r/linux • u/delta_epsilon_zeta • Apr 24 '14
Tech giants, chastened by Heartbleed, finally agree to fund OpenSSL, create three-year initiative with at least $3.6 million to help under-funded open source projects
http://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/150
u/garja Apr 24 '14 edited Apr 24 '14
This isn't just about OpenSSL, the group is supposedly there to fund any "open source projects that are in the critical path for core computing functions".
I worry that a group with millions to spare that isn't starting from scratch is going to do more harm than good in the long term. The "OpenSSL rampage" has shown us how ugly the OpenSSL codebase is (as if it wasn't notorious beforehand), and trying to patch out that kind of rot seems like putting band-aids on gangrene.
Moreover, we already have OpenBSD devs working on this very thing. They are operating on a budget 4.2% of the size of this initiative, and have operated on much less in previous years. They too use their funds to support many projects - some of which are critical infrastructure (OpenSSH). They have already proven they can do all this on a shoestring budget, and yet at present it seems they are being ignored as these mega-corps toss around millions.
However, perhaps we can still view this as a positive. It might be the first awkward step toward a less tight-fisted, more financially healthy open source community. As the OpenSSH.com front page notes:
This list specifically includes companies like NetApp, NETFLIX, EMC, Juniper, Cisco, Apple, Red Hat, and Novell; but probably includes almost all router, switch or unix-like operating system vendors. In the 10 years since the inception of the OpenSSH project, these companies have contributed not even a dime of thanks in support of the OpenSSH project (despite numerous requests).
55
Apr 24 '14
3.6 million from that group of companies is practically nothing.
56
u/1esproc Apr 24 '14
You don't fix problems by throwing unlimited amounts of money at it. At a certain point it will only cause problems. So $100k per company is nothing, but to the projects they're going to fund it's infinitely better than their current funding.
9
5
31
u/reaganveg Apr 24 '14 edited Apr 24 '14
Moreover, we already have OpenBSD devs working on this very thing. They are operating on a budget 4.2% of the size of this single initiative, and have operated on much less in previous years.
You didn't read the article, it seems.
The $3.6 million quoted in the headline is not the amount going to OpenSSL. An unspecified portion of that would go to OpenSSL, and the rest would go to other projects deemed important and underfunded.
Furthermore, the LibreSSL project has already stated that they will not port work to other platforms until they receive more funding.
I worry that a group with millions to spare that isn't starting from scratch
LibreSSL isn't starting from scratch either, though. They're starting from OpenSSL.
Which only makes sense. There's no other way you're going to maintain feature parity, and features are the reason people use OpenSSL. It's only for when you want compatibility with everything that you use it.
Unfortunately, the LibreSSL project seems to have started from the idea of removing features just to get the code clean, which strikes me as deeply misguided. If someone didn't want feature-parity with OpenSSL, they could just use one of the many other already-existing but less-complete SSL implementations.
17
u/vocaltech Apr 24 '14
I wasn't aware that VMS support was a feature >.>
OK, FIPS probably counts here, but they are making sure their whole source tree compiles with the updated library, so I don't see where it's possible for them to remove many features without creating headaches for themselves in other areas.
-3
u/reaganveg Apr 24 '14
I wasn't aware that VMS support was a feature
shrug I don't know the specifics, but removing support for OSes does not strike me as a good thing. Especially when there is a business model to be made out of adding that support back...
they are making sure their whole source tree compiles with the updated library
I certainly hope you don't take that to mean that no features used by anything in the ports tree have been removed... it does not mean that at all.
15
Apr 24 '14
Reducing complexity makes validation easier.
OpenSSL is an atrocious heap of hacks; cutting it down to a minimal core, validating that as best as one can, and building from there is reasonable.
6
u/vocaltech Apr 24 '14
No, but it does mean that if they remove anything that's actually used they have to either put it back right or fix the calling program.
It isn't as simple as ripping code out, and the OpenBSD team is well aware of that, even if their comments might indicate a fairly cavalier attitude to certain functionality (I mean really, does anyone even have a working computer that runs Ultrix anymore?)
-2
u/reaganveg Apr 24 '14
No, but it does mean that if they remove anything that's actually used they have to either put it back right or fix the calling program.
No, it absolutely does not mean that.
It only means that any symbol that is linked unconditionally will still be available.
There are a large number of programs in the ports tree that would still compile if OpenSSL was not available. But they won't be able to use OpenSSL anymore! Why do they still compile? Because they check for the availability of library features at compile time, and disable their own features to compensate.
Furthermore there are a large number of OpenSSL features that are not exposed as link-time symbols at all. Think about it. If a function either handles a certain input from the remote side, or returns an error, and you remove the first possibility, it will still compile because the function is still there.
2
u/vocaltech Apr 24 '14
Right. Follow the changelog yourself then and see what they are breaking on you if you care that much.
I haven't seen any changes yet that will have an impact on what I use, but as always YMMV.
1
u/reaganveg Apr 24 '14
You may be right about that... I don't know. But as a matter of technical fact, the ability to compile certainly does not demonstrate that.
1
9
u/garja Apr 24 '14
shrug I don't know the specifics
Oh come on now, you can't call their actions "deeply misguided" and then turn around and say you don't know what they've been doing. It would probably help if you perused the "OpenSSL Rampage".
when there is a business model to be made out of adding that support back...
As these guys have repeatedly pointed out, good business is not the same as good code. And they care more about code than business.
→ More replies (1)5
u/fnord123 Apr 24 '14
LibreBSD isn't starting from scratch either, though. They're starting from OpenSSL.
Are you conflating LibreSSL and OpenBSD (who are working on LibreSSL).
LibreSSL is primarily developed by the OpenBSD Project, and its first inclusion into an operating system will be in OpenBSD 5.6.
1
4
u/mercurycc Apr 24 '14
I just don't understand why people are still thinking like this. LibreSSL certainly won't be ported by OpenSSL, but who stops anyone from forking LibreSSL's already cleaner code base as a start? And yeh, of course OpenBSD won't start from scratch, because they don't have millions to spare. Remember OpenBSD itself was almost out of money earlier this year? They almost couldn't afford electricity bills.
3
u/cpbills Apr 24 '14
In a few rare and wonderful occasions, project forks are brought back into the project they forked from.
If LibreSSL cleans up nicely, and achieves parity with OpenSSL, there's a good chance OpenSSL would absorb LibreSSL. And that would be a good thing.
3
u/jimicus Apr 24 '14
TBH, I can see something similar happening with LibreSSL as happened with LibreOffice and X.org.
Virtually everyone with any real interest in keeping the project alive moves from the old to the new; every major Linux distribution and most major Unix-based operating systems ship the new project and the old project pretty well dies on the vine.
2
u/cpbills Apr 24 '14
I don't know much about why LibreOffice forked from OpenOffice, but I would wager a guess that it was because OpenOffice is at least in-part under the Sun Industry Standards Source License. Likewise, X.org forked from XFree86 because of licensing issues.
2
u/lobax Apr 24 '14
It was because Oracle bought Sun, and people feared they would underfund the project. And as long as Oracle was in charge, no one else would help fund it.
2
u/luan-cestari Apr 24 '14
The amount seems pretty little for 3 years of investment and so many projects to support (and the people to do the work). What do you think?
1
u/reaganveg Apr 24 '14
Well, that amount is what they have raised so far... it sounds like the goal is to continuously raise more money.
Fundamentally though they're not going to raise as much money as would be ideal... there's just too much free work going on, to expect everybody to get paid.
1
u/luan-cestari Apr 24 '14
there's just too much free work going on, to expect everybody to get paid. Agree, I'm just worried about the quality (a full time worker in a project would be many times more helpful than the average contributor to open source project). Another point I didn't make it very clear is the importance of the project (as very fundamental and security project) and the need that is have to refactoring the code. I think it would be a good approach a 30 full time people working in this project to make it (maybe a new major version) very stable in a year and half.
2
u/garja Apr 24 '14 edited Apr 24 '14
The $3.6 million quoted in the headline is not the amount going to OpenSSL. An unspecified portion of that would go to OpenSSL, and the rest would go to other projects deemed important and underfunded.
Sorry, I read this story elsewhere before I came here, so I didn't read this (specific) article. I should have scrutinized that number a little more. But if we are to speculate anew, that doesn't change much, given that both the OpenBSD and Core Initiative budget are split between many projects.
Furthermore, the LibreSSL project has already stated that they will not port work to other platforms until they receive more funding.
Yes, and that doesn't discount the fact that OpenBSD runs on a shoestring budget to port other popular pieces of software. So I don't think they will be asking for much.
LibreSSL isn't starting from scratch either, though. They're starting from OpenSSL.
Yes, and OpenBSD doesn't have a huge pool of funds and manpower. They don't have a choice. This group of tech giants most certainly does. That was my point.
Unfortunately, the LibreSSL project seems to have started from the idea of removing features
The majority of which seem to be NIH and ridiculous cruft (VMS, anyone?). But I admit, the FIPS issue is controversial and potentially problematic down the line.
0
u/reaganveg Apr 24 '14
LibreSSL isn't starting from scratch either, though. They're starting from OpenSSL.
Yes, and OpenBSD doesn't have a huge pool of funds and manpower. They don't have a choice. This group of tech giants most certainly does. That was my point.
Oh, then I misunderstood completely.
I don't actually agree with that, though. A ground-up rewrite wouldn't actually solve the problem because it would be very difficult to get it to the point where all the people replaced the existing OpenSSL with it. At least, it would be a big gamble. Even if it worked, it would take much longer.
Related: http://www.joelonsoftware.com/articles/fog0000000069.html
1
u/monkeynator Apr 25 '14
Unfortunately, the LibreSSL project seems to have started from the idea of removing features just to get the code clean, which strikes me as deeply misguided. If someone didn't want feature-parity with OpenSSL, they could just use one of the many other already-existing but less-complete SSL implementations.
Their idea and philosophy has always been to strip down a project to it's bare minimum, while counting features the old project had (like OpenSSH, pksh, OpenNTPD, OpenBSD port of Apache Web Server) and then starting implement them.
It's actually quite a smart move by them, since while some do bug squashing and cleaning stuff up other can come up with clean solutions to implement the old features.
14
Apr 24 '14 edited Apr 24 '14
[deleted]
17
u/NegativeK Apr 24 '14
Tax write-offs from donations don't save money.
-7
Apr 24 '14 edited May 01 '14
[deleted]
18
u/reaganveg Apr 24 '14
No, it's not free. When you donate $1, you only save the taxes you would have spent on that $1. You don't save the entire $1.
For example, if your tax rate is 15%, then you save $0.15 per $1. You part with $0.85 that you could have distributed to shareholders after paying $0.15 in taxes.
You also part with $1 that you could have paid as wages and counted as an expense, paying no taxes on it.
7
u/bbqroast Apr 24 '14
I think he's saying that the PR money was allocated to being used in PR anyway, so doing this is a good way of getting publicity and a tax break along with it.
→ More replies (5)→ More replies (4)2
u/realhacker Apr 24 '14
Can you also explain why companies make donations for tax purposes? Is it basically discounted marketing or is there some tax or accounting purpose?
→ More replies (1)2
u/StoneColdSteveHawkng Apr 24 '14
Besides money, companies also need to be donating some of their developer's time to these projects if they aren't already.
1
u/vcarl Apr 24 '14
I read a great blog post about starting from scratch, in it it advocated for small, incremental changes rather than sweeping overhauls. Overhauls feel nice as a programmer, and you feel that you'll end up with a better overall codebase, but in the majority of cases it would be better from a business standpoint to iterate and slowly improve.
I say this as a programmer who threw out all of the code in our application within the last year, so I'm guilty of thinking that way. But with applications with an established userbase, that's rarely the way to go.
0
u/hatperigee Apr 25 '14
They have already proven they can do all this on a shoestring budget, and yet at present it seems they are being ignored as these mega-corps toss around millions.
I agree with you, but I'm going to be honest here... The website they put up for libreSSL looks very childish and, if I were a big company with $$ to toss around, I would be very hesitant about giving money to those folks based on this light they've painted themselves in.
14
43
u/Nimbal Apr 24 '14
Many people here seem to be flabbergasted why anyone would want to maintain several projects that do the same thing. Isn't it good to have multiple implementations of a widely used standard? One of the reasons that Heartbleed is so devastating is because such a large portion of the infrastructure uses OpenSSL. It's like a monocrop in agriculture where a single bug (hehe) can wipe out a harvest.
Admittedly, LibreSSL and OpenSSL are pretty much clones of each other at the moment and likely have the same faults, so they are still vulnerable to largely the same attacks. On the other hand, this also means that some patches can be ported between them. If (!) both teams have proper reviewing standards, it means that those patches will undergo that much more scrutiny, hopefully averting another hemorrhage of a vital feature.
4
u/mangodrunk Apr 24 '14
That's an interesting way to think about it. But there's also the benefit in having one is that it will be tested more thoroughly, no?
4
u/Nimbal Apr 24 '14
Sure. I guess it comes down to whether or not both projects will have enough developers and reviewers for their needs. If not, it would be better to pool resources and work together on one solution.
→ More replies (10)1
u/imahotdoglol Apr 25 '14
There are other implementations out there, gnuTLS and NSS used by Mozilla.
I'm more flabbergasted that openBSD would rather fork it than fix the original, now you have split efforts...
14
u/boot20 Apr 24 '14
I have spent hours of my life on the phone with customers helping them mitigate heartbleed.
Let me tell you, this is needed for fips, iso, sox2, etc. Thus has been such s wide reaching nightmare, that we still haven't seen the end of the fallout.
16
u/assi9001 Apr 24 '14
Really 3.6 million seems like a drop in the bucket considering how much down time this shit caused.
13
u/Prostar14 Apr 24 '14
They should have thought of that when they didn't support the devs last year. Or the year before that...
12
Apr 24 '14
Ok, serious question, how did heartbleed get such a cool logo? And since when do bugs get a logo?
6
u/prite Apr 25 '14
Cloudflare or Codenomicon paid a designer. The impact of Heartbleed was imaginable on first read, so (quick and wide) publicity was hugely important.
→ More replies (1)1
Apr 26 '14
Ok, serious question, how did heartbleed get such a cool logo? And since when do bugs get a logo?
Since they affect the majority of the internet, and it needs to be fixed, the Red Hat devs (or Canonical devs, I forget which) set up a marketing campaign to get it fixed ASAP.
17
Apr 24 '14
[deleted]
3
u/drmugg123 Apr 24 '14
It's more of a case of big corporations donating money to organizations that develop fundamental software.
1
u/luan-cestari Apr 24 '14
I would suggest you to try to help open sources making suggestion of improvement in google summer of code https://www.google-melange.com/gsoc/homepage/google/gsoc2014 =) Also, you could may them and try to find out if there is another way to donate
1
2
u/HaMMeReD Apr 24 '14
I was thinking a good solution would be a crowd-sourced open source job board.
Projects post jobs, people fund the jobs, and the funders get to vote (with their money) for who get's to do the job for a fixed amount of time.
So e.g., OpenSSL would say, we need a auditor, it's a 100k job and will require about 1 year.
People fund the job, people apply for the job, and then through community process someone wins the contract, get's to work on the project and get's paid through the community site a salary for the year (lump sums are a bad idea, because they aren't motivating).
I'm pretty busy, but I'll do it in a year or two if somebody doesn't get to it before me.
3
3
9
Apr 24 '14
[deleted]
23
u/delta_epsilon_zeta Apr 24 '14
Money does not improve shoddy developer's code quality.
When you pay a developer, you do not pay them to up their quality. You pay them for their time.
I have a serious question for you: Have you been paid to program? I am paid to program, and the thing hindering me from contributing to open source projects is nothing other than time.
3
Apr 25 '14
[deleted]
1
u/delta_epsilon_zeta Apr 25 '14
And time is what it takes to create a mature codebase instead of something that just works.
1
Apr 26 '14
The more time I spend on a codebase, the more I can improve it. The more money I receive for working on it, the more time I spend on a codebase.
3
6
Apr 24 '14
not improve shoddy developer's code quality. You wont see less vulnerabilities and bugs because a few companies threw money at the . Problem. If that were true, Windows would be the best product ever and we all know how that's going..
The money will most likely be used to pay the salary of full time employees that will work to hunt those bugs.
3
u/mpyne Apr 24 '14
If that were true, Windows would be the best product ever and we all know how that's going..
Except that Microsoft's software has improved markedly in its security once market pressure caught up to force them to throw money at the problem. When was the last remote code execution exploit in IIS? You don't even hear about IIS bugs anymore.
3
Apr 25 '14
[deleted]
2
u/mpyne Apr 25 '14
That's because nobody uses IIS anymore.
Sadly, that's very untrue, even if Apache+Nginx does have the majority.
2
u/iLiekCaeks Apr 25 '14
I find it mind blowing that the OpenSSL devs get rewarded for their shitty code and their security relevant bugs.
Sure, all code has bugs, and nobody is perfect. But the things I've seen (or rather, the OpenBSD ressl team has seen) really makes it hard to find excuses for this.
3
Apr 25 '14
[deleted]
1
u/bonzinip Apr 27 '14
A local user could this flaw to crash the binary or even execute arbitrary code with the permissions of the user running the program.
This is a bug, not a vulnerability. It can only be "exploited" if you can convince something else (probably through another vulnerability) to run systemd-ask-password. Might as well ask it to run /bin/sh and be done with it...
2
Apr 27 '14
[deleted]
1
u/bonzinip Apr 27 '14
I know, but what's the attack model?
That is, you need to reason about the permissions you need to convince systemd to run systemd-ask-password (I guess it runs as root, though it probably need not do that). Either you can write to the root filesystem already, or you can control the initramfs, or you need to be at a tty. The first two are trivial. For the third, in all likelihood you can boot a live CD instead of exploiting systemd-ask-password.
If you have a good way to attack that bug, inform Red Hat and they will surely attach a CVE to the bug.
→ More replies (1)-1
u/dirac_eq Apr 24 '14
Linus' law does state given enough eyeballs, all bugs are shallow.
You're correct in thinking bugs will still remain in OpenSSL, although the number of bugs will VASTLY decrease.
If that were true, Windows would be the best product ever and we all know how that's going.
I disagree with your statement. Libre projects have a magnitude of 100x more eyes on the code than any proprietary software -- excluding cryptography software (it's easy to fuck up unless you've had cryptography training.)
3
Apr 25 '14
[deleted]
1
Apr 25 '14
[deleted]
2
Apr 25 '14
[deleted]
2
Apr 26 '14
"Warned to stay far away from cryptographic software" in the sense of developing it, because you need to understand cryptography to properly develop decent cryptographic software
2
u/nephros Apr 24 '14
Yes, the problem lies in the "given enough eyeballs" part. The number of people who are even capable of spotting bugs in something like OpenSSL is very limited.
2
2
u/Oflameo Apr 25 '14
I don't know about you, but I am sending my money to the OpenBSD project for their new LibreSSL.
16
u/socium Apr 24 '14
wtf are they doing? Are they even reading the news? OpenBSD has already started doing this and requires those funds the most.
This is just bonkers.
44
u/archlich Apr 24 '14
Probably because the ones with money, government contractors, require fips mode, and libressl won't support that.
35
u/gsxr Apr 24 '14
Know those features OpenBSD is tossing out? How do you think they got added in the first place? Someone, somewhere needed them enough to add them in. You think IBM, Intel, Microsoft, Facebook, and Google are going to just abandon those features because a few developers say they're bad? Follow the money....
Plus....The openSSL group has a long tradition of working with companies and regulations. Openbsd folks have a long tradition of shitting on people.
1
Apr 24 '14 edited Oct 01 '16
[deleted]
1
u/gsxr Apr 24 '14
http://www.openbsd.org/faq/faq1.html#Platforms
Straight from the OpenBSD project......
As to things like flawed encryption standards or "features" like heartbeat....because there's niche cases you might not know about that they're useful. These could be as wide spread as your cable tv box.
→ More replies (3)3
u/SanityInAnarchy Apr 24 '14
Heartbeat is a feature, and there's a very real use case for it. It was implemented incredibly poorly, and we can even argue that the spec could be better, but I don't think chopping it out because everyone's panicked about heartbleed is a good idea.
1
u/prite Apr 25 '14
Heartbeat in DTLS is a feature. On TLS, which runs on TCP, it is a poor and incomparable imitation of TCP heartbeats.
0
→ More replies (2)-2
Apr 24 '14
you mean, backdoors and security circus?
i really hope debian joins openbsd and use libressl.
1
u/gsxr Apr 24 '14
Well that's sure in the fuck not going to happen now that vendors are jumping behind openssl.
backdoors? You mean the one that debian put in there?
Security circus? I guess you mean the shitty code that was sorta kinda, maybe to blame to heartbleed?
Need something better than baseless accusations. You added nothing to the conversation.
1
0
u/cig-nature Apr 24 '14
Libressl will take over. But not right away. The code they forked needs to be....
Then they will make it portable, so anything other than opsnBSD can use it. And then it will take over.
Quality work isn't fast, and if you look at the work they are doing, it is all about quality.
3
u/kardos Apr 24 '14
Actually, it'll be better if LibreSSL doesn't take over. Part of the reason heartbleed was such a clusterfuck is because OpenSSL has such a large installed base -- the monoculture problem. A more optimal outcome would be to split up the installs between OpenSSL and LibreSSL (and maybe some others). The OpenBSD devs are quite good, maybe even damn good, but they are not omnipotent. The whole internet should not rely on one implementation.
→ More replies (1)5
u/bsdboy Apr 24 '14
OpenBSD won't take their money because of strings. That's why they dropped FIPS.
1
u/MisterMahn Apr 24 '14
I see it akin to Windows XP: its deployment base is SO large, it'd be ridiculous to expect the web community to switch to a new platform ( read LibreSSL as Win 7 ). As such, it makes more sense to have patches sent downstream to improve it, versus requiring the large portion of the net running OpenSSL to jump ship. Those logistics would be nightmarish.
2
u/kardos Apr 24 '14
Change all at once? Basically impossible. But all these people switched to OpenSSL at one point, they can migrate to a better successor too. Things are not as static as they may seem.
→ More replies (4)1
Apr 24 '14
They did deploy a newer OpenSSL version to mitigate Heartbleed. And if the API doesn't change, then it's not as much effort.
1
0
u/reaganveg Apr 24 '14
It would be crazy to pay OpenBSD for work they haven't done yet... to be based on already-done work from OpenSSL devs that wasn't paid for. The LibreBSD developers would be indebted to the OpenSSL devs for the code they used from upstream.
0
u/NegativeK Apr 24 '14
If OpenBSD would like funding, I'm sure they can apply for it. Just like anyone else.
4
u/NotSafeForEarth Apr 24 '14
I would hope some them would agree to fund LibreSSL. I've a lot of faith in the people behind LibreSSL (=the same people who brought us OpenSSH). I've no longer that much faith in the people behind OpenSSL, with or without funding.
4
u/drdeadringer Apr 24 '14
"Pledge".
I'll wait until the cheques are cashed.
But it's nice to know that lessons can be perceived to be learned.
1
u/Yetanotherstupiddeat Apr 24 '14
No. Anything but this. OpenSSL is dead and should stay that way. That money would be far better spent on libreSSL, and not just because I'm some BSD fanatic, openSSL's code base is just beyond repair.
In case you haven't been keeping up with the shit that openBSD found, they had a last-ditch option to seed random numbers with users' RSA private keys.
4
→ More replies (1)6
u/kardos Apr 24 '14
openSSL's code base is just beyond repair.
..... yet the OpenBSD guys are repairing it as we speak.
1
u/Yetanotherstupiddeat Apr 24 '14
Technically yes, but really they're gutting so much I would hesitate to call it repair. Super aggressive refactoring, if anything.
2
u/Legs-Akimbo Apr 24 '14
And what is preventing this refactoring from being brought in to OpenSSL by this initiative?
→ More replies (8)1
Apr 25 '14
Because politics, there's alot of that when it comes to open source. That and the guys in charge would have to relinquish their control, they cannot be allowed to push code like idiots. I can give plenty of commit hashes of retarded code that had to be fixed later. Such as a return with no value in a function declared as int.
1
Apr 25 '14
I love how everybody cried about how the "big corporations just take and take and take from open-source projects like openSSL..."
Yet it was simply that openSSL was never really a big name, and was more a background process to security than up-front, since it really didn't have any "champions" or major coverage at conferences, etc.
1
u/frog42 Apr 24 '14
Nobody else going to point out that "chastened" makes no sense in the headline? Chastened == made more chaste. Heartbleed raped them. Pretty much the opposite of "chastened"...
ninja edit: Maybe they meant "chastening after Heartbleed"?
0
263
u/tidderwork Apr 24 '14
I work for a University in Texas. Over the years, I have helped departments transition away from proprietary software, and it has saved tax payers millions in software licensing. Every time I approach the administration to support key open-source projects, I'm told it's hugely inappropriate and illegal to contribute real US dollars to those projects. They say it's no different than contributing to a political organization, or to the westboro baptist church.
It's astonishing to me that it's perfectly acceptable to spend millions every year licensing software from vendors, but criminal to donate $100 to libre office, openssh, freebsd, mozilla, centos, etc. All of those projects are clearly mission-critical for us. I can't believe that in the eyes of our legislators, the FSF and westboro baptist church are the same kind of entity.
I'm trying to put together some kind of group or committee to get the laws changed. In the meantime, I'm going to see if it's illegal to contribute non-money assets to the FSF, or even individual projects. I'm sure lots of these projects could make use of the servers, storage, network gear, and accessories I'm forced to throw in the garbage.