Any time I hear that a Chinese company is investing in a product I use, it's as if the Chinese government is now part owner of it as well. This may be general paranoia, but given the latest crackdown on VPNs and privacy, I don't know that I want a foreign government with a significant stake in Alibaba have access to direct the future of MariaDB. Is anyone else feeling this?
If you look at Alibaba's investment portfolio [1], you will see Alibaba has invested in a number of popular US-based startups like Snapchat and Lyft, so are they owning part of Snapchat as much as other VCs (depending on the % of course).
One can say about Google / Facebook / Amazon investing in startups and non-profits inevitably influence these organizations' directions; that's just the nature of any investments. When you donate money to a cause you support, you indirectly influence how the cause is headed, because you can pull the pledge, and when enough people pull the pledge, then the people running the cause/non-profits will have to do something to the demand of the donators.
China is the biggest creditor of the US national debt, and even before that US was careful with its relationship with China anyway. So we can't say there is a cause and effect, the best is a weak correlation, and even that is a stretch.
"Biggest foreign creditor" and "biggest creditor" are worlds apart; it's not just about being more precise. More than two thirds of US debt is held domestically.
Yeah, would be better if a US company like Oracle were in charge of it ;)
(Not agreeing or disagreeing with you, just kind of funny/ironic that we're talking about a fork of an open source project that exists because of disagreement with the steward of MySQL... if Alibaba negatively impacts MariaDB, couldn't we just then move on to another fork. MylantaDB anyone?)
Not everything has to be about politics. Sometimes a big company investing in an open source database it already uses is just trying to improve its own infrastructure, not trying to hack your country.
That's besides the point. Even if every single employee at Alibaba is well-intentioned (which is close enough to reality to be considered the case), in the end the government of the PRC has the capability to coerce the company to exert influence in a direction we almost certainly wouldn't like. The only question is whether the PRC would consider the trade offs worth it.
> in the end the government of the PRC has the capability to coerce the company to exert influence in a direction we almost certainly wouldn't like.
It's open source- when that happens, you can fork it and influence it in the direction that you like. I mean if the GCHQ has an active github account[1] - I think the PRC gets a pass to publish open source, let alone Alibaba.
I hear you. We should keep these companies in the hands of US tech companies that would never dream of violating our privacy or collaborating with a government entity against our wishes.
What would the concrete concern be in this case? Any backdoor would destroy the company brand and be excised immediately in a fork.
I suspect they’ll treat it like a piece of critical infrastructure; their political concerns would be at the gfw level, and I just don’t see the likelihood of weaponized attacks. Databases are usually locked down for egress and any outgoing attempts would be rapidly detected.
But a subtle buffer overrun resulting in a 0day that's only obvious to the writers - that's much more likely.
Check out the Underhanded C contest for examples of ways exploits can hide in plain sight.
EDIT: I'm not saying that's what going to happen with Alibaba & MariaDb. I'm just saying that "open source" != "free of exploits and backdoors". One of the biggest untruths about open source is that, with enough eyeballs, all bugs are shallow.
Lenovo seems to get caught with a backdoor every 6 months or so lately. Although I do think that has tainted its brand, I think it's still pretty far off from "destroying the brand".
Interesting, If Google or another tech giant in the U.S. are investing it, would you worry about that? I remember Project PRISM did happen, didn't it ? Alibaba invested it to its own advantage by contributing back to opensource and try to get more Startups in China to use it, that's simple as that. And MariaDB is opensource and community-driven, I don't think it will be controlled.
