If the Linux Foundation was a software company, it'd be the biggest in the world

Kubecon The Cloud Native Computing Foundation has returned to Shanghai for the city's first Kubecon since the pandemic.

During a keynote that switched languages several times, demonstrating the challenges faced by both AI and human translators in keeping up, Jim Zemlin, executive director of the Linux Foundation, threw out several crowd-pleasing statistics while also highlighting some projects likely to make one or two companies squirm a little.

On the statistics front, Zemlin joked that the Linux Foundation was likely the largest software company in the world, noting that if one took an average software developer's salary – he put the worldwide mean as being $40,000 – and multiplied it by the number of developers contributing to the foundation, the payroll would come to around $26 billion – more than Microsoft's $24 billion R&D payroll.

The statistic was somewhat tongue in cheek as Zemlin pointed out that none of the developers working on Linux Foundation projects actually work for the Linux Foundation.

However, the sheer quantity of engineers involved highlighted another issue noted by Zemlin: the "paradox of choice" when selecting the correct open source project for a given purpose when the number on offer reaches the hundreds, thousands, and beyond.

Reflecting the increasing maturity of some elements of the open source world, he also emphasized the opportunities for companies to increase revenues and profits through the use of open source. WeChat, Alibaba, and Huawei all received nods – unsurprising considering the location – as Zemlin noted a virtuous circle whereby improvements go back into projects, meaning better profits, meaning more improvements, and so on.

It all sounded very utopian, although darkening clouds were signaled by the addition of OpenTofu to the list of projects Zemlin was keen to boast about, including open source efforts around large language models.

OpenTofu, which was announced by the Linux Foundation on September 20, is a direct response to HashiCorp's decision to change from a Mozilla Public License v2.0 (MPLv2) to a Business Source License v1.1. Previously named OpenTF, OpenTofu is a fork of HashiCorp's Terraform infrastructure-as-code tool that is open source, community-driven, and managed by the Linux Foundation.

HashiCorp's decision and other moves, such as Red Hat's changes around its Enterprise Linux product, serve to highlight the challenges faced by companies seeking to make money out of open source. Zemlin was keen to highlight the opportunities for profit in an open source world, yet others have sought to protect their investment with progressively more restrictive license models.

Security challenges were also highlighted. Robin Ginn, executive director at OpenJS, noted the rapid rise of software supply chain attacks. She said the risk presented by transitive dependencies – effectively dependencies of dependencies – had skyrocketed in recent years. OpenJS was cited as an example of a project with hundreds, all requiring consideration.

However, Robert Reeves, VP of strategic partnerships at the Linux Foundation, pointed to the elephant in the room as far as an open source conference in China was concerned. As projects become increasingly global, with developers spread over the world, ensuring that engineers have access to the same services can be a challenge.

For example, Huawei's wares tend to be frowned upon by several Western governments, while Google's services have attracted the ire of Chinese authorities.

• From browser brat to backend boss: Will WASM win the web wars?
• OpenTF forks Terraform, insists HashiCorp is the splinter group
• Inclusive Naming Initiative limps towards release of dangerous digital dictionary
• SBOMs should be a security staple in the software supply chain

Reeves observed that as well as demonstrating commitment by actually turning up in person to events in regions such as China, it was up to organizations including the Linux Foundation to facilitate communication between developers to ensure the tools and platforms chosen would suit all involved, even if that might result in some not being able to use their first choice.

Chris Aniszczyk, CTO of the Cloud Native Computing Foundation, took a break from extolling the virtues of WebAssembly – in this instance, effectively a lightweight version of containers – to concur.

China, after all, comes in as a solid second behind the US for contributions. India and Germany occupy the third and fourth positions respectively.

Rather than a challenge, Aniszczyk saw the differing availability of services worldwide as an opportunity. He told The Register: "It took us a long time to fix it, but we did.

"It sucks. But that's the reality of the world… [dealing with regional restrictions] is a good way to improve the project.

"I'm a strong believer that open source is like a common purpose for humanity to share knowledge and build upon ... Open source is global. It's meant for everyone's usage and everyone should add to it.

"... and it should be permissionless innovation." ®