LWN: Comments on "McGrath: Red Hat’s commitment to open source"

McGrath: Red Hat’s commitment to open source

MattJD — Tue, 25 Jul 2023 14:21:46 +0000

Also from the terms:

> The Individual Developer Subscriptions allow you (as an individual, natural person) to use certain Red Hat Subscription Services in connection with Red Hat Software for Individual Development Use and for Individual Production Use subject to these Program Terms at no cost.

I don't know why they are making a distinction, but they explicitly allow both uses.

McGrath: Red Hat’s commitment to open source

kleptog — Thu, 13 Jul 2023 19:27:27 +0000

People should really read the whole text[1], it's not long. The passage quoted above is merely the definition of Individual Production Use, the rest of the subscription doesn't distinguish between production and non-production. The distinction is probably for some legal purpose not relevant to us.

And suing? Really? Yes, in theory RedHat can sue anybody, but as an individual the law really limits what they can do to cancelling your subscription. They're not going to sue you unless you happen to be a million dollar business pretending to be an individual developer, because then consumer rights won't protect you.

It feels like some people here want to find a reason to hate RedHat. I don't use RedHat, never have, but I don't think they're evil or anything.

[1] https://developers.redhat.com/terms-and-conditions

McGrath: Red Hat’s commitment to open source

pizza — Thu, 13 Jul 2023 16:44:19 +0000

> So, Red Hat can sue you any time if you just use packages of their repositories (without any of your own development) in the production environment? Meaning, this is so confusing and ambiguous, that I would immediately run to openSUSE or Debian.

...Debian and OpenSUSE are not equivalent to, or substitutes for, RHEL (or even CentOS Stream), especially where the support window is concerned.

(Unless of course you never actually needed RHEL to begin with, and/or were just using one of its rebuilds because you didn't have to pay anything for it)

Seriously, please, there are a lot of options, but don't delude yourself into thinking that the grass is necessarily greener everywhere else -- Each of those options represents a different culture, warts, and compromises.

McGrath: Red Hat’s commitment to open source

ceplm — Thu, 13 Jul 2023 16:24:55 +0000

Exactly:

> “Individual Production Use” means any use other than for Individual Development Use including, but not limited to, using the Software (a) in a production environment, (b) with live data and/or applications and/or (c) for backup instances.

So, Red Hat can sue you any time if you just use packages of their repositories (without any of your own development) in the production environment? Meaning, this is so confusing and ambiguous, that I would immediately run to openSUSE or Debian.

McGrath: Red Hat’s commitment to open source

kleptog — Tue, 11 Jul 2023 11:20:28 +0000

The bank does not physically check the signatures. The organisation setting up the direct debit asserts to the bank that they have received appropriate permission (a signature isn't the only way). In exchange, the end-user gets prior notification of the direct debit and can cancel it anytime and even undo any direct debits for the last 13 months. And the bank will charge the organisation setting up the DD a hefty charge-back fee. Do it too often and they'll kick you off altogether.

For this reason my apartment management refuses to do DD for the monthly service costs, because of shenanigans with people selling their apartment and then reversing all the fees for the previous year. Sure, you can prove that you had the right to do DD, even a signature, but you'll have to send it to debt collection or even the courts to get your money.

So yes, someone could publish their IBAN here and I could (attempt to) setup a direct debit for it, but it would be fraud. Really big organisations like energy and insurance companies use DD because people undoing direct debits without cause is just another one of the many things that can go wrong and it's just a cost of doing business.

McGrath: Red Hat’s commitment to open source

paulj — Tue, 11 Jul 2023 08:45:17 +0000

No signature is required for DDs in a number of countries, AFAIK. If a company wants to set up a DD, they just need your bank details to do so. And someone can misrepresent themselves to a company and give your bank details. I guess the company has to swallow the cost when it's discovered, but it will still cost you one or more mornings of phone calls to get it sorted out. See my sibling comment.

McGrath: Red Hat’s commitment to open source

Wol — Mon, 10 Jul 2023 20:42:22 +0000

You clearly haven't set up a DD in the UK (and possibly Europe). It's incredibly easy to set up a fraudulent DD. It doesn't happen often, because (a) it's normally easily reversed, and (b) the banks are legally on the hook.

It's just a right pain if you're the victim, which is why I tend to treat my current account details as seriously private.

Cheers,
Wol

McGrath: Red Hat’s commitment to open source

zdzichu — Mon, 10 Jul 2023 17:16:27 +0000

How someone could setup DD without my authorisation? They would have to forge my signature.

McGrath: Red Hat’s commitment to open source

paulj — Mon, 10 Jul 2023 16:39:06 +0000

In my case, every time I cancelled the DD the company doing so would simply set it up again. The bank could not tell me exactly which company. I had to make an educated guess, based on the name. Some kind of payday loan company. However, ringing up the company a) Cost money (another country) b) They either had no record of me as a customer, under my name - or at least, that's all they would tell me given I couldn't give them any customer account / reference number.

In the end my bank had to completely remove the ability to setup DDs on that account to stop this DD reappearing again and again - they didn't have a function to refuse /specific/ DDs.

McGrath: Red Hat’s commitment to open source

paulj — Mon, 10 Jul 2023 16:31:22 +0000

Oh, and in the UK Jeremy Clarkson famously published his bank account details, as part of his claims in his column that some other data privacy breaches of bank account details were not important. Someone then disabused him of this by getting a DD setup out of his account.

http://news.bbc.co.uk/2/hi/7174760.stm

McGrath: Red Hat’s commitment to open source

paulj — Mon, 10 Jul 2023 16:29:02 +0000

If someone sets up a DD you did not authorise, you should be able to get it cancelled easily. Getting it refunded can still eat some of your time, phoning and emailing the bank and/or the business concerned.

A company could maliciously setup a DD or - more the case - someone who has your details may misrepresent themselves to a company and have a DD setup to your bank account (possibly obtaining some service or goods from said company, as part of a fraud). You should get your money back, but it can still cost a bit of a time.

Guess how I know.

McGrath: Red Hat’s commitment to open source

zdzichu — Mon, 10 Jul 2023 15:47:17 +0000

Maybe this is the France being special, or maybe some misunderstanding? Here in Poland we have savings accounts and settlement accounts (or more common hybrid savings-settlement accounts). Saving accounts typically have higher interest rate, but various limitations – like the number of free wire transfers per month or transfer only to predefined destinations.

Settlement accounts are more flexible. It is typical to give the account number to people to receive money (like when splitting the receipt). It is totally safe. There is a possibility of setting up direct debit for the account, but it requires account owner agreement.
I have DD setup with my mobile phone company, it works smoothly. I'm not aware if there is a possibility to limit direct debit amount. But I'm sure if the telecom ordered a transfer bigger than usual 10 EUR (that's monthly for 2 phones), I would have complaint processed quickly either by my bank or by the telecom itself.

McGrath: Red Hat’s commitment to open source

geert — Mon, 10 Jul 2023 15:33:54 +0000

Interesting. Anyone can wire funds to my (Belgian) savings account, but only the account (mandate) holder can withdraw or wire funds from it.

Hence for receiving money (e.g. as a gift suggestion on a wedding invitation) people typically hand out a savings account number, which works also for children who are too young to have a checking account (which does not mean they can get married, though ;-).

McGrath: Red Hat’s commitment to open source

glondu — Mon, 10 Jul 2023 13:36:49 +0000

I don't know about other countries, but in France, only the owner of a savings accounts (or his/her legal representatives) can wire funds to it. So it is not suitable for micro-donations. While setting up an IBAN only for receiving micro-donations (via SEPA) seems possible in theory, I would say it's not convenient in practice (and I am not aware of such commercial offering in France).

McGrath: Red Hat’s commitment to open source

Wol — Fri, 07 Jul 2023 16:17:56 +0000

> And bear in mind that once you publish such details it's possible for others to setup direct debits.

If the recipient is sensible, an attacker CAN'T set up direct debits.

Most accounts are fully part of the banking system - sort codes, bank account numbers, IBAN etc. Not all, however, are current (checking) accounts.

If I publish bank account details, I always use a savings account, where much of this functionality just doesn't work. RECEIVING money always does, though. I would have no worries whatsoever making this info available on the Internet.

Cheers,
Wol

McGrath: Red Hat’s commitment to open source

paulj — Fri, 07 Jul 2023 11:07:41 +0000

Least, Wise definitely charge money for certain accounts, e.g. business. And also certain kinds of transfers on top of that.

McGrath: Red Hat’s commitment to open source

farnz — Fri, 07 Jul 2023 11:06:03 +0000

I've attempted to send you money. Tell me how much I sent when you get it.

McGrath: Red Hat’s commitment to open source

paulj — Fri, 07 Jul 2023 11:04:06 +0000

Also, Wise is not free. Wise cost you money to buy-in too.

McGrath: Red Hat’s commitment to open source

paulj — Fri, 07 Jul 2023 11:02:37 +0000

Ok, if Wise + SEPA is so much better and so much more suitable for public solicitation of micro-payments/tips, please give me your details so I can send 5c.

I am quite happy to give you my details for my preferred system: 87774rpgLdmjCFLqyV3BYN6VwBzdvaVbccVUF2K3NHGEFyoQKxCTqcxeDcPHpQPixqitthXhYK5uGbYuFExff24ACiaAUkH

McGrath: Red Hat’s commitment to open source

farnz — Fri, 07 Jul 2023 10:19:50 +0000

It's one of many alternatives - I use Wise, but I could have the same from Starling Bank, Revolut, or HSBC (to my knowledge - I chose Wise simply because of the four I looked at, they were the first to get back to me with confirmation that they could give me the specific letters I needed to get through the processes a US sender of currency wanted me to follow to get money from them).

The clearing system will be SEPA, for Euro payments to any of those three.

And I have related problems with Monero - there's no guarantee that any of the exchanges will let me convert my Monero into useful currency, nor is there a guarantee that if I use an exchange to turn Monero into real money that I won't then be held personally liable for someone else's financial crimes. At least with traditional banking, I'm guaranteed (by regulation) that the banks are the people liable, not me.

Note, too, that even if I go for the expensive option, the fees are still lower than Monero (0% to buy in as compared to Monero's 2.5%, zero transfer fee as compared to Monero's fraction of a cent, and 2% buy out fee, as compared to Monero's 2.5%). It's just that Monero splits the fees up so that you're hyper-focused on the thing that's free to me in the credit card system, and pointing out that that component of the fees is smaller than the total fees in the card system.

McGrath: Red Hat’s commitment to open source

paulj — Fri, 07 Jul 2023 09:58:57 +0000

Also, Wise is kind of cheating a little. It's 1 company, not a clearing system. And there's no guarantee a) Wise will have you as a customer, b) Wise will keep you as a customer (e.g., if the balance of currency flows from your account doesn't fit in with their business, they may kick you).

McGrath: Red Hat’s commitment to open source

paulj — Fri, 07 Jul 2023 09:56:58 +0000

Ok, reply here with your bank details (name and IBAN), and I'll send you 5c.

I will quite happily give a Monero address here.

McGrath: Red Hat’s commitment to open source

paulj — Fri, 07 Jul 2023 09:53:54 +0000

And I'm serious - post your name and IBAN and I'll see if I can send 5c.

And bear in mind that once you publish such details it's possible for others to setup direct debits. ;) (Inc giving those details to another company to setup a DD to pay for something).

McGrath: Red Hat’s commitment to open source

farnz — Fri, 07 Jul 2023 09:48:57 +0000

You ask me for my Euro bank details, and send me a SEPA payment - I have an account with Wise that has banking details in multiple regions, including the Eurozone, USA, Canada, Australia, Singapore and other places, and I can get accounts with other providers who will give me account details in a foreign banking system.

And the other way I could take a micropayment is via the credit card system - I can get a card handling setup that has fees of 2%, minimum withdrawal £50, if I want to take micropayments. Compare that to the best I can do with Monero - 2.5% fees, minimum withdrawal also £50. If credit cards are a non-starter, Monero is also a non-starter, because the fees are higher.

This is the fundamental problem with Monero as a solution - you take my total 2% fee for credit cards, and you split it into a 2.5% fee for buying into the system, a transaction fee, and a 2.5% fee for buying out of the system. If you did the same split for credit cards, it's 0% to buy into the system, no transaction fee, and a 2% fee for buying out of the credit card system.

McGrath: Red Hat’s commitment to open source

paulj — Fri, 07 Jul 2023 08:44:35 +0000

The use case here, the context of this sub-thread, is global Internet micro-payments. That's a use-case *not* served by the (not many) regional fast+free regional banking clearing systems, which are restricted to deal in the same currency (UK Faster Payments, SEPA Instant - not sure about US).

Outside those exceptions, if you want micro-payments to anywhere, Monero is probably the best and most accessible (for sure if you value privacy; and if we're talking global use cases, donations to projects that may displease one's local authoritarian regime are certainly one).

We are simply /never/ going to see any trad-banking-model, no-currency-exchange (i.e. single currency), global micro-payments system. So I appreciate that in your particular region, for your particular currency, you may have a local banking system that can meet that need /slightly/ cheaper. And go use that for donations to your project for others in the same region! But, that's not going to work globally, and it never will!

You're in the UK I think. How do I make a donation of, say, 5 Euro cents, to you for some project of yours via the banking system?

McGrath: Red Hat’s commitment to open source

cortana — Thu, 06 Jul 2023 17:24:15 +0000

> Self support on the free tier makes it *really hard* to file a bug for RHEL.

Hm. I've filed a few bugs in Bugzilla and some have been fixed, others I've corresponded with developers and are not, I think, in a state where they'll rot forever.

subscription-manager is always a pain to deal with though even when it's working. And it's so s...l...o...w...!

McGrath: Red Hat’s commitment to open source

cortana — Thu, 06 Jul 2023 17:20:27 +0000

No, the terms are in the Red Hat Developer Subscription for Individuals subscription agreement:

McGrath: Red Hat’s commitment to open source

farnz — Thu, 06 Jul 2023 16:55:47 +0000

From my perspective, Monero involves me paying about 2.5% fees to turn local currency into Monero, then a transaction fee to get the Monero to the recipient, who has to pay about 2.5% to turn the Monero back into their currency. Compare that to credit cards, where the recipient can pay about 3% fees in total - if credit card payments aren't suitable for micropayments due to fees, then Monero, with its higher fees is definitely not suitable.

And that's the problem - Monero doesn't actually solve any of the issues that affect micropayments. To use it as an actual payment mechanism requires either someone to bootstrap it to the point where I can deal solely in Monero (e.g. paying my taxes, my food bills, my housing bills etc in Monero), without introducing a significant crime problem (since a significant crime problem means that I can't use Monero for other transactions).

Otherwise, all I see is higher fees than credit cards (around 5% for Monero, to at most 3% for cards, and at most 0.5% for international bank transfers with the accounts I have), just split into three buckets instead of being a single monolithic fee.

McGrath: Red Hat’s commitment to open source

paulj — Thu, 06 Jul 2023 16:10:13 +0000

In the context of the micro-payments in this discussion, 10c is a lot.

McGrath: Red Hat’s commitment to open source

paulj — Thu, 06 Jul 2023 16:09:19 +0000

The context here is micro-payments. Can you make and accept micro-payments with the banking system? Globally? Or at least, between the major developed economies? It's great you can do SEPA within Europe, but... how would an EU project accept micro-payments from a US resident? And vice versa?

Yes, buying some Monero, to have to hand to distribute micro-payments to whatever X number of projects you want; and a project taking X micro-payments to an exchange to convert to the local currency might cost 4%, but if the alternative is: No micro-payments, then Monero wins. Does it not?

That said, I was talking more about the technology, not the value of the underlying token. The value and utility of the token recorded in a distributed ledger is a social issue, not technological.

Given Monero is designed to have much lower inflation (in the long-term) than any fiat currency you would have used to buy it with, one could argue "Why convert back to fiat? Just hold what you don't immediately need to convert - it will (slowly) appreciate". But that's not a technology argument, and not really on-topic for LWN. ;)

AML: Centralised Exchanges are required to comply with AML laws. Further, if you're dealing just in small amounts, AML laws may not apply to you in your jurisdiction. There is a whole other debate here about the social wisdom of governments stripping away privacy in transactions between citizens, with an evident goal of acquiring complete state insight into /all/ financial transactions - as described in working documents from various central banks and EU and others. But again, I guess not on topic for LWN. (I don't think it is wise, and I think privacy is a fundamental requirement to have some robustness against state oppression in the long run, and we should have that privacy even IF that privacy also enables some criminal use of money - cause you're not going to stop criminals finding things of value to exchange anyway; but hey).

McGrath: Red Hat’s commitment to open source

anselm — Wed, 05 Jul 2023 07:49:54 +0000

No, I wouldn't. I prefer Debian.

McGrath: Red Hat’s commitment to open source

ceplm — Wed, 05 Jul 2023 07:47:46 +0000

Yes, and you would base your company on this side comment somewhere in the documentation. Congratulations, you are the most courageous (or reckless) entrepreneur of the year!

McGrath: Red Hat’s commitment to open source

mathstuf — Tue, 04 Jul 2023 21:23:15 +0000

I think this is more about the oodles of `--enable-*` flags that end up existing in C and C++ projects over time. Do you want network support? How about MPI? Sanitizers? Oh, you are missing some deps, that's OK, we'll just "helpfully" silently disable some features for you. Oh, we found some obscure dep on your machine, let's "helpfully" enable some broken part of our code.

Python, Rust, etc. have much more narrow "how is this built again?" style questions that tend to accumulate in the C and C++ ecosystem.

McGrath: Red Hat’s commitment to open source

ssmith32 — Tue, 04 Jul 2023 18:56:18 +0000

What ecosystem is this?

I've worked in several different ones, from PHP, to C/C++, Java, and JavaScript.. they all have these issues, in some form.

McGrath: Red Hat’s commitment to open source

farnz — Tue, 04 Jul 2023 10:38:12 +0000

Have you looked at fees for international bank transfers? E.g., SWIFT? Have you looked at the fees that card payment processors charge?

I do fee-free transfers internationally with my banking setup; I also get a decent exchange rate in the process. Just for kicks, I've looked at what would happen if I tried to do the transfer by buying Monero with one currency, and selling it for the other, and I'd get about 97% of what I get by doing international bank transfers by the time I'd paid the various exchange fees converting USD to Monero, and Monero to local currency.

I also looked at what I'd end up getting if I did local currency to Monero to local currency, avoiding the credit card processors - the total fees for that route end up being around 4% to 5% (as in, I start with $100, I end up with $95 to $96 out), where I can get under 3% from credit card processors (where I get $97 to $97.20 out from $100 in). Further, with the card processors, I'm guaranteed compliant with my local anti-money-laundering and know-your-customer regulations (since the card companies take care of that); Monero exchanges require me to take that risk on myself. This risk is an unlimited fine and up to 15 years in jail for failing to perform adequate checks on the sources of funds.

I have heard complaints like yours from people transferring money in and out of Poland and Hungary, where the local banking system isn't yet as well-regulated as elsewhere, but I would be wary about generalising from those countries.

McGrath: Red Hat’s commitment to open source

paulj — Tue, 04 Jul 2023 08:36:40 +0000

"I can't be the only one who thinks that a decision of this magnitude [has] some hard data backing it up."

You may think so, maybe others, but anyone with experience of suits at big corporations also know decisions like this often get made without hard data. Indeed, anyone with experience will know such suits often have a very strong presumption /against/ things like goodwill and intangible value being of benefit to the corporation's bottom line.

McGrath: Red Hat’s commitment to open source

anselm — Tue, 04 Jul 2023 08:20:37 +0000

Officially it is the development version only for development.

According to Red Hat, “the no-cost Red Hat Developer Subscription for Individuals may be used for demos, prototyping, QA, small production uses, and cloud access” (emphasis mine).

McGrath: Red Hat’s commitment to open source

ceplm — Tue, 04 Jul 2023 06:19:55 +0000

Officially it is the development version only for development.

McGrath: Red Hat’s commitment to open source

jccleaver — Mon, 03 Jul 2023 22:31:38 +0000

The problem here (for Red Hat) is that adopting an antagonistic posture toward rebuilds won't force a long-term change here. The underlying code is open source; the patches are open source. SRPMs can be re-assembled, and OSS collaborators can simply work harder to try to get it back to the same level that CentOS Linux had been in the EL6 and EL7 era. At best it delays things, and the cost was a huge amount of goodwill.

Furthermore, this recent action really can't be taken alone, separately from the decision two years ago to clobber EL8 rebuilds halfway through the RHEL8 lifecycle. McGrath at that point clearly demonstrated on the CentOS list where he seemed to dig even deeper with every possible opportunity: eg, https://www.spinics.net/lists/centos-devel/msg19597.html

Oracle and Amazon can throw whatever amount of money they want at reverse-engineering EL. If that's their concern, then they haven't figured out yet that it's better to co-opt your enemies than fight them. Demonstrate what RedHat's value is and cash in some of that goodwill. Instead, they've burned their goodwill and Oracle and Amazon will do whatever it is they want to do anyway, and CloudLinux, Rocky/Alma, and NASA or whichever lab decides to work on Scientific Linux 2: Electric Boogaloo will find a way to formalize support for things that they now actually have a larger claim to have placed real value into, based solely on the amount of (re-)engineering effort they're now having to put in.

McGrath: Red Hat’s commitment to open source

abufrejoval — Mon, 03 Jul 2023 20:13:22 +0000

> Have you looked at fees for international bank transfers? E.g., SWIFT? Have you looked at the fees that card payment processors charge?

I work for one and I can assure you, that we're a lot cheaper, at least within a relatively local range (say within the EU).
Cheaper than cash generally, because people tend to forget that cash has significant cost and risks (and feathers a more comfortable stuffing).

You can certainly buy a sandwidch for €2.50 anywhere within the Eurozone, even with VISA or MC involved without everybody losing money on the transaction, I see kids buying sweets for €0,50 using plastic. And they don't have to wait until the candy has melted before the transaction is validated, either.

We've come a long way...

In the good old day, yes we got 2% and we bought a new IBM mainframe every other year. But at current interchange fees we try to save money with CentOS.

You see, we can't really afford five minutes of down-time, let alone hours. By the time any human Redhat support person has even answered the phone, we have blood running along our office corridors and mutiny in the shops.

There is some value in Redhat code, but to us no value in their support.

We paid for RHEL, but ran CentOS, simply because it avoided having to deal with the whole business workflow of subscriptions. And we ran for a long time on OpenVZ, which Redhat stupidly ignored, pushing for CXL, VMs or Podman.

They can be an incredibly arrogant and pig headed bunch of people and it's rather unfortunate that those types are now ruining a company that has or at least used to have people of very different mindset.