Interview with celebrities | open source is a double-edged sword for security -- Wei Jianfan, author of the Chinese translation of cathedral and market

| Reprinted from ： Open source rainforest

| edit ： Zhou Yunshi

Current interview lineup

The guest ： Wei Jianwu ,《 Cathedral and market 》 Author of Chinese Translation , Doctor of science, Department of computer science, School of information science and technology, Peking University , Member of the financial technology special committee of the Chinese Financial Association . Engaged in information technology management for a long time 、 Financial technology 、 Network security 、 Software Engineering 、 Blockchain Technology 、 Research and practice in open source technology and other fields , Published many articles on interpretation of open source licenses .

host ： Zhuang Xiuwei , Director of the open source society 、 Huawei open source management center open source experts . Participate in various community activities all year round , Enthusiastic about open source governance 、 Open source growth 、 Open source academic research and sharing .

---

---

Q： How did your technical optimism come into being , How to view the current technological progress ？

Zhuang Xiuwei ：

Many people may not know much about technological optimism , Let me first briefly talk about what I understand as technological optimism , Then Wei sir To expand . I understand that technology optimism does not mean that technology is omnipotent , Instead, we believe that technology can even be the most likely to solve all kinds of problems in the modern world . Further technical optimism is used to refute , For example, some people think that technology will bring many problems , But technology optimists will say , Although the problem is brought about by technology , But the solution still depends on Technology , We must not avoid these problems by retreating .

Wei sir‍：

Basically consistent with my understanding , Technological optimism is more optimistic about technology solving human problems . How did my technical optimism come into being ？ in fact , Many of my ideas were not invented by myself , More through constant reading 、 Observe 、 Think and confirm , A theory , If it's right with reality , I initially believed in this theory , And will further verify it with more facts , If it's still right , I believe it more and more . Technology can solve human problems , I look down , Basically right , Although not only technology can solve the problem .

Table Wei just said that technology is not everything , But I think it is almost omnipotent . For nearly one or two hundred years , Technological development has brought great progress to mankind , Let me have this optimism . You can see , Technology has freed people from hunger to a large extent 、 disease 、 poor 、 Toil , Even war , It has brought great quality improvement to people's life .

There are more complicated factors behind this , And technology will bring more profound changes , I have no intention of saying , I just think there is such a logical chain ： Everyone has a good heart , From the bottom of my heart, I always want to benefit myself and others , As long as one has a chance , Will find ways to improve their own and others' lives . Technology is the key means for people to improve their lives , And technology is man-made , So technology always follows people's wishes , Develop in the direction of improving life . Human intelligence is amazing , So technology can always be improved , Life can always be further improved . I think this logic will continue .

Consider from the simplest example , Household appliances are accessible to all of us , Think about it , The refrigerator 、 Washing machine 、 sweeping machine 、 Floor sweeper 、 Smart appliances such as dishwashers , Has it really improved our life ？ Another example is the progress of medical technology 、 Advances in communication technology , Has it improved our life ？ Over the years , As long as you think carefully , You can thank the benefits of technological progress from your heart . Of course , Technology is a broad term , The progress of Psychology 、 The progress of Economics , Can be regarded as technological progress , Everything that helps people control things , Can be regarded as technology , I'm not going to expand on that .

Zhuang Xiuwei ： In fact, I'm also a technology optimist , But I have changed a little in recent years . I recently read a book , It's called 《 The rise and fall of American Growth 》, It's about 1870 - 1970 In a century of , An economic revolution Roll beauty countries , The story of the unprecedented improvement in the living standards of the American people . The first industrial revolution and the second industrial revolution are of great significance to the happiness of human life , In particular, the economic life of Americans has greatly improved , But for the third time , The information revolution after the invention of computer , The growth brought to the American economy is actually very limited , For example, internal combustion engine 、 steam engine 、 automobile 、 The plane 、 The invention of refrigerators and the like has brought about an increase in human beings , It may not reach half of the previous two times . In addition, now Moore's law is about to expire ,IT The rapid growth that technology can bring is about to begin , There is no exciting feeling that the world is still waiting for us , This is actually quite a blow to me , It will make me reflect on this .

Wei sir： I have really thought about this problem . I think the main problem is , The development of information technology is like a black hole , Absorbed a lot of smart 、 A wise mind , Many scientific research talents have invested in this field , So that other fields are a little understaffed , It's not as fast as it used to be , But I think this is temporary ,IT Aspects have developed to a certain extent , People will start to develop in other aspects . at present ,IT The potential of aspect has not been fully released , Many applications are far from being shown , There are many exciting inventions that will slowly emerge , Many problems in other fields may be applicable IT solve .

Q： Wei sir Currently engaged in safety work , He is also a very senior expert in open source , What do you think of the relationship between open source and security , How to view these two areas ？

Wei sir：

generally speaking , Security problems are more caused by coding , Unsafe code brings unsafe systems . From the most intuitive point of view , I think open source has something to do with security , But relatively independent . Not open source , It is necessary to adopt different safety management methods or different safety technologies ; It doesn't mean open source , Security issues are significantly less or significantly more .

《 Cathedral and market 》 The author of Eric S. Raymond say , Open source is more conducive to discovery Bug, Because the code is public , There are more opportunities for review and improvement , To some extent, it improves the quality of the code . however , Security issues are often very hidden , Even open source code may not be easy to find , Discovery of safety problems , More professional personnel and tools are needed . A community of open source projects , If there is no safety tester , There is no security testing tool , Safety issues of the project , It's hard to find out .

Open source is a double-edged sword for security , Open source helps developers discover Bug, But it also helps attackers find problems , It is difficult for attackers to analyze binary , But if you give the source code to the attacker , The difficulty of analysis will be reduced . Then there is the problem of supply chain security , This problem is also more complicated , In particular, some unsafe open source components have been widely used , The problem is even more serious . But closed source software also has supply chain problems , It's just slightly affected , After all, free things are used more .

Overall speaking , Closed source will have a weak advantage in safety , But open source has an overwhelming advantage on the whole , Because the trend of open source is unstoppable , Therefore, there is no need to consider shutting down the source because of security problems .

As for how open source can enhance security , I think it's the same as how closed source can enhance security . What people need to consider is how to invest more in developing security , How to develop requirements 、 Design 、 code 、 unit testing 、 Integration testing 、 Consider and do a good job of security in the deployment stage , There are many theories in this regard 、 Methods and tools . Closed source can be used , Open source can also be used , No big difference .

Q： How to choose open source software License ？

Wei sir： I am right. MIT、Apache、GPL These three protocols have been studied more , These three are also the most commonly used .BSD People used to use it a lot , But now much less , I think MIT Basically put BSD Replaced the , They are basically the same .

If you just play by yourself , I don't care much about the commercial value or whether there will be a larger market in the future , I think it uses MIT That's enough , Because you don't expect to get more potential benefits .

If it is a business friendly 、 Tolerant 、 I hope there will be more development projects in the future , Just use Apache. In the law ,Apache Than MIT More rigorous , Think more carefully .

If you recognize the concept of free software , Pay more attention to the freedom of software , Just use GPL, Especially when your project is in a relatively basic position in the whole software ecosystem , And you don't want to see private branches , use GPL better . because GPL There are very strict restrictions , Derivatives are also required to be open source , Can better realize the author's wishes . but GPL There's a side effect , It's infectious , Many people will be afraid to use private code because they are afraid of being infected .

in general , Before selecting a license , I hope you can read the license carefully , Study thoroughly before making a choice .

Q： About 《 Cathedral and market 》 This book , Why did you translate it at first ？

Wei sir： This is more an opportunity to take the initiative to find the door , At that time, Huazhang publishing house wanted to translate this book , The editor found me on the Internet . Of course , I feel honored to translate this book , Because this is a famous book , author Eric It's very famous , This book combines open source and anthropology 、 sociology 、 economics 、 Political science and other aspects are integrated into one , High ideological value .

Zhuang Xiuwei

： I feel very much .《 Cathedral and market 》 Marcel is mentioned in · Moss （Marcel Mauss） Written 《 gift 》, Along 《 gift 》, I also read Professor Yan Yunxiang's at the University of California, Los Angeles 《 The flow of gifts 》, These are books on anthropology , That's why I fell into the pit of anthropology , Read a lot of related books . Recently, I'm still reading a book about a French anthropologist going to South America , Look for books about Indian cannibals , And it's interesting , Especially increase your knowledge .

Q： Wei sir Read a lot of history books , Talk about how reading history books has changed you ？

Wei sir：

The direct impact is relatively small , It can't bring direct changes to life , Nor can it provide specific guidance for daily affairs . More changes are to understand things that were not understood before , Understand the changes in human history and possible development trends . At least in my opinion , It benefits a lot .

Specific examples are not listed , Just say one thing about my feelings ： People under certain historical conditions , It will form corresponding social organization forms and interest relations , With the change of resource distribution and Technological Development , The balance of power between different classes has changed , Social patterns will also gradually change . The main driving force , It is the instinct of human nature to constantly expand their own rights , Once economic power and technological capabilities make it possible to improve the existing status quo , This will happen , So as to achieve a new balance in the social form .

As Marx said , Economic basis determines superstructure .

Q：“ The definition of wealth freedom ” What is it? ？ Is there any way to wealth freedom ？

Wei sir： The definition of wealth freedom , In fact, many people have made it very clear , That is, passive income brought by existing assets alone , You can support yourself without work （ Including the family ） Relatively fixed living expenses , Can not rush about for salary , Have time to do what you want to do .

There are actually several points , First, passive income , Second, fixed expenditure , Third, there is something you want to do , Only when these three points are satisfied can wealth and freedom be counted , Especially the fixed expenditure , You can't spend and upgrade just because you have money , Then you may have no money . We should rely only on passive income （ Such as interest 、 Rent, etc ） life , And never spend the principal , Such wealth and freedom are sustainable .

The purpose of wealth freedom is to save time , Let yourself have more time to do what you like , If you already have plenty of time to do what you like , Then there is no need for wealth and freedom , Just keep the status quo . in fact , Most people , It is impossible to achieve the state of wealth and freedom , It's impossible to have a lot of time to do what you like . This is more of a vision . Understand the concept of wealth freedom , It can encourage people to think more deeply about financial management , Encourage people to accumulate wealth for the future .

There are many books about how to acquire wealth and freedom , But more about some ideas . He obviously can't tell you exactly how to do it , More about thinking and behavior habits . For example, navar is 《 Navar collection 》 Inside say ： You need to have a professional skill , It's best to use the Internet 、 Server tools help you make money , Instead of making money by hiring people as before , It's more efficient . And he said ,“ Provide valuable things to the public , Especially if they don't know how to get , And large-scale supply , Learn marketing , Learn to create . If both will , Nothing can stop you from succeeding .” Although these contents cannot be directly applied , But at least tell people a more correct direction .

Q：Linus There is a classic saying , It's called Just For Fun. But in the industry , I've been talking about the commercialization of open source . Wei sir How do you think about making money from open source commercialization ？ Or how likely is it ？

Wei sir： In the last century 90 S to Eric S. Raymond The time when I wrote this book , I think it is the golden age of open source , Although it is not a golden age in the market , But emotionally , I think it is . At that time, people engaged in open source were particularly passionate 、 Dynamic , Those people are purely interested , It's simply to bring more shared code to the computer world and forget to eat and sleep , That feeling is particularly beautiful , Especially memorable . After the vigorous development of open source in recent years , After more and more open source projects are commercialized , I feel less excited .

There is a prediction that “ Open source will eventually devour software ”, Maybe eventually all software will have to be open source , Because under the same quality , Open source is definitely more competitive than closed source , It's like a “ Internal volume ”,“ Internal volume ” We must rely on open source to survive better . But this prediction may still be wrong . As before, we thought that websites would be free , But there are still many websites that charge , And we are willing to pay for it . So even if open source can ultimately dominate , There will still be many closed source software , The forward and reverse of things may always alternate .

Q： How to view the incentive mode of blockchain ？ It seems to be a money making model that is relatively friendly to open source .

Wei sir：

If we can find a way to combine them , And well designed , It can be successful in theory , But at present, there seems to be no particularly successful case , Maybe there will be . If programmers can prove every contribution to open source software , After the success and benefits of this software , These passes will bring benefits to programmers . This is also more in line with the moral concept , Everyone gathered to work , Contribute more , Gain more , Less contribution , Less gain , There is no question of who exploits who . But how to correctly measure the amount and quality of contributions , This model is quite difficult to build , But this general direction is good .

Related reading  | Related Reading

Interview with the big guy | Various strange situations in the open source community —— The book of night sky, Chen Zili tison

blockbuster ！ China open source map officially launched , Sincere invitation All open source communities join in CO creation ～

Programmers engage in open source , What is the best book to read ？

Introduction to Kaiyuan society

Kaiyuan society was founded in 2014 year , It's made up of individual members who volunteer to contribute to the cause of open source , In accordance with the “ contribution 、 Consensus 、 Co governance ” Composed of principles , Always maintain vendor neutrality 、 public welfare 、 The characteristics of non-profit , It was the first to “ Open source governance 、 International connection 、 Community development 、 Open source project ” Open source community Consortium for mission . Open source community actively supports open source community 、 Enterprises and relevant government units work closely together , With “ Based on China 、 Contribute to the world ” For the vision , It aims to create a healthy and sustainable open source ecosystem , Promote China's open source community to become an active participant and contributor to the global open source system .

2017 year , The open source society has transformed into a completely composed of individual members , reference ASF And other international top open source foundations . In the last seven years , It links tens of thousands of open source people , Gathered thousands of community members and volunteers 、 Hundreds of lecturers at home and abroad , It has cooperated with nearly 100 sponsors 、 The media 、 Community partners .

This article is from WeChat official account. - Kaiyuan society KAIYUANSHE（kaiyuanshe）.
If there is any infringement , Please contact the [email protected] Delete .
Participation of this paper “OSC Source creation plan ”, You are welcome to join us , share .