1. The Rise and Fall of Open Source
Or: Forkbombing an OSS community project

2. The Rise and Fall of Open Source
Welcome from the
Legion of Free Mawers
of the Temple of Eris!

3. The Rise and Fall of Open Source
Advisory
Product Overview
Strengths
Exploit
Vulnerability analysis
Similar vulnerabilities
Threat mitigation
Discovered by

4. The Rise and Fall of Open Source
Product overview – The Rise
Originally, only Open Source software existed
Collaboration of companies and universities
Closed Source was a kid of the 80s
Open Source was converted to a paradigm
Lots of books and dissertations
Fnord

5. The Rise and Fall of Open Source
Product overview – The Fall
During the dotcom era, a lot of commercial support got lost
Lots of forks have been made during the last few years
Few people working on many projects – few people per project
Only maintenance cost can be covered

6. The Rise and Fall of Open Source
Product overview – Strengths
Open Source can be maintained by anyone
Forks are easy if they ever become necessary
Anyone can take the code and do as he pleases with it
Everyone can contribute – combined knowledge of the entire community goes into the project
Fnord

7. The Rise and Fall of Open Source
Product overview – Strengths
Dynamic – no market constraints or shipping regulations for certain versions
No «The version must be out on November 1st – with or without bugs»
For an example, see FreeBSD

8. The Rise and Fall of Open Source
Exploit
Forks involve serious consequences for the community
Developers tend to disagree on certain matters
Open Source makes forking easy
The maintenance cost per project is a constant
If a project gets forked, the maintenance cost is doubled

9. The Rise and Fall of Open Source
Exploit
Maintenance cost (security patches etc.) hogs up the developers
Project can get to a state were no innovation takes place, because the given resources only cover maintenance → innovation is stalled
Worst case: project cannot cover the maintenance cost → gets gradually unusable

10. The Rise and Fall of Open Source
A practical exploit
A project falls into the same category as a big bad company's product
The big bad company sends a mole into the project's core group
The big bad company waits for the project to become usable
Fnord

11. The Rise and Fall of Open Source
A practical exploit
The big bad company instructs the mole to provoke a fork of the project
The project forks until innovation is stalled
The big bad company copies the functionality of the project and integrates it into their product
Everyone uses the product while the project wastes away

12. The Rise and Fall of Open Source
How a programmer works
Input → Confusion → Output

13. The Rise and Fall of Open Source
How a programmer works
Confusion := \
Internal Confusion || \
Preference-Induced Confusion || \
Problem-Induced Confusion || \
Syntax-Induced Confusion || \
Personal Confusion

14. The Rise and Fall of Open Source
How a programmer works
Confusion := \
Internal Confusion || \
Preference-Induced Confusion || \
Problem-Induced Confusion || \
Syntax-Induced Confusion || \
Personal Confusion

15. The Rise and Fall of Open Source
Vulnerabilities
Developers disagree over certain technologies and some decide to fork off a new project embracing the new technology
Developers get mad at each other for personal reasons and a fork is created for each competing party
Developers disagree over the source control system and fork off a new project with a different SCM
Fnord

16. The Rise and Fall of Open Source
Vulnerabilities
Rewrite competitors
Out-Of-Tree ports

17. The Rise and Fall of Open Source
Non-Vulnerabilities
Sometimes, a not-so-benevolent dictator stalls innovation (Xfree86-X.Org fork)
A copy of the source tree can be published and still kept compatible, so it doesn't constitute a fork
Some projects do research in different areas but keep their code more or less compatible (BSD projects)

18. The Rise and Fall of Open Source
Threat mitigation
Diversification inside the project tree: Branch off, experiment, don't simply fork
Keep your mouth shut – there is no reason to mix personal disagreement with technical reasoning
Model: managed diversity (BSD style)
Fnord

19. The Rise and Fall of Open Source
Questions?
WTF?!

20. The Rise and Fall of Open Source
Thanks
Thanks a lot for listening
Hope you slept well
All hail Discordia!