"As adoption has grown, so has our responsibility to ensure the project remains sustainable and continues to thrive. That’s why, with the release of Liquibase 5.0, we are updating the license for Liquibase Community." www.liquibase.com/blog/liquiba...

PSA: attacks on public infrastructure like software package registries are on the rise. Here’s an active one targeting folks who have crates.io accounts.

It’s really hard for OSS projects too. Imagine a leaked GH access token from a project maintainer who is not responding, and who is not an employee because OSS isn’t a company. How do you the project get that token revoked? You can’t. You have to de-list the maintainer from your GH org.

From my POV, the most important message for everyone who is doing the hazardous work of developing software in public on platforms like GitHub: you have to pay *close attention* to GitHub token permission scoping. It’s not well known outside of security research circles how often GitHub tokens leak.

There's much to agree with in Dan's piece on defending the definition of Open Source. On details, I quibble. "Today, Valkey is maintained by a neutral foundation, ensuring no one company can take it away from open source." Linux Foundation doesn't maintain Valkey. thenewstack.io/open-source-...

Thrilled for the launch of @kiro.dev today! We started with two main ideas that led to Kiro's spec-driven development features: 1) AI can help us build better products through rapid prototyping 2) Devs can declare their app's requirements to get better results from AI, close to production-grade code

It has officially begun. The CRA info request counter is no longer at zero.

OH: "And so, it begins."

This is not an adventure that FOSS maintainers should have to endure, in my opinion. Unfortunately The Rules don't prohibit allocating a CVE for an identified weakness that was never in a released Product... www.cve.org/resourcessup....

I do not like this timeline.

While there is much more that industry can do, and NEEDS to do, we should recognize that in the past Google has directly sponsored libxml2 development. It's not *just* been Project Zero sending vulnerability disclosures to the maintainer. gitlab.gnome.org/GNOME/libxml...

The innovation of piped water and sewer systems had an enormous impact on public health and economic growth. It's infrastructure that we generally take for granted in developed industrialized nations.

A dimension of open source software supply chain risk management that we don't discuss enough... ⬇️

#hugops to all that operate, no matter who you work for.

The story of #CVE-2016-1000027 is a tell of woe for Open Source maintainers. A zombie CVE from a CNA long dead, a CVSSv3 base score of 9.8 in the NVD, and a weakness that is intrinsic in the language ecosystem (do not deserialize Java from untrusted sources, people!!!). github.com/spring-proje...

Not all Foundations are the same.

Oh the _feels_ when reading this announcement! I was one of the GNOME project’s first sysadmins, back in the days of a single CVS server running on a machine hosted at Red Hat’s office. It’s amazing to see their journey to the cloud! foundation.gnome.org/2025/06/10/g...

Is an emergent behavior of a system an anomaly if no human notices? 🤔

This is disappointing. The Red Hat I knew understood that its whole existence hinged on the permissions granted to all, indiscriminately, by all Free and Open Source licenses.

📰 New article by Clare Liguori Introducing Strands Agents, an Open Source AI Agents SDK #AWS #OpenSource

AWS today launched a new SDK for building AI agents, with support for LLMs from its own Bedrock service, LiteLLM and Ollama. By @fredericl.bsky.social

Excited to open source Strands Agents today! LLMs have gotten so good at reasoning and tool use that building model-driven agents with Strands is easy AND powerful Models + Tools = 🧬 Read more: aws.amazon.com/blogs/openso...

Fun chat about Strands Agents, I love it when the space station is involved in demos www.youtube.com/watch?v=Ausm...

“AWS-LC looks like a very active project with a strong community. […] Even the recently reported performance issue was quickly fixed and released with the next version. […] This is definitely a library that anyone interested in the topic should monitor.” www.haproxy.com/blog/state-o...

What’s old is new again… (SugarCRM… iykyk) Another “badgeware” license. docs.openwebui.com/license/

This is absolutely the right take. AGPL and SSPL were written with wildly different (and in many ways, completely contradictory) motivations.

“They set out to craft a license that followed in the AGPL’s footsteps by not applying reciprocal provisions to software hosted in a network fashion, but dramatically expanding the scope of these protections beyond the boundaries of the protected software itself and into adjacent software.” Nah.

“The primary purpose of AGPL appears to be creating barriers for public cloud providers, which likely guarantees that major sponsors like Amazon and Google will continue to support Valkey.” - Vadim Tkachenko, @percona.bsky.social co-founder. Respectfully, no. This is not the purpose or the reason.

Unpopular opinion: If you do not perform all the obligations of a license like the AGPLv3 yourself, and would gladly and fearlessly use software produced by someone else exclusively available under that license as part of your software service, you shouln’t offer your software under that license.

We don’t know what works in practice unless some tries.

The situation we have now: AGPLv3 is not seen as a reliable instrument for giving permission to offer a program as a networked service. It depends on the whims of the licensor. Do they intend to gladly empower others to fearlessly offer the software as a service, or intend to chill that act.

A network copyleft that is closer to MPL than AGPL is relatively easy to have without creating a whole new license. Just use AGPLv3 with additional permissions, similar to the GCC runtime permissions added to GPL.

One day I hope we will stop calling it a “donation” because companies aren’t *really* required to give up control when transferring assets to the Linux Foundation. Companies can (and do) arrange initial governance rules that give them assurances of continued control and influence over a project.

"Copyleft obligations for thee, not for me." I don't want to teach others this strategy, because I care about the social movement more than helping companies bend it in service of their needs. From a community PoV, I think it was bad when MySQL started it, and it's bad now.

I will believe that a company that offers software they exclusively control under the AGPLv3 license truly embraces the Open Source Community when they accept a contribution under AGPLv3 from me and meet all of the obligations of the license for network-based services they offer that use it.

A reminder: if you consider the things you are transferring to a consortium to be core assets for your business, and you are expecting the transaction to help your business grow, you aren’t “giving it to the CNCF”. It isn’t a gift. It isn’t a donation.

And all this time I thought it was created as a consortia play by companies that were struggling to gain traction in a wildly growing segment, and wanted to try to change the rules of the game to be more in their favor… 😅

A reminder that transferring assets to a consortium in hopes that it can accelerate your business is never a “donation”, especially if one believes they can “take it back”. 
Businesses see CNCF as an incubator where “their” assets can grow. Because in many ways it is. www.cncf.io/blog/2025/04...

Reflecting tonight on the #CVE program, all it has given us, and how frustrated I’ve been because of what does, and what it fails to do. Unfortunately there is no point in claiming that the purpose of a system is to do what it constantly fails to do… #InfoSec #SBOM #OpenSource

Many business leaders underestimate how much freedom from license frustration means to the software development community…

The amazon-q-cli package is now in Nix unstable!

"In keeping with our commitment to open source, we’re making Llama 4 Maverick and Llama 4 Scout available to download on llama.com and Hugging Face […]" Your regular reminder that all the Llama Community License Agreements have terms incompatible with Open Source norms. ai.meta.com/blog/llama-4...

The latest proprietary VSCode extension that no longer works in non-Microsoft builds of the open source VS Code code base appears to be C and C++ support. Your regular reminder: more of VSCode functionality is proprietary, and #FOSS hostile, every day. github.com/VSCodium/vsc...

#freesoftware is more than just code – it’s a community and a movement 💕 Today, we celebrate all the people who dedicate their time and passion to upholding the #fourfreedoms to #use #study #share and #improve ❤️ Thank you to every contributor of Free Software ❤️ Who do you want to thank […]

Forking isn’t an act of retaliation. It’s the purest expression of the underlying freedoms that empower open source. We should stop trying to avoid it, and instead make it a normal part of the social fabric.

Great read. I would say I think it’s less “beware of single vendor” - it’s more “get comfortable with forking as a natural extension of community”. If you’re using single vendor oss, not paying for it, and it disappeared tomorrow - be ready to fork. That’s the contract.

When you choose to use a FOSS license like BSD, you are choosing asymmetrical benefit relationship. Others can “take without giving back” and there is nothing fundamentally wrong with that. For example see the CRC64 performance improvements in Redis copied from Valkey. github.com/redis/redis/...

"After thorough consideration, we see joining forces with the Linux Foundation as the best way to secure financial stability, strengthen collaboration across the open-source ecosystem, and enhance long-term community support." - Jonathan Bryce, Executive Director of @openinfra.org

In the context of organizational evolution I think that culture is a result of the behavior of individuals, not the other way around. I think too often we look to "culture" as a tool, in and of itself, that can change behavior of individuals within organizations.

二度とないように