Gloria Johnson’s Post

Need clarity on what license to use before sharing code in #opensource community? Do read my article explaining with examples.

Working on my Open Source Maintainers course! 🎉 Here are the sections and lessons I have so far, what do you think? 👇

Ecosyste.ms: Exploring Open Source Software Landscapes by Andrew Nesbitt 💯 "26% of all the issues and pull requests are created by bots." 💡 "86% of "critical" open source projects only have one maintainer." 💡 "Then you notice that Sindre [Sorhus] is in there as a single person. He has 1,900 different open source packages that he's published and comes within the top 10 platforms in terms of supporting open source projects as a single person." 😂 What's next for Ecosyste.ms? - Reverse Dependency Tooling: Who depends on my open source project? 💯 https://lnkd.in/gqkQPg-V #OpenSource

Just submitted «Scaling IaC: OpenTofu, Terragrunt & GitHub Actions» proposal to the #OSSummit. If you have use-cases you'd like me to cover in the presentation, reply 👇. P.S> There is less than 24 hours left to submit your proposals ⏰ #iac #terragrunt #terraform #opentofu #github

In a business world where taking advantage of #opensource is "all it matters" strategy even if they claim innocency and virtues, it's on us walking away from deep pocket magicians and working for, supporting, and defending the #opensource community, development, software, and projects. DO NOT expect from a crocodile to become a vegan. It's NOT going to happen, never and never. We all member of #opensource need to be strong and stay together and work for humanity in order to progress all together and leave this misery behind us. As #opensource members we have the responsibility to support this amazing collaborative development model, promote our model, and leave behind us our legacy to let #opensource flourish for generation to come. #opensource, #corporatenonsense, #opensourcedevelopmentmodel

Unfortunately, this is an increasingly common occurrence. Even companies that try to 'community source' their open source project only wind up killing it because there are no maintainers. Without dedicated people, all projects will die. Likely tied to economic cycles, we're heading into a bad one now, so hopefully in 5-10 years we'll see the upswing again and we can do great open-source work again. Until then, batten down the hatches and survive.

As I watched this video, I kept yelling at the screen, YES, THIS!!! I created CIQ, and CIQ is a founding organization/member of Rocky Linux, the Rocky Enterprise Software Foundation, and now OpenELA too (along with SUSE and Oracle). I don't support "Single Vendor Projects" where a single company owns, controls, and thus can hold hostage, an open source project. Open source projects that we work with at CIQ are hosted openly and collaboratively within the community, such that CIQ can't ever do anything sketchy. This even includes projects that I personally created! If you love something, set it free! Open source isn't a marketing or business switch, it is an open and collaborative development model. If you don't believe in what it means to be open source, then don't release as open source! Hat's off to Jeff Geerling for this video and well said perspective. I agree 100% and wish to work with other companies and executives who believe in the same! https://lnkd.in/gNJhNgUN

I'm just patching my two Go libraries again, against some CVE's in third party libraries. Luckily I don't use these libraries directly, but I wanted to talk about GitLab. I moved these libraries to GitLab a number of years ago (I must say they were under my personal account rather than under a group or organisation). They are now under an organisation go-box in GitLab and have been for a number of years. Now I actually sort of regret the move to GitLab and in a way I want to move it back to GitHub, but why? The reason I want to move it, is because GitHub has better dependency security scanning facilities for Open Source projects. I just don't understand why GitLab makes scanning dependencies part of GitLab Premium only but why not make it available to Open Source projects, public repos? But for Go libraries moving a repo is a big deal that changes all the imports and that is stopping me going through with it. So how do I even know it has a CVE against dependencies? Maybe I should just mirror it to GitHub for the sake of running dependabot. I literally have to check this page right now and when I get busy (which face it, is always) then I might miss some: https://lnkd.in/gfYHAqvg GitLab, please please please consider security scanning for public repos. It will make the web a better place.

Why do organizations so often choose a non-Open Source license (such as the BUSL) and a DOSP release arrangement when simply publishing under the AGPL4 from the start might, in many cases, meet their goals well enough? #dosp #busl #opensource