Two visions for the future of sourceware.org

Stranger is the governance structure (of what? the hosting? all of sourceware and all the software running on it? do they have veto power on what the projects can do, or is this just overseers again under a new name?) where in return for huge piles of money -- paid, as far as I can tell, from the new sponsors to the hosting organization of their choice, *quite possibly themselves*, so this is quite possibly only money in theory, like living in a house you own is foregone rent -- the sponsors get to occupy almost all the seats on the new governance board, leaving only *one* for a rep of the actual projects. So a huge loss of control compared to now where overseers are almost all involved in various projects too. Indeed the original talk was all about the neat things that that control were letting them do and the services they were providing, which would probably be impossible in this new world because they'd be beholden to asking, and probably paying, someone else instead.

And, uh, what are the benefits? Well, unnamed third parties are worried about "cybersecurity" causing the projects to not be allowed in various other projects. Were there any actual examples? Not in the first half of the talk, and even if there were this appears to be third parties engaging in what looks very like extortion, threats to obtain a desired end, particularly if some of them are among the sponsors (not saying they are because the sponsors' identities are also largely unknown, a really good look for this sort of thing). Generally one doesn't respond to extortion by saying "yeah, good, go on, you can have all but one seat on the governing board".

Presumably, going by their actions, the unnamed third parties are worried about attackers getting into the hosting, rather than about the actual developers, at least for now, but who's to say they wouldn't start using the same argument to impose extra constraints on who can push to the GNU toolchain software on their hardware in future? Not working for an approved employer? Goodbye, you can always switch jobs! They can even use the exact same excuse. Only approved employers are "secure". This sort of thing is routine in the proprietary world, and no doubt that's the sort of entity pushing this.

Also, this whole thing is also only worthwhile if the "professionally managed hosting" is vastly better than what it replaces. As we know cloud infrastructure and hosting providers are perfectly secure and never go down, oh wait no they're a really big basket containing lots of eggs, and an even bigger target for attackers!

Honestly to me it seems like the right solution is preventing people messing with the repos, and oh look we're using git so that's easy. It's pretty obvious if anyone messes with history because everyone's pulls conflict suspiciously (and if it was way back in history, fixing it is *hard*, needs hacking at everyone's individual working repos, and will stand out a mile). For recent commits getting locally committed under someone else's name, we also already have a fix: get everyone to sign their commits. SSH keys are fine, they can stick them up somewhere else on the web, on a SSL-signed domain they control or on a verified github account or something, or just get people to vouch for each other. The feature's only been in git for about ten years -- but quite possibly teaching these third parties' security consultants that git commit signing is even possible will be very hard, as will teaching them why git histories are hard to surreptitiously modify. Such people are almost always box-tickers and their boxes are often decades out of date. Maybe you can call git a blockchain to make them happy.

Attackers can also modify the system configuration (and often do), so keep the system config in git too and autovalidate it every N hours, and an attacker can only get in for N hours before their changes are reverted and the system sounds the alarm.

As someone who wasn't even at cauldron, and whose only previous impressions of Carlos have been enormously positive: if Carlos had *wanted* everyone to look on this as a giant and distinctly ugly conspiracy akin to the attempted takeover of .org by venture capitalists helmed by the person then running .org (also described as critical for security reasons, and it didn't happen and none of the promised disasters came to pass), I'm not sure he could have done better. I am baffled.