At first I thought this might be promising, given

without burden on upstream maintainers

Then I see

This is not an officially supported Google product

on https://github.com/google/oss-rebuild

And then I also see

oss-rebuild uses a public Cloud KMS key to validate attestation signatures. Anonymous authentication is not supported so an ADC credential must be present.

    $ gcloud init
    $ gcloud auth application-default login

I would not use this with a dependency on Google Cloud, or the gcloud command line tool.

Mainly because Google has horrible customer support.

It would be more interesting if they came up with something hosted on third party infrastructure. Last I heard, Google Cloud is run by Oracle executives

---

e.g. in particular the Unisuper incident led me to believe that a lot of operational stuff is being outsourced, and is of poor quality

UniSuper members go a week with no account access after Google Cloud misconfig

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

Google accidentally deleted a $125 billion pension fund's account

https://qz.com/google-cloud-pension-fund-unisuper-1851472990

I would not say this is unrelated, because operations in the underlying cloud can be a weak link in security

Although I'd certainly be interested in an argument otherwise

1. That is two years better than nothing.

2. It will likely be well architected.

3. It is open source, so others can fork it when Google abandons it. https://github.com/google/oss-rebuild

> 1. That is two years better than nothing.

This means two migrations in two years.

There are some initiatives to help change that: https://osspledge.com

Once there are as many private jets available for open source devs as there are for google employees then we are making progress.

I think that's the wrong way to frame it. OSS is not meant to make you rich, and expecting that is going to bring more pain than joy. However, I do think businesses should use their success to fund their dependencies in a way that makes sense for them.

> businesses should use their success to fund their dependencies in a way that makes sense for them.

They already do, and always have. It doesn't make any sense to most of them to fund their OSS dependencies at all, because they're available for free. They should do more than what makes sense for them, and they should have to pay professional consequences if they don't.

Programmers should have enough unity to bring pressure against companies that make a lot of money from software they don't pay for. Or rather, should have had, because LLMs have changed anything.