On Software Development (or "O Sr. SiIva disse..."): Open Source

Mostrar mensagens com a etiqueta Open Source. Mostrar todas as mensagens

segunda-feira, 29 de junho de 2020

REUSE: Open Telemetry project

Quoting JP newsletter: [Open Telemetry is for] the gathering of metrics produced from your applications. These metrics are either known common ones that are almost always collected (thread counts, CPU consumption, etc) or application specific but benefit from a common collection API.

After decades of every vendor/project/application building their own implementation for these, we're finally going to have a commonly available implementation and standard from the OpenTelemetry project:

https://opentelemetry.io/

From the site: "OpenTelemetry provides a single set of APIs, libraries, agents, and collector services to capture distributed traces and metrics from your application. You can analyze them using Prometheus, Jaeger, and other observability tools."

quarta-feira, 8 de maio de 2019

Logging: Flogger

https://www.infoq.com/news/2019/04/java-logging-framework-flogger

Quoting:
"new open-source Java logging framework called Flogger. Acknowledging that "[t]he field of open-source Java logging APIs is already extremely crowded", Google asserts that Flogger offers "many benefits over existing logging APIs". These improvements include reducing the cost of disabled log statements, increasing overall readability, and allowing extensibility.

Flogger, a portmanteau of fluent and logger, argues that one of its main benefits is "[l]ogging at disabled levels is effectively free." Whereas other logging frameworks may generate bytecode for disabled logging statements, Flogger aims to completely avoid it.

More specifically, logging frameworks typically utilize varargs to accommodate the unknown number of parameters in a logging method call rather than having hundreds or even thousands of different and unpredictable method signatures. This use of varargs results in additional bytecode, particularly to allocate an Object[] for storing the varargs. While additional bytecode doesn’t typically warrant concern, it becomes particularly important in applications with very fine-grained logging statements or logging statements that occur in loops."

domingo, 30 de setembro de 2018

JAVA: Using Java 11 In Production - Things To Know

Java 11 is out. What's new? You pay. Well, this is not all that's new, but you do get to pay if you the Oracle JDK in production:

Using Java 11 In Production: Important Things To Know | IntelliJ IDEA Blog

Quoting:

"The new six-monthly release cadence and Oracle’s changes in licensing and support model mean that any organization that deploys a Java application should take this opportunity to look at:

Where they get their JDK from (e.g. Azul, IBM, Oracle, Red Hat, or other OpenJDK build)

Which versions of Java they use in production

Whether or not they expect to get updates (e.g. patches and security fixes) for these versions of Java

Which versions they want to use in the future

How frequently they want to update their version of Java (i.e. to the next major version)

What sort of support (i.e. triage and bug reports) they expect for their version

Changes to the Oracle JDK

In the past, many of us simply downloaded Oracle’s JDK and used this in development, in testing, and in production. From Java 11, Oracle has changed the license of their JDK, so instead of having a single JDK build which can be used either commercially (i.e. with paid support) or for free (which many of us were doing), they now have two different JDK builds:

Oracle’s JDK (commercial) – you can use this in development and testing for free, but if you use it in production you have to pay for it

Oracle’s OpenJDK (open source) – you can use this for free in any environment, like any open source library

Note that since Java 11, Oracle’s commercial JDK and Oracle’s OpenJDK builds are functionally the same, so we should be able to run our applications on either without having to make any changes or losing any features."

And the components of the JDK are:

http://cs-fundamentals.com/tech-interview/java/components-of-jdk-environment.php

PS: Kudos to N. Raimundo for pointing this out.

terça-feira, 3 de abril de 2018

DIGEST: SW Licensing options

An interesting sum-up of some licensing options (http://www.codeproject.com/info/Licenses.aspx) that might be of interest as a first approach to a decision on what license can we apply (or are we obliged to use) when reusing and/or building upon.

Quoting (licenses valid for Code Project):
"

Microsoft Reciprocal License

A Microsoft open license and a free software license . Allows for distribution of derived code so long as the modified source files are included and retain the Ms-RL.

The Code Project Open License (CPOL)

The main points subject to the terms of the License are:

Source Code and Executable Files can be used in commercial applications;
Source Code and Executable Files can be redistributed; and
Source Code can be modified to create derivative works.
No claim of suitability, guarantee, or any warranty whatsoever is provided. The software is provided "as-is".

The Common Development and Distribution License (CDDL)

Based on the Mozilla Public License (MPL) that makes it more applicable for use outside the Mozilla Foundation.

The Microsoft Public License (Ms-PL)

Used by Microsoft. Compiled derived code can be distributed, for both commercial and non-commercial use. If the source code is to be redistributed then a complete copy of this license must be included in the redistribution.

The Mozilla Public License 1.1 (MPL 1.1)

Used by Mozilla and Firefox, among others. The patent clauses are not acceptable to some.

The Common Public License Version 1.0 (CPL)

Derived from the IBM Public License and influenced by the Mozilla Public License, and used by some Microsoft projects on SourceForge.

The Eclipse Public License 1.0

A newer version of the Common Public License that is in some cases more acceptable to business.

The MIT License

A very old license with essentially no restrictions on the use of the code. It also provides very little in the way of protection for authors or users. It is the same as the BSD license without the 'no endorsement' clause.

The BSD License

A very old license with essentially no restrictions on the use of the code. It also provides very little in the way of protection for authors or users. It is the same as the MIT license except that it includes a clause preventing the use of the author's name for endorsement.

The Apache License, Version 2.0

Slightly more restrictive (but still very open) version of the BSD or MIT license that adds patent clauses. Read carefully.

The Creative Commons Attribution-ShareAlike 2.5 License

A license that requires a link be visible on works that use this license. "Share alike" is what it sounds like, you can share this work as long as that work has a license similar to this one.

It is recommended that this license not be used for software.

The zlib/libpng License

A license with an emphasis on freedom of use and re-use, with a few restrictions.

A Public Domain dedication

Not a license, but a dedication to the public domain. All rights are given up and anyone can do anything they wish with the code. Please note this is not a license and provides no guarantees for the user and no indemnities for the author.

The Creative Commons Attribution 3.0 Unported License

This license lets others distribute, remix, tweak, and build upon your work, even commercially, as long as they credit you for the original creation. It is recommendedthat this license not be used for software.

The Creative Commons Attribution-Share Alike 3.0 Unported License

A license that requires a link be visible on works that use this license. "Share alike" is what it sounds like; you can share this work as long as that work has a license similar to this one. It is recommended that this license not be used for software.

The Creative Commons Attribution-NoDerivatives 3.0 Unported

A license which specifies that if you remix, transform, or build upon the material, you may not distribute the modified material. It is recommended that this license not be used for software.

The GNU Lesser General Public License (LGPLv3)

A derivative of the GPL that was intended to allow non-GPL code to work with, and call GPL code. The author of this license asks that you only use this license if you are licensing functionality already commonly available.

Example usage in your code

(Replace 'Foobar' with the name of your product)

This file is part of Foobar.
 
Foobar is free software: you can redistribute it and/or modify
it under the terms of the GNU Lesser Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
 
Foobar is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Lesser Public License for more details.
 
You should have received a copy of the GNU Lesser Public License
along with Foobar.  If not, see <http://www.gnu.org/licenses/>.

The GNU General Public License (GPLv3)

A common but misunderstood license. This allows developers to freely use the software as long as they use the same (or an even less restrictive) license for parts of the program that they wrote themselves. Viral in nature. Read carefully and make sure you understand the implications of using this license. Unacceptable to many.

You can write commercial software using software licensed with the GPL, but you cannot write proprietary software (meaning software for which the code is not freely available). You can sell GPL code, even if it's already being given away, or you can sell services attached to the code such as support contracts.

Any software written using GPL'd code must itself be licensed using the GPL (or less restrictive license) meaning it cannot be proprietary. This means that developers writing commercial software may not be able to use GPL code if they do not wish to provide the code.

One important note (thanks to René Pfeiffer): The GPL doesn't require you to publish the source to the world. Only the recipient of the software needs to have the source. If you have a customer, write GPLed software for a specific purpose and only give the binary to this customer, then only this customer must have access to the source code, not everybody and not the public; just the recipient of the (binary) code. This is in full agreement to the GPL. The main advantage is to play with open cards and not create a "blackmail" situation.

At the Code Project we prefer that developers allow other developers to use their freely given code in whatever way they wish - commercial, proprietary, or free for anyone. Our preference is that our authors do not use a GPL-like license.

Example usage in your code

(Replace 'Foobar' with the name of your product)

This file is part of Foobar.
 
Foobar is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
 
Foobar is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
 
You should have received a copy of the GNU General Public License
along with Foobar.  If not, see <http://www.gnu.org/licenses/>.

segunda-feira, 8 de janeiro de 2018

Static Analysis: FB Infer static analyzer now ships with RacerD for detecting race conditions (which are multi-threading issues)

Ah well, it feels good when big companies give back?... Maybe. Could be better. But this is better than nothing. :)

Facebook open-sourced Infer, a static analysis tool it uses for itself and now it ships with RacerD for detecting race conditions (as a code review bot). Sample code for detectable situations can be found here:

https://www.infoq.com/news/2018/01/java-concurrency-infer-racerd

About the FB Infer static analysis tool:

Infer static analyzer | Infer

Quoting (the first link):

"Facebook’s open-source static analysis tool, Infer, now ships with support for detecting race conditions in Java code via RacerD. RacerD identifies race conditions between methods in classes that use locks or the @ThreadSafe annotation.

Facebook has used RacerD in its own production code for the last year identifying more than 1,000 multi-threading issues, all before code ever reached production. This concurrency checking capability is now available to Java developers who use Infer to detect bugs in Java code.

A race condition is a type of concurrency error or bug that occurs when two threads operate on the same object without proper synchronization, causing their executions to overlap each other, and at least one of the accesses is a write. Concurrency issues are hard to debug and even harder to reproduce after encountered.

RacerD performs fast, useful concurrency analysis at scale. RacerD is fast because it doesn't try to check an entire code base for concurrency issues; it only examines the code that it believes can be run concurrently.

RacerD identifies code that can run concurrently by looking for classes, methods, and interfaces that have been explicitly annotated with the @ThreadSafe annotation or that create a lock via the synchronized keyword. When a class or interface is annotated with @ThreadSafe, all subclasses of the class/implementation are also evaluated. To increase code coverage with RacerD, additional optional annotations may be useful: @ThreadConfined, @Functional, @ReturnsOwnership, or @VisibleForTesting."
(...)

Situations not detected (quoting):

"RacerD is currently limited to checking for data races only;

it doesn't check for other concurrency issues like deadlock and atomicity.

RacerD also misses data races that are due to:

aliasing
locally declared objects escaping its scope
accesses protected by different locks
local objects containing non-owned objects
weak memory and Java’s volatile keyword"

quarta-feira, 8 de novembro de 2017

AI: OpenAI (open source systems)

"Old" news about OpenAI firm by Elon Musk (2015) and MS Azure:
http://www.ibtimes.co.uk/microsoft-elon-musks-openai -join-hands-democratize-artificial-intelligence-1591770

Quoting:
"Elon Musk's $1bn non-profit artificial intelligence (AI) research firm OpenAI has signed an agreement with Microsoft to run most of its large-scale experiments on the tech giant's flagship cloud platform, Azure. Announcing the partnership on Tuesday (15 November), the companies said they are focused on the importance of "democratizing access to AI" and "making significant contributions to advance the field of AI" to tackle some of the world's most challenging issues. OpenAI said it will use Microsoft's Azure platform for its experiments and research in AI and deep learning."

The (open source) systems are listed here:
https://openai.com/systems

segunda-feira, 6 de novembro de 2017

Open Source: What kind of license to choose?

Interesting article on what kind of open source license to choose if you are to be the project maintainer:
https://01.org/blogs/jc415/2017/open-source-hacks-one-question-interviews-open-source-experts-licenses?sf148133548=1

Quoting:
“Which open source software license should I use for my project?”

I get asked that a lot. Or this variation, “What are your preferred open source licenses?” My answer: It depends.

I’m not trying to be flip; really, IT DEPENDS! No single open source license is appropriate for every use case or objective. And I have no “preferred” open source licenses—sure, there are some I find myself using or recommending more frequently, but as long as it has been approved as an open source license by the Open Source Initiative (OSI) or a free license by the Free Software Foundation (FSF), there is no license that I *wouldn’t* use, given the right scenario.

The choice comes down to what is most appropriate for a particular situation. How do you determine which license(s) might be appropriate for a given project? There are multiple factors to weigh.

If you are contributing to an existing project, the community expects you will make contributions under the existing project license, or a compatible license—the important thing is to understand and follow that community’s norms.

A project maintainer might reject contributions made under any license other than the one they’ve specified, even if from a legal and practical perspective the licenses have no incompatibilities. “Know your audience” and “go with the flow” are two maxims to keep in mind when you’re making upstream contributions.

What license to choose becomes more interesting when the project is your own. Assuming you have a choice (you haven’t used or incorporated any code licensed under terms that require the same license for derivative work), think about what you want recipients to be able to do (or not do) with your code.
(...)
The “right” open source license for your project will be the one that has terms that support your objectives, is compatible with other licenses in the relevant ecosystem, and is acceptable to your users.

Getting that equation right doesn’t guarantee your project success, of course, but getting it wrong is almost certain to ensure failure.

One of the best ways to learn about open source licensing is to keep up to date with discussions in the open source legal and licensing community, either by joining a mailing list or browsing a mailing list’s archives (...)"

Examples of those discussion lists are in the article.

sábado, 28 de outubro de 2017

Autonomous Vehicles: Open sourced? (Apollo 1.0 self-driving car software)

https://github.com/ApolloAuto

Source:
https://www.cnet.com/roadshow/news/open-source-apollo-speeds-up-baidus -self-driving-software-development/

Quoting:
"In July, Chinese technology company Baidu made its Apollo 1.0 self-driving car software available as open source on Github, using the Apache/BSD license. By Day 4 of the release, it was the most downloaded C++ software on the site.

At an Apollo meetup hosted by Baidu at its Sunnyvale, California, offices, company president Ya-Qin Zhang announced Apollo 1.5, a major iteration of the software, just three months after the initial release."

quinta-feira, 26 de outubro de 2017

Security: Sonar (Open Source MS Tool)

https://thenextweb.com/apps/2017/10/26/microsoft-launches-sonar-to-test-your-sites-performance-and-security/

Quoting:
"Enter your project’s URL, and Sonar will comb through it for accessibility, interoperability, performance, security and progressive web app-related issues. Once it’s done scanning, it’ll list the errors it’s found and do its best to explain what’s going wrong, highlighting the errant code snippets and offering possible solutions.
(...) Sonar improves on the capabilities of other linting tools by executing your website code in a container instead of simply performing a static analysis for more accurate results, as well as allowing for integration with other services. And if you don’t care to use Sonar in your browser, you can also invoke its command-line interface."

quarta-feira, 4 de outubro de 2017

Open Source: Mass spectrometer analysis API

Open source, the good parts (like not having to implement Fourier transformations in plain Java) include open source mass spectrometry APIs:
https://www.nature.com/articles/nmeth .3959.epdf

Project in GitHub:
https://github.com/OpenMS /OpenMS

segunda-feira, 21 de agosto de 2017

OSS: Integrating Open Source in Commercial Software (Risks)

Very interesting article explaining the risks of using OSS in commercial software (typically closed-source):
http://sdtimes.com/open-source-commercial-software-development-handle-care/

Quoting:
"licenses fit into two major categories: Permissive and Copyleft. With Permissive licenses, there are few terms and conditions. With Copyleft licenses, the terms and conditions tend to be more stringent and bind any derivative work to the same terms and conditions."
(...)
"Mitigate Your Legal Risk
You can mitigate your risks by following some key steps. Some best practices:

Track all third party software included in your distribution and the license type, and keep it up to date. Consider each addition carefully, examining the risks and the benefits. Be sure to republish the license text of each work (and subwork), particularly if you are distributing object code only.
For Apache works, be sure to republish a copy of the Apache license, together with a prominent notice on any modified files that you have changed the files.
Consider the use of any GPL work in a closed source application very carefully. If your application can be considered and extension of the GPL work, you may be required to disclose your source. Seek counsel if your rights are in doubt.
Is the project supported by a specific group of developers and is there a thriving community dedicated to delivering a quality application? Or, is the software built by a single developer as a part-time project?
Are contributions well vetted and under CLA? Consider the effort and expense of replacing the software should you encounter any issues. Can it be swapped out easily, or is it intimately entangled with your application? Consider the value of the contribution when compared to self-developed or commercial alternatives. Could you benefit from vendor engagement and professional support?"

quarta-feira, 9 de agosto de 2017

Using Github as a source of attacker traffic?

A proof of (the bloody) concept has been presented:
https://securityintelligence.com/news/gitpwnd-shows-how-threat-actors-could-hijack-git-repositories-in-software-development/

Quoting:
"[The PoC] could be used to communicate malicious commands from threat actors. As proof, they developed GitPwnd, an open source penetration testing resource that takes advantage of popular services such as GitHub, GitLab or BitBucket.

Security Affairs explained how such attacks would work: Cybercriminals could use something like GitPwnd to host their Git repositories on GitHub, for instance. Then, as commands are sent to an infiltrated system, they could be easily disguised as legitimate traffic coming from a software developer, which use the same transport layer for legitimate work."

terça-feira, 31 de janeiro de 2017

Parts of Google Earth open sourced to Github (GEE)...

... And as such could be incorporated in your products:

https://maps-apis.googleblog.com/2017/01/open-sourcing-google-earth-enterprise.html
Quoting:
"Open-sourcing GEE allows our customer community to continue to improve and evolve the project in perpetuity. Note that the Google Earth Enterprise Client, Google Maps JavaScript® API V3 and Google Earth API will not be open sourced. The Enterprise Client will continue to be made available and updated. However, since GEE Fusion and GEE Server are being open-sourced, the imagery and terrain quadtree implementations used in these products will allow third-party developers to build viewers that can consume GEE Server Databases."

sábado, 14 de janeiro de 2017

Reuse: Statistical Data Processing

When in need of statistical data analysis, we will need to implement or reuse system components into our system.
Microsoft has been making available the (free until a certain point) open-source R statistical programming language (and servers):
http://www.infoworld.com/article/3156544/big-data/microsofts-r-tools-bring-data-science-to-the-masses.html

Quoting (the article focus on a new MS acquisition but provides us with an overview of the R programming language and the Development environment to support developers and Data Scientists):

"One of Microsoft’s more interesting recent acquisitions was Revolution Analytics, a company that built tools for working with big data problems using the open source statistical programming language R. Mixing an open source model with commercial tools, Revolution Analytics offered a range of tools supporting academic and personal use, alongside software that took advantage of massive amounts of data–including Hadoop. Under Microsoft’s stewardship, the now-renamed R Server has become a bridge between on-premises and cloud data.
Two years on, Microsoft has announced a set of major updates to its R tools. The R programming language has become an important part of its data strategy, with support in Azure and SQL Server—and, more important, in its Azure Machine Learning service, where it can be used to preprocess data before delivering it to a machine learning pipeline. It’s also one of Microsoft’s key cross-platform server products, with versions for both Red Hat Linux and Suse Linux."