The Rise and Fall of Open Source Or: Forkbombing an OSS community project

The Rise and Fall of Open Source Welcome from the Legion of Free Mawers of the Temple of Eris!

The Rise and Fall of Open Source Advisory Product Overview Strengths Exploit Vulnerability analysis Similar vulnerabilities Threat mitigation Discovered by

The Rise and Fall of Open Source Product overview – The Rise Originally, only Open Source software existed Collaboration of companies and universities Closed Source was a kid of the 80s Open Source was converted to a paradigm Lots of books and dissertations Fnord

The Rise and Fall of Open Source Product overview – The Fall During the dotcom era, a lot of commercial support got lost Lots of forks have been made during the last few years Few people working on many projects – few people per project Only maintenance cost can be covered

The Rise and Fall of Open Source Product overview – Strengths Open Source can be maintained by anyone Forks are easy if they ever become necessary Anyone can take the code and do as he pleases with it Everyone can contribute – combined knowledge of the entire community goes into the project Fnord

The Rise and Fall of Open Source Product overview – Strengths Dynamic – no market constraints or shipping regulations for certain versions No «The version must be out on November 1st – with or without bugs» For an example, see FreeBSD

The Rise and Fall of Open Source Exploit Forks involve serious consequences for the community Developers tend to disagree on certain matters Open Source makes forking easy The maintenance cost per project is a constant If a project gets forked, the maintenance cost is doubled

The Rise and Fall of Open Source Exploit Maintenance cost (security patches etc.) hogs up the developers Project can get to a state were no innovation takes place, because the given resources only cover maintenance → innovation is stalled Worst case: project cannot cover the maintenance cost → gets gradually unusable

The Rise and Fall of Open Source A practical exploit A project falls into the same category as a big bad company's product The big bad company sends a mole into the project's core group The big bad company waits for the project to become usable Fnord

The Rise and Fall of Open Source A practical exploit The big bad company instructs the mole to provoke a fork of the project The project forks until innovation is stalled The big bad company copies the functionality of the project and integrates it into their product Everyone uses the product while the project wastes away

The Rise and Fall of Open Source How a programmer works Input → Confusion → Output

The Rise and Fall of Open Source How a programmer works Confusion := \ Internal Confusion || \ Preference-Induced Confusion || \ Problem-Induced Confusion || \ Syntax-Induced Confusion || \ Personal Confusion

The Rise and Fall of Open Source How a programmer works Confusion := \ Internal Confusion || \ Preference-Induced Confusion || \ Problem-Induced Confusion || \ Syntax-Induced Confusion || \ Personal Confusion

The Rise and Fall of Open Source Vulnerabilities Developers disagree over certain technologies and some decide to fork off a new project embracing the new technology Developers get mad at each other for personal reasons and a fork is created for each competing party Developers disagree over the source control system and fork off a new project with a different SCM Fnord

The Rise and Fall of Open Source Vulnerabilities Rewrite competitors Out-Of-Tree ports

The Rise and Fall of Open Source Non-Vulnerabilities Sometimes, a not-so-benevolent dictator stalls innovation (Xfree86-X.Org fork) A copy of the source tree can be published and still kept compatible, so it doesn't constitute a fork Some projects do research in different areas but keep their code more or less compatible (BSD projects)

The Rise and Fall of Open Source Threat mitigation Diversification inside the project tree: Branch off, experiment, don't simply fork Keep your mouth shut – there is no reason to mix personal disagreement with technical reasoning Model: managed diversity (BSD style) Fnord

The Rise and Fall of Open Source Questions? WTF?!

The Rise and Fall of Open Source Thanks Thanks a lot for listening Hope you slept well All hail Discordia!