Attention and Prevention

Dear Linux Pro Reader,

The Linux Foundation launched the Core Infrastructure Initiative (CII) [1] as a bold stroke in 2014. The foundation, which stands astride the FOSS world and mediates between the realm of business and the hacker culture, started the CII as a reaction to the infamous Heartbleed bug, which shocked the open source faithful and left doubts about the security of FOSS technologies. The original goal of the CII was to "fund and support critical elements of the global information infrastructure," which sounded like a good idea. I didn't have high hopes for them doing much besides giving out money, but money is always good. In the business world, where the Linux Foundation keeps one foot, if you can't make a problem go away by denying it, the next best thing is to pounce on it dramatically and say, "We've got this under control!"

The plan seemed to be to accumulate a big bank roll through donations from corporate partners and then dole out the money judiciously to help core infrastructure projects in need of attention. But which projects? Thousands of Free Software projects exist today. Some are huge corporate operations; others are tiny utilities written years ago by a single developer. Do you chase after the biggest projects with the most lines of code, or do you hunt for hidden weak links, as an intruder would do, searching for that tiny mousehole no one is watching?

[...]