Laurie Voss, who was one of the founder of NPM, the Javascript package repository that is now run by Microsoft, has written a longer post about an idea about how to fund Free Software that I found interesting. It’s worth reading if you have some time and makes good points even though I will critique it a bit. But financing Free Software is an unsolved problem right now and any meaningful contribution can help us move this forward.

So, let’s dive in Laurie’s idea is quite simple:

We need a way to force companies to pay for Free Software and the package repositories (NPM, PyPI, etc) are the ideal chokepoint to enforce that payment. The package repositories should force companies to pay for access and distribute the money among the packages that were being used:

Second, a fixed slice of that revenue is a royalty, and it goes to the packages. Not to the registry, not to a foundation, not to a grants committee with an application form. Pro rata, to every package that shows up in the paying customer’s dependency trees, weighted by how many paying customers depend on it, automatically, every month

Laurie Voss, https://seldo.com/posts/nobody-pays-for-open-source-we-can-force-them-to/

Now I do think that a few things in the post are smart: Turning charity towards a forced expense for companies makes sense, companies already know how to pay bills and licenses. Also: Understanding package repositories as chokepoints is a clever idea. I also appreciated how he directly addressed the “but people will cheat to game it” argument basically with a “yeah, might happen to a degree, but not doing something cause someone might cheat is not a good strategy” which I think we need to apply a whole lot more when it comes to support systems. Means testing is shit and we shouldn’t do it.

But you know how sometimes you read and argument by someone and it is built well but doesn’t click with you until you realize that their concept of the problem space is very different from yours? This is one of those cases. After I read through the article and thought a bit about it, I had this sort of intrusive thought: “I bet Laurie uses a Mac.”

This is not some FSF-style purity argument or me hating Macs (I do but that’s only cause I have to use one at work and not the matter here). This realization explained to me, why Laurie’s solution didn’t do what I think matters most.

I think Laurie – who as I mentioned in the beginning was one of the founders of NPM – has a very narrow view of Free Software (I keep writing Free Software where Laurie writes Open Source and maybe that is also part of the difference in understanding): To him, Free Software are all the libraries that you (or your “agent” given the hellscape we live in today) can pull into your software project through a package manager such as NPM. And I’d disagree.

Not just cause a lot of those package managers (for example NPM) are run by for-profit companies, though I do think that creates a non-ideal incentive structure. Because what he describes is basically the Spotify sales pitch – at least how many users think about it. Spotify gets money, takes a cut and distributes it among the artists that their users listen to (let’s ignore for a second that that’s not how it works for bullshit reasons and a lot of the money just goes to Taylor Swift). But then Spotify realized that they would have to pay out a lot less money if they created their own music and got that into the playlists. Having that much money flow through a business just to distribute is a recipe for triggering ideas. Like the ones MBAs have. Horrible ideas.

I disagree because that sees Free Software as this backend stack that companies (and if they want to also individuals) build upon. He tries to solve the problem that if you maintain some library in the middle of the JS dependency tree you are basically working for Amazon or Microsoft without a paycheck. And that would do some good, would support a few people who I’d love to have a stable income.

But it also ignores a lot of Free Software that aims (I’d argue) even more at human beings and their needs. You do not install GNOME through NPM or PyPI. It comes with your distribution who put in a lot work into packaging, potentially patching and curating a whole environment for you to be able to use your computer in a more liberating way. It ignores all the infrastructure projects that work outside of the package registry pipeline. Think of all the core C libraries that a modern Linux system is build around. None of them come from any of those package repositories.

Laurie’s idea implicitly frames Free Software as “the underpaid supply chain for startups and big tech” which is partially true, but that’s not the core of it, I’d argue. Some Open Source communities might disagree of course, especially the JavaScript community feels (from the outside) a lot less political than other parts of the Free Software ecosystem. But I think what Laurie’s suggestion really brings forward is the question of what kind of software are important.

All software is important of course. Our data flows through these systems, our infrastructure is built on those countless libraries that are thanklessly being maintained in people’s free time at the expense of sleep. Laurie’s analysis is on point with that. But I am a bit old maybe so when I think about computers I do think about the device people have in front of them. Not just “the services on the Internet that accumulate your data and rent compute back to you” but the thing you start up where your files are. Where you start the tools you want to use to solve a problem at hand, to do a task, to play and have fun.

Obviously he push towards web-based solutions has reshaped computing. “A website with a mobile app and a chrome wrapper for Mac, Windows and maybe Linux” has been turned into the default. everything has a server now that does … something. Often useful things, store your data in a hopefully safe way or provide resources you can’t afford to buy or that wouldn’t be worth buying for the one time you need them. In my impression Laurie thinks about how to fund a world of Chromebooks, of dumb terminals attached to Internet services built on Free Software stacks.

But is that the path that we are 100% happy with? I spent the day on trains from Zurich to Berlin and the wireless fucking sucked. And so much shit just didn’t work. What worked was what I had downloaded before to have available for applications on my machine.

Of course one can argue that cell service and wireless will just get better and that the future is “the Internet + terminal”. But why do we have to subscribe to this understanding of computing that has been defined dominated and pushed by Google, Amazon and Microsoft?

When thinking about how to fund software we quickly end up at the question of what kind of software we want to fund. Not just which single libraries or developers to support but what kinds of structures and systems we want to see in the world.

I think Laurie’s idea is a clever hack to siphon money out of big corporations. I am a big fan. And it would fund a few people who today don’t get funding or who have to have a day job on the side to be able to eat. That is fantastic.

But it is also built around the idea that the kind of computing that big tech has pushed in order to establish chokepoints. Build around the processes that big tech corporations use to build software. And maybe that’s my main irritation.

Package repositories are useful to individual developers. I find a library I could use for something and I can quickly install it. Great. But here’s the question: Am I the target audience of those registries or am I just … kinda there? I think that repositories such as NPM or PyPI are build especially for corporate software development processes. For contractors and developers who have to think about SBOMs and dependency trees to be able to deploy their software to hundreds if not thousands of machines based on a git commit and a successful CI run. DevOps engineers have polished those pipelines to be almost frictionless. They re so polished, that you can even have stochastic parrots use them.

But that is infrastructure for big corporations and their needs. And I am not saying that package repositories are inherently bad, I just wonder if just following those corporate logics is the way. Because setting it up that way does create an implicit pressure towards being a proper cog in the machine that keeps Google’s software supply chain running. They are – after all – directly paying you to use your code.

I think we need to find better solutions to make developing Free Software humane. That does include giving people the resources to be able to learn how to do it and to do it. And the two core resources here are time and money – with time often coming from giving people money so they don’t have to have another job. And that is how we should think about building systems to support and fund the creation and maintenance of Free Software. Not as a way to keep the people Microsoft or some Startup doesn’t want to hire but whose work they’d like to use kinda fed. But as a way to actually create space for human beings to come in and be able to contribute. Regardless of whether your library fits into Big Tech’s supply chain.

The last few years have been hard as someone who is not only very much engaged with technologies, their applications, damages and affordances as well as their politics. We’ve been moving through hype cycle after hype cycle with increasing promises at increasing speeds. Which is somewhat natural of course: Being built not around something material, something real, but around a “world-changing narrative” is what defines a hype.

There is the reliance on experts, the hope that they’ll call out what’s going on, point the finger at the issues at hand. But that all only works when there is working journalism that translates and transplants those critiques into the mainstream discourse. Because how else are normal people supposed to be able to have any opinion on how the world is being influenced and reshaped?

I’m not saying that there is no great tech journalism. I am a very happy 404media subscriber for example and there are other sources of great or at least good journalism about tech (when I write “tech” I don’t just mean that as shorthand for “technology” but as a signifier for the digital-technology-industrial-political complex built around Silicon Valley ideology and companies). But the issue is that “technology” is no longer a journalistic vertical, it’s horizontal. Which is a big problem.

There has been this shift (and I am not knowledgeable enough to be able to point at the exact time frame) towards equating “progress” with “technological innovation and development”: Society is moving forward if tech produces more shit. If you’ve heard me talk you might have picked up on me mentioning that today’s vision of the future is just a thinner iPad every few months.

But if “progress” – which is a political term about values that one aims to manifest or express or expand in the world – is just replaced with following PR messages about whatever tech wants to sell next, that does not only make the space of possible futures paperthin, it also puts massive amounts of power into tech’s hands. And I don’t just mean economic and political power (which is also true and needs to change massively, rapidly and aggressively) in this context I mean narrative power.

Let’s look at the last few months. “AI” labs keep releasing basically unsourced accounts about how their stochastic language models are “hacking” or how they are “solving hard math problems”. And sure those would be – if they were true – very important developments. But are we having actual conversations about it outside of very niche circles?

You can use LLMs to run attacks on infrastructure. That’s obvious. A lot of code and howtos describing how to attack services and programs is in the training data so getting an LLM to emit something that might even manage to break into a system isn’t surprising, especially if your are a frontier “AI” lab and can burn more money than god on those experiments. We’ve had exploit frameworks for decades and this just adds to it: A well-funded security researcher can use a string generator to do a more advanced form of fuzzing attack on some service. That is 100% real and does change the threat model of everyone on the internet a bit. But it’s not “OMG AnthrOpenAI’s AI is hacking teh world, Skynet is near!!111”. But that’s where the discourse lands. Because it’s profitable: “AI” Labs can keep their narrative of their LLM having magic powers intact in order to attract more funding to fill the hole in their balance sheet. “Experts” can hit that drum to get invitations to interviews and panels and keynotes about how very scared everyone needs to be.

We end up with everybody scared and badly informed. Because those “AI” models do not plan to hack shit. They don’t do anything without someone prompting them to do something. The issue is that those systems – being stochastic in nature – might go totally off the rails and break something. Or do something interesting. Or just waste a few thousand kWh of energy on nothing really. It’s unpredictable.

But not unpredictable in the way that the discourse these days implies. These systems are not “intelligent”, are not scheming or planing or doing something alien beyond our comprehension. If hooked up to the ability to run code they will run some generated code. Some of it will be absolute garbage and not run, but if the prompt and the moon phase align they might also get to exploit some bug in some – potentially vibe-coded and unreviewed – piece of software.

And that is what’s so toxic about the discourse: We are letting those labs and the boosters of the current hype technology get off the hook without even one relevant question.

Take the recent conversations about how ‘”AI” might kill us all with a 10% possibility’. That’s what a leading person at Anthropic says. And is being reported not as “look, a crank from a weird rationalist cult showed his ass again” but as “Anthropic warns: AI might kill us all”. What the hell are we doing? How can you interview a person who says that and not go *record scratch* “so, you are telling me that your stochastic language model could kill us all with a significant chance and you are still developing it? Are you psychotic?” before going into actually questioning how a synthetic text extruder reasonably would do that.

But tech is progress, tech is the future. So we have to take tech leaders’ mental breakdowns as gospel.

Sure, one can have interviews with OpenAI or Anthropic people about whatever story they are telling us. But you do not need to be an expert to ask: “Okay, but does that even make sense?” You just need a spark of mistrust in authority. And that’s a thing we lost.

We put all our eggs into the tech basket hoping that GoogleAmazonMetaAppleAndWhoeverelse could technologize our problems away. And I am increasingly convinced that the lack of critical analysis of their statements is not just about the many economic pressures that journalists have to operate under, the brutal schedules that allow little time for reflection and thinking. I think that many are scared.

Not scared of what some random technological artifact might do. But scared about challenging tech as the dominant mode of making the future. As soon as you stop taking Dario Amodei or Sam Altman or one of those other unpleasant people serious, you have to start asking yourself where to get your future now. As soon as you stop believing that you need to take Anthropic rationalists or weird freaks working at Meta serious you have to challenge the dominant narrative of tech being the well of progress and future.

And that is scary, I understand that. It would be really easy if every 5 or so years we could just ask some random white boy who went through y-combinator or so about what the future is and just run with it. Okay. Metaverse. Really? If you say so… Oh, Metaverse was not it? Okay, now it’s chatbots. Surely this time it’s gonna be fan-fucking-tastic.

We can spend our limited time on this earth hoping that serial liars like Sam Altman or Elon Musk or whatever their names are surely will not screw us. Or we can go and rediscover the spark of challenging those narratives of the powerful. We have no time to keep idling around in their hellscapish dreams and visions. We need to challenge them. Find better, humane, convivial narratives and need to work towards manifesting them.

And one of the most important things to do is to stop letting those LLM-brainwormed men keep talking about what their magic chatbots will do without challenging their psychotic behavior. If someone really believes that their invention will probably kill humankind and they still happily take their fat paycheck and keep building it, keep demanding more and more resources for that, that person should be forced to have a few months of intense therapy before we let them out into the world again.

Think about a person who works on developing chemicals basically saying: “Yeah we’re just throwing random stuff together. There’s at least a 10% chance that – since we don’t really do any security – we might poison everyone, but please give me all the money you had planned to give to hospitals. KTHXBYE.” The world we currently live in is the one where we respond with “Sure Mr. Altman. Here’s also all the money we wanted to spend on schools.”

That is not a world we should want to be in. Should allow anyone to keep us in. And opening a portal to a better world sounds hard, but the walls between potential worlds are basically just in our heads. We just need to start by breaking the chokehold tech has on the discourse. The spark is still there in each and every one of us.

Omarchy should not matter. But sadly it does. As a power grab.

If you don’t know what Omarchy is here’s the short summary. David Heinemeier Hansson, creator of RubyOnRails, owner of a software business and millionaire, decided a few months ago to go all in on Linux and – because that’s just his MO – thought that turning his setup into a project made sense. Omarchy is just that: A pretty standard Arch Linux distribution with a handful of configuration files, that Heinemeier Hansson (or DHH as he is often called) wrote, or vibed or whatever. There is nothing wrong with this, custom, opinionated special purpose distributions have been part of the Linux culture for a long time and provide a lot of value and experimentation that sometimes even flows back to the original project. In a way Ubuntu Linux is just that to the basis Debian.

There’s also nothing wrong in more opinionated software – quite the opposite. I do think that RubyOnRails and similar frameworks gained traction especially because they do have a clear idea of how they see the respective problem domain. There’s even the statement “There should be one – and preferably only one – obvious way to do it” in the Zen of Python. Having a strong point of view is not a bad thing in software or in general. The problem is the kind of points of view DHH has.

I don’t want to go into all the gritty details here, Brennan Kenneth Brown did a great job with their article “Normalized Fascism in Open Source: $12 Million Given to DHH“, but here’s the short version. DHH is a racist and a fascist. He recently wrote articles on how there are [Content Warning: massive racism] too many brown people in London these days. In July he wrote an [Content Warning: Racism, anti-romanism] article comparing Roma communities (using a slur for them) to “wolves” that should be “shot”. His X account is also know to be “edgy” in a similar way. A few days ago he posted sort of a manifesto for his set of config files:

There’s even a longer version on the website. Even without a strong background in antifascist literature or history this reads like a fascist creed. About unity and identity. About “holding the line” (against codes of conduct and the rights of marginalized people as the website explains). About how there always needs to be a strong leader who makes the decisions. Given DHH’s other writing this is not a misguided joke, this is how he thinks about the world.

I began this text writing “Omarchy should not matter” but I have not explained why it does. It’s surely not about user numbers (it’s a clunky distro aimed at people who love to cosplay hackers). But it is about power.

DHH has used his connection to CEO’s of tech corporations and his position as influencer to collect up to now above 18 million dollars of funding for Omarchy. He uses that money not for himself (he has enough of that) but to fund certain pieces of Software he uses in his distribution. Like for example the window manager hyprland whose main developer the Omarchy money now funds. What is “Vaxry” known for outside of a niche window manager? He runs a community based around LGBTQ discrimination and participates in that (see the short summary on Drew DeVault’s “Weird Little Guys of FOSS” list). His bigotry is so consistent that he was banned from participating in the Freedesktop.org community where all the other developers of window managers and the free software desktop stack collaborate. And it was long before DHH funded him.

One could see a world where a CEO using his connections to drum up some funding for free software projects would be a good thing. But that’s not the world we live in I am afraid. DHH got 3 million USD from Digital Ocean (a cloud provider) for Omarchy. Basically at the same time where Digital Ocean cancelled their support of Flathub and GNOME that amounted to a value of 50 USD per month.

DHH is using his position and his influence to accumulate donations that he then can distribute to projects that align with his fascist worldview and ambitions. And in a time where many important projects and infrastructures are strapped for cash running just on the goodwill of a handful of people that is increasingly dangerous. Not because its corporate money – a lot of funding for open source comes from corporations, they are after all who are sucking up all the surplus from people’s labor. It’s because this amount of money gives him power.

The Omarchy foundation will be where projects in desperate need of funding will be pointed. And will a project focused on human rights and social justice get funding from our fascist overlord? What kind of pressure can that exert on projects who have to decide to either die due to lack of funding or kill their code of conduct?

An open fascist is building one of the bigger sources of funding for open source fully under his individual control and sucks up a lot of money that otherwise might have gone to liberatory projects. Community projects. Antifascist projects.

And that is why Omarchy matters. Sadly. Not because of its technical merit (even though those fascists love to use the “merit” argument to fight human rights) but because of its leader, his connections and his ability to accumulate financial power. Without anyone in that ecosystem saying anything about how that leader operates and talks. And you might know the saying: If there’s a Nazi and 10 folks sitting together at a table and nobody says and does anything? There’s 11 Nazis at that table.

Omarchy got a lot of recognition recently. Not only by corporate donors but by Youtubers and other tech influencers who kept praising it and nudged people (who might not know about DHH’s exploits) towards testing it. To become “a hardcore linux user/dev” or whatever other chauvinist argument they made. This makes it dangerous.

Running Omarchy means contributing to this dynamic. It means willingly integrating oneself into a fascist community. Legitimizing it. Supporting it. Omarchy is a fascist project that normalizes fascist thinking for everyone entering that community (even unknowingly). The baseline has to be not to use that system. And as people who believe in human rights and dignity, in community and a tech world that can be better we need to oppose Omarchy. Need to make sure it gets no seat at any table. Support projects who actively refuse to collaborate. Support projects who care about human rights and flourishing. And do not do business with the companies who willingly support fascists.

Siamo tutti antifascisti!

(Share this message about Omarchy [or some other similar post] around in the tech circles you frequent. Tell people about the background of this hyped Linux distribution and its fascist leader. Quit your 1password or Digital Ocean accounts and mention that it is because the support fascists.)

As some of you might know, I am part of a team of people moderating a Mastodon server. And as so many of those servers we’ve been having some problems with fake signups lately. This is about how we mitigated the issue and how it was beneficial beyond that.

So for those who don’t know what Mastodon is: It’s an open source software that you can use to connect to an open federated social network called the Fediverse. You can use many different kinds of software to be part of the Fediverse, some look a bit like microblogging services (think Twitter), some look like image services (think Instagram) some look more like reddit, etc. If you have an account that connects to the Fediverse, you can interact with all those services. But that means you need an account on a server and many people have no idea how to run a server or don’t have the resources to do so. Which is why many public servers (like the one I help maintain) offers accounts to people.

There is no rule that those accounts have to be free or for everyone. Some accounts are just for members of a specific group (who can still interact with the whole Fediverse, but on that server only people from that group can have an account) but there are many servers that let you just create an account, sometimes with a moderation step, sometimes completely automated.

And while that is convenient and would work well in a perfect world, that sadly is not the world we live in. Spamers found that loophole as a way to quickly create accounts all over the fediverse to send around scam links etc., often taking real people’s self-descriptions with a new name and generated image to fool the moderation.

For us that meant that every day we had a whole lot of subscribers that were (mostly obvious) spam. And it kinda tainted (at least my) perception: An email about a new signup request triggered an emotional “oh shit, more spam” reaction in me. Which sucks, it’s not how I want to look at people asking for an account. So we looked into blocking disposable email addresses and some other hacks but at some point decided, we’d just disable automated account creation. You cannot just create an account on tldr.nettime.org. What you get is this:

For the “AI” bots this is a big stumbling block. The automated button is gone and there’s not even an email address directly in the text (that one is on the front page where people triggered the “Create Account” workflow though). Spam went down to zero. Instantly. (No shit Sherlock!)

But what also happened is that people send us emails asking for an account. Telling us in a few words about their friends or comrades on our server or how their work relates to the community we are aiming for. “Signups” became actual human connections again, we understood who was joining and because there was a direct line of communication we could add a few remarks about maybe following the account used to send around status messages about the server itself and other onboarding info. For us the workflow is marginally harder than just clicking “yes” or “no” in the admin interface, but generating an invitation link and responding to the email also is not that much work. And at least for me it totally changed my emotional response to this moderation task: It is cool to see interesting people sign up, look at their websites and work. It feels like welcoming a new person to a party and less like fighting away spam bots.

So for us this new process works well. And I understand that this manual process does not scale up to these massive servers with tens of thousands of users. But maybe that’s a good thing? Maybe that is an indicator that these huge servers are just a bad idea? That we should structure the internet and our platforms around smaller, more connected groups that then connect to others.

From my point of view our approach to fighting spam by making bringing new people in a (short) conversation (if just via email) has worked way better than I thought. And if your server has a similar problem, maybe there is an easy and actually better solution than looking for scripts and filter lists and other technical tricks.