[jaas]

(Executive Director of ISRG here)

> What is left out of the title is that they do not provide funding to the current authors/maintainers of these open source projects. Instead, they fund an organization that will rewrite these tools.

This's not what's happening. Here's what is:

ISRG plans and coordinates investments in moving open source software to memory safe languages. We have a strong preference for working on these plans with maintainers and developers, and then funding them to execute the plan.

Once we have a plan prepared, and, ideally, maintainers/developers on board, then we pitch it for funding. Once someone (e.g. Google) funds the project, then ISRG handles contracts with the project developers/maintainers to get the work done. In some cases maintainers may be on board but want us to find a contractor to actually do the work.

In both of the first two projects, and in most future cases, the money that Google (or another company) provides will largely go to project maintainers / developers.

[lrossi]

This sounds great, thanks for clarifying!

Also, thanks for Let’s Encrypt. I didn’t make the connection between the two names. This initiative looks much better to me now.

Is rust the only language that you are considering? Would go make sense as well?

[Cullinet]

so potentially the result is a complete rewrite not involving the original authors in a language the original authors may not be current with, by a contractor code publisher / producer.

given the potential for security theater and general fud and the potency that appeals to authorities such as sponsors like Google can create in the minds of the public, how has this been evaluated in terms of the possibility for widespread disintermediation of the open source software community at large?