Open-source Sustainability (The tale of 2 package managers)

Last weekend I had the priviledge to attend the 10th PyconAU and listen to some amazing speakers. I went with my I will write markdown on the fly and make a blog-post at the end of the day mindset. Even though I did write a lot of markdown on the fly, I haven't gathered the courage to push these unedited notes into a public post. Excellent examples of live-blogging from conferences here.
What did happen was that the niggling doubts I had around how open-source works in the real world outside of just the code crystallized. This was as a result of 2 very good talks , one about how the PyPi project works and another around Open-source sustainability beyond money.

For the last year I have been writing and reviewing a lot of React Frontend, Python backend (Flask/Django) and Notebooks code. Both frameworks are super easy to buy batteries for where the included ones are running out of juice. Simply via pip install and npm install you can climb onto the shoulders of giants who are library maintainers and the life-blood of lean start-ups everywhere. However the maintainer burnout is a thing and start-ups when building their stack should be highly cognizant of this. Package repository burnout is also a thing. In my time in the software industry I have seen Maven repositories disappear. More recently NPM go through an identity crisis and the left-pad incident.

The PyPi talk gave me great background on a tool I use every single-hour without too much thought. It takes some dedicated volunteers to keep the dream alive. Who according to Dustin Ingram are :

• Unemployed and bored and poor (but super talented) 
• Paid for by their employer (thanks employers who support FOSS) 
• Not getting enough sleep (or in my case time with the family)

Vicky's talk covers another aspect. Developers and maintainers need more than money to keep going, they need back-up. The community need insurance against the bus-factor and burn-out. I have been guilty of this myself, putting a few dollars behind features I would like to see in BountySource instead of diving in. This has become more so as I have progressed in my career and become increasingly time-poor. Talking about this would anyone at VSCode like to claim the few dollars we put here ?

I love the longevity and discipline of project warehouse and will find some time to contribute to it. I also look forward to a similar alternative to npm, rather than a caching proxy with community behind it.

WebGL globes round up - in the face of security

WebGL bring the the OpenGL Embedded Systems (ES) profile to the virtual machine that the web browser is rapidly becoming. Microsoft has hit the headlines in the last few days with their proclamations about the security holes created by WebGL and their reluctance to fix them. They might be trying to plug any holes in their answer to high performance graphics in the browser - Silverlight, may be they can reuse the silverlight code to plug the GPU access security holes.

I wasn't going to rant about IE's double-standards but summarise a few WebGL globes I have come across, so here goes:

1. A very early port of NASA WorldWind API to WebGL - Lanyard.
2. The Swiss OpenWebGlobe.
3. Google's data visualisation globe.
4. WebGL Earth from Klokan.
5. Godzi globe from Pelican.

Let us just hope that Microsoft pulls its head out of the sand and works on securing GPU access via no-matter which technology. Meanwhile I will rush off to build a video buffer capture with handhacked versions of JOGL (if anyone ever accepts my signature). What Javascript really needs is establishment of trust and signed execution.