Open-source software

'Cause we have somewhat common background, and I, I would love to hear your thoughts on some of these things that it's may not, may not be as related to the AI, AI infrastructure, but it's kind of related to everything we're talking about and doing in our day to days.

So first of all, what's your thoughts on like OSS models? And what I mean by that is today a lot of say, "Oh, this model's OSS," but it's really not.

It's open weights, right? And do you think there will ever be a truly OSS model like run by Linux Foundation or CNCF? Like what would it take and what is your thoughts on like something like that ever happening?

So that is an excellent, excellent question.

I know I talk long, so just, I don't know, scratch your nose or something-

And that was unique because a lot of the sort of previous sharing of technology from Google, whether it be Big Table or GFS or MapReduce, had been in the form of academic papers.

and then you would see that like there would be communities formed around these things, whether it be the Netflix OSS stuff or whether it be Hadoop and they would just do it in a slightly different way.

And so there was innovation that took things beyond what Google would do.

And there was zero way for Google to reimport that expertise and that, that, that code back in.

It runs the Phosphogy North America event.

it's all about a kind of infrastructure, a technology for building resilience, either in code, but then underpinning a lot of the data efforts that we've got, but it's about free open source software for geospatial applications.

So there's a community thing, and I would urge as many of you as can, try to get involved in those efforts, because they are both important in their own right for, like Ryan Burley was showing for, you know, enabling us to share data, enabling us to display data, enabling us to analyze data.

Adam Tim talked about enabling us to access databases and use those at scale more effectively, et cetera.

But then, you know, open source software underpins so much of what OpenStreetMap is actually doing in the collection.

And then, you know, I've been lucky enough to go to a couple of OpenStreetMap OSM events.

The work that you all have done in the Fed Geoday community has exhibited people like Daryl that are actively involved with federal agencies trying to work with OpenStreetMap to actually extend their reach, extend the things they're doing.

Changing the conversation around crowdsource data and its value.

Elastic's Elasticsearch offers an OS version but charges for hosting and advanced security features.

Here distribution becomes the engine because anyone can install the OSS stack locally paying customers are those who want a turnkey fully supported service with SLA guarantees.

That's where managed services come in.

Providers like Databricks built an entirely managed analytics platform on top of Apache Spark which is open source but complex to configure at scale.

This allowed them to lock in users without making the core code proprietary.

But that also meant that if a competitor decided to create an alternative orchestration system, they'd have to convince the community that the new stack was as powerful or better than Kubernetes.

That's a hard sell because developers invest time in learning APIs and writing code for one orchestrator switching costs rise Now, when we talk about licensing models, we have to distinguish between pure OSS, where anyone can run the code and proprietary extensions that may require paid licenses or cloud access tokens.

A notable example is Grafana.

Brandon is one of our product managers on GKE.

He has been one of the people behind launching multiple OSS projects like Ray Operator, Agent Sandbox, and our topic for today, the Agent Substrate.

Welcome to the show, Tim and Brandon.

Thanks for having us.

Hey folks, this week I talk with Benjamin Samuels of Trail of Bits, and we're talking about Patch the Planet.

That's the Trail of Bits initiative to help open source projects deal with the absolute tidal wave we're all seeing of pull requests, bug reports, and vulnerability disclosures.

This is Floss Weekly, episode 880, recorded Tuesday, September the 1st.

The Two Wolves.

it's time for floss weekly that's the show about free libre and open source software i'm your host jonathan bennett and today we're talking about something really cool we've got benjamin samuels of trail of bits and he does their boring blockchain thing that we may cover a little bit but the other thing he's involved in is patch the planet which is all about helping open source projects with security problems And reading the notes ahead of time, I happen to know that, you know, take a drink.

We're going to talk about AI, but not necessarily the everybody should using it.

But this is causing a problem for some open source projects.

How do we deal with that? So we'll get into all of that.

Welcome, everybody, to another edition of Coffee in Open Source, a place that meets new friends, have some great conversations, and maybe learn something on the way.

I'm your host, Isaac Levin.

And if you're enjoying the conversations here, be sure to like, subscribe, follow, whether you're watching or listening.

Like, do I care? like, what are you with that? Like, I'm trying to find this balance of, like, do I care if an agent builds me an app in .NET versus, like, for existing stuff, for sure.

Like, if I have an existing project I've been working on, like, you know, the old way, the old-fashioned way, obviously I want it to follow my... coding practices i wanted to do things right i want to use the the the latest nougat packages and all these things but i'm green generating like an app from scratch like a vibe code app that i want to like do a demo of or whatever like do i really care what language is written in

yeah yeah that's a good point so we in fact just uh had a customer conversation about the open source things we are doing and it's exactly this point so here's where i stand like if it's like to your point if it's like a quick demo if it's a proof of concept, it's like for my kids' school, something quick and easy, then I literally do not care, right? I mean, it's a language I'm sure I can read and make sense of it.

And even if it comes down to maintaining it a little bit, I can.

But the moment it becomes a little bit serious is where I start caring.

I'm your host, Matt Treiner, with more years in DoD trenches than I care to count.

And today we're tackling a topic that is controversial as pineapple on pizza, the use of open source software in the Department of Defense.

Now, before you roll your eyes or clutch your proprietary software licenses, let me assure you, this is going to be a spicy discussion.

Joining me in the hot seat today are two brilliant minds from Hunter Strategy.

Great to have you, Nate.

Thanks for having me.

So what's on the menu today? We'll be serving up a heaping helping of insights from why open source software can be a game changer for DoD, but also why it can sometimes feel like playing with fire.

We'll talk about benefits like cost savings, flexibility, and community driven innovation.

是吗？又不是电脑喔，是吗 [笑声]？

是啦，呃，它不是电脑，是啦，又不是手机，不过虽然它可以在手机上面 run，OK。呃，呐，其实事发经过是这样的，那么我就在，呃，在我，呃，家里的 Google TV 上面呢，就，呃，首先 sideload 了 F-Droid 啦，那么就装了一个叫做 AirPlay Server 的一个 open source 软件下去的。

喂，给大家认识下什么叫 F-Droid 先，未必个人知道什么叫 F-Droid 啊。

呐，F-Droid 呢，就是一个，就是 open source 的一个-

App Store。

App Store。呃，是啦，是 Android 的 App Store 啦，那么可以装到 APK 这样落去你的，就是，呃，Android 的 device 啦，这样。

App 都是，呃，free and open source 的。

是啦。