Broadcom pledges to lock down open source Python, Java libraries

Broadcom has decided to take responsibility for the security of some important open-source software, namely the Spring Java application framework and RabbitMQ. Australian developer Rod Johnson created the precursor to Spring in 2002, then found collaborators to tread the well-worn path towards monetizing open source software by …

[Anonymous Coward]

This is the sort of thing I'm on the fence about.

Yes, you should be able to make money developing open source software. But I feel that whe it goes too far in that direction, you get the whole "open source can't survive without money!" attitude. It's against the original spirit of open source, where everyone provides their code to prove that it does what it should, and to share.

On the other hand, without any money, you end up with ramshackle software underpinning the foundations of the modern world, which is also a bad thing.

I guess the tension between the two is part of the whole thing, and a necessary evil.

[Anonymous Coward]

I’m sure Broadcom will find some way to squeeze blood out of the monetisation stone.

[Anonymous Coward]

Did you not see what Broadcom did to Bitnami?

[FeRDNYC]

I'm on the fence for somewhat different reasons. There are good and bad versions of how this could go down.

Good version: Broadcom helps to support maintainers of open-source projects, contributing back useful fixes in a helpful manner, without burying the volunteers in corporate code bureaucracy or pushing too heavily for inclusion of features that are only really of interest to Broadcom.

Bad version: Broadcom effectively starts maintaining their own fork of every project they consume, because they end up developing and carrying a mountain of downstream patches that, even if they are all sent along to the upstream project and are all generally relevant and useful to the project beyond Broadcom's needs, create far too much work for the original project maintainers to handle at a pace that satisfies Broadcom.

[Anonymous Coward]

You forgot the 3rd option: They fork it closed and abandon the open source version*.

* - no, i have not looked up the current license assigned to Python or Java and may be full of it.

[Fido]

Spring Java uses an Apache License which allows creating a proprietary fork that does not contribute improvements back to the open source project.

RabbitMQ uses the Mozilla Public License which allows it to be included in a proprietary program but with the restriction that improvements to the MPL code be made open source.

[Fruit and Nutcase]

Spring Java

Users of Spring/SpringBoot should look at Quarkus. It may offer a fairly painless way to escape Broadcom, and pickup some performance improvements on the way.

Though, be careful of what you wish for

[containerizer]

Re: Spring Java

Quarkus is good, and delivers on the lightweight/high performance aspects, but the Spring platform is larger, more mature and significantly more feature-rich. The core stuff is well-implemented and the tooling is good, but if you're going off the beaten track then you'll find yourself missing some of Spring's integrations.

[Eric 9001]

>which allows it to be included in a proprietary program but with the restriction that improvements to the MPL code be made open source.

RabbitMQ is under the MPLv2.0, which doesn't say "open" in it (such license is a free software license, that has been influenced by the free software GPLv3 license).

It isn't a restriction, that how partially respecting the users freedom, is a condition of distributing the software - after all, you are not restricted from distributing the software, as you are fully capable of providing the source code of your modifications to the MPLv2 files, as free software (under the same or a compatible license), or choosing not to distribute the software at all.

Although, the weak copyleft makes the MPLv2 nowhere near as good as the GPLv3-or-later - there is no real requirement that the changes to the MPLv2 code are made available as free software - a proprietary software developer can get around the requirement by shoving changes (or improvements) to the MPLv2 files into other files - sure they'll be required to provide the source code of any shim code in the MPLv2 files - but that would be a regression, not an improvement.

[Anonymous Coward]

Tigers Eating People’s Fsces ???

Broadcom …. Shirley not.

[Henry Wertz 1]

Or fourth option

Or option four, 'hey we found these bugs' and they just spam the maintainers with bug reports, with no patches, and no funds toward the projects or their main contributors. I think Broadcom may know better, but this has happened a few times in the past.

[alkasetzer]

I recommend reading the actual announcement: https://investors.broadcom.com/news-releases/news-release-details/broadcom-strengthens-spring-security-and-adds-coverage-java

if i understood correctly, broadcom will offer (for a tiered price) forked, patched, rebuilt and probably broadcom signed upstream jars of the exact releases used when shipping a specific version of spring framework (or boot, cloud, etc).

For the ones tracking spring releases, this is good mostly for spring users as they don't really follow upstream releases of libs that closely. Also the oss version has a very short window (12 months) of support vs the paid version (24 months depending on the version).

[containerizer]

After Broadcom/VMware pulled the plug on Bitnami helm charts, and their generally appalling conduct with the VMware platform, you would be mad to get involved with them.

[ecofeco]

This.

They are radioactive at this point.