September 2024 - Boost - lists.preview.boost.org

Safe C++ and Boost
by Vinnie Falco 17 Sep '24

17 Sep '24

Hi. I am proud to announce that the C++ Alliance has entered into a partnership with Sean Baxter to develop Safe C++: language extensions to provide memory safety in C++. Some of you might have seen the official announcements on various social media sites, and I’m here to provide some more information on how this initiative affects Boost. First, I want to express my appreciation for Sean’s enormous technical abilities, and for his stamina to invest eight years of research and development into Safe C++. I believe that his efforts reflect good philosophical principles for improving the language with memory safety extensions: 1. Safe C++ must be a superset of C++: all existing code must work. 2. Safe C++ must allow controlled opt-in to memory safety: expecting the world to rewrite everything in a new language is not realistic. 3. Safe C++ must be developed using an implementation-first approach: a working model is preferable to just ideas. The partnership with Alliance has three deliverables: research the remaining design problems, complete the Safe C++ Language Extensions proposal for standardization, and implement the Safe C++ Standard Library. The safe library is a set of additions to the standard library providing essential vocabulary types and algorithms needed by users to achieve memory safety. We don’t know that Safe C++ is the final solution for memory safety in C++. Perhaps the required extensions will be so intrusive as to make it effectively a new language. Maybe the language features which allow for zero-cost abstractions are so powerful that they can’t be preserved in ways that are memory safe. Yet there is value in pioneering this design space that Sean has carved out. It is also possible that Safe C++ becomes the winning memory safety story for C++. We at the Alliance believe it is worth taking the chance to find out. Through the relationship with Alliance, the Boost community has a unique opportunity to participate in helping to explore and solve the remaining difficult design problems, and a front-row seat to the latest draft of the Safe C++ proposal which can be viewed here: https://safecpp.org/draft.html If you would like to discuss Safe C++ in real time with other engineers please join the #safe-cpp channel in the Official C++ Language Slack Workspace by signing up here: https://cppalliance.org/slack What does this mean for Boost? There is a tremendous opportunity here for Boost to innovate ahead of the C++ Standard. I envision the scenario where some volunteers will port selected Boost libraries to Safe C++ as a proof of concept. The porting process will surface areas of the proposal which need work. As memory safety is rapidly becoming the defining feature of modern mission-critical software development, the opportunity for Boost to lead in this area may attract the needed revitalization of the project in the form of new volunteers. Please join us in helping to define this exciting chapter of the C++ language! Thanks

5 8

Boost Asset Stewardship Review
by hans.dembinski＠gmail.com 16 Sep '24

16 Sep '24

I vote to accept the proposal of the Boost Foundation. I am neither affiliated with the C++ Alliance nor with the Boost Foundation. I am the developer of the Histogram library, which sees a lot of use in the scientific community. My personal values are aligned with the Boost Foundation and its supporters. My observation is that the C++ Alliance uses money to gain influence over this community, for example, by paying some community members to work on projects, and through its donations into the infrastructure. I want Boost to be a non-hierarchical community based on volunteer work, inclusivity, transparency, and consensus. The community is developing away from this ideal, as the C++ Alliance has taken an increasingly dominant role. While my decision here may not change that trend, I cannot support a proposal which would further increases their influence. Hans

3 2

On how to write good documentaiton and why
by Andrzej Krzemienski 16 Sep '24

16 Sep '24

Hi Everyone, While reviewing a Boost candidate library, I re-watched Robert Ramey's advice on how to write library documentation, from CppCon: https://www.youtube.com/watch?v=ACeNgqBKL7E&ab_channel=CppCon https://www.youtube.com/watch?v=YxmdCxX9dMk&ab_channel=CppCon These are so great talks, and so much practical, wise and appealing advice. Whenever my colleagues ask me for advice on how to write documentation, I give them these links. I also follow the advice ever since I watched the first video. Robert, thank you for them. I believe that this is a valuable Boost asset, and should be listed along the Boost Software License and the Boost Review Process. I hope that our documentation (old or new) will mention it in a prominent place, much like the docs mention the great article "Exception-Safety in Generic Components" by Dave abrahams. Regards, &rzej;

1 0

Page on the website clarifying Export Status
by Glen Fernandes 15 Sep '24

15 Sep '24

Every now and then (most recently, two days ago), I get a question asking if we have an ECCN in compliance with US export control laws. ECCN is an Export Control Classification Number. (More details at the Bureau of Industry and Security website : http://www.bis.doc.gov/ for anyone interested). We fall under "Not Controlled", so we do not have such a number. (Ion, as a heads up, you will probably start getting these kinds of questions now too). We should probably put this somewhere on our website. FAQ or a page on itself. Any concerns or comments? Glen

1 0

[Asset Stewardship] Andrzej's review
by Andrzej Krzemienski 15 Sep '24

15 Sep '24

Hi Everyone, This is another review in the context of the Boost Asset Stewardship proposal(s). I am not affiliated with either the C++ Alliance or the Boost Foundation, although in the past I talked with the Alliance about the potential compensation for my contributions to Boost, and I represented the Alliance in one WG21 meeting, in Rapperswil. I maintain Boost.Optional library, try to contribute to all Boost reviews, and have managed the review of Boost.SafeNumerics library. I consider myself a Boost Developer. The subject of the review is, which legal organization formally owns the Project's assets, and who actually manages them. But the questions I, as many others, am trying to answer is: * What is going to be the shape and the popularity of Boost libraries? * Where will the funding come from? * What will the Boost community look like? * To what extent will the Boost community be in control of things? The tricky part is that the goal of the Boost Foundation in the past, as well as the future goal of whoever will manage the Boost assets is so that the developers can focus on the development, and need not study the administrative and financial stuff. Yet it is the developers that need to make the decision regarding the administrative and financial stuff now. One thing that I didn't have to pay attention to in the past, and now is becoming clear to me, is that in order to be able to host a host of libraries, test them continuously, improve the infrastructure tools, and build new tools (like the one for documentation), costs huge amounts of money (by my standards). It is my understanding that this cost has been primarily covered by the C++ Alliance. But it is also my understanding that this happened under the Boost Foundation's government, and theoretically the C++ Alliance could continue to make financial and technical contributions under the government of the Boost Foundation. I also hear that this is practically impossible, for reasons that are not all clear to me. I understand that there are fundamental differences in philosophy. The Boost Foundation has the volunteer model, where people devote their private time as their lives permit, and that the C++ Alliance is an organization with huge funds, and the capability to employ people. I also understand that it is a risk for the C++ Alliance to invest huge assets in the Boost project, knowing that ultimately the efforts can be torpedoed by the decisions of the Boost Foundation. I am not saying that this is or has been the case. I am only pointing out the obvious consequences of the mistrust. The Boost Foundation is volunteer-driven. This means that people work on what is deer to their heart, and if something is not deer to anybody's heart, it may not be done, even if important. The volunteers can only put as much effort to their work as their private life permits. This means sometimes they have to give up. The effect might be that a volunteer-based organization may appear unreliable. On the other hand, volunteer work inspires more volunteers. I was surprised to find that the Boost Foundation's, as it is today, primary goal is not to support Boost's interests: it supports many initiatives, Boost being one of them. I was misled by the name. People, including myself, have pointed out that the support for the Beman project is somehow in conflict with supporting Boost. But having thought more about it, I no longer feel this way. I am now inclined to think that the Beman project is the best thing that could happen to minimize the damage caused by the current process of standardizing libraries in WG21. So if there is any glitch in the Boost Foundation, it is the support for some proceedings in WG21. This is because WG21 innovates and experiments, instead of standardising the things that work. I think the Boost Foundation has been doing a good job at steering Boost. If people feel that "they are doing nothing", this might be the indication of the job done right: Boost is rolling, the lights are on, the Foundation is not getting in the way of the developers. Most of the job done is invisible. The question is, can we still improve if we adopt the Fiscal Sponsorship Agreement from the Alliance. I understand that the Agreement gives the Alliance the sense of stability: that the efforts that cost years and millions will be integrated. This would help secure the development of essential components that we need: * the modularization * the platform for communication that is open for the young, while not discriminating the old (like myself) * a tool that helps produce documentation. Except for the first, I do not think they can be achieved without a substantial financial effort. Risks: * With this huge and single source of income, we will be looking more like a company than a volunteer organization. * It is likely that because of this Boost will not attract new volunteers * It is likely that no-one else will feel the need to sponsor Boost. But even if some of these risks were to materialize, the value of having a tool for writing documentation for C++ libraries is so huge: it goes beyond Boost. My concern from a different level is that after all the chaotic and unpleasant (mis)communication in the Mailing List, I am left with the impression that the C++ Alliance is ready to break the established rules in order to achieve the goals. This may be a deeply unfair statement, but I can't help it: this is what the shreds of information that I receive suggest. The proposed Agreement attempts to secure the Boost project against the situation of an irresolvable conflict, but no agreement can secure your interests when the agreements are not respected. During this review period I have heard late but honest explanations from the Boost Foundation members that explain their actions and show their motivation, and I find them credible. I do not believe I have heard the account from the C++ Alliance that would help understand what motivated the organization to act the way they did. One last concern is that I am not comfortable with the fact that the proposed Fiscal Sponsorship Agreement re-uses the term "Steering Committee". As indicated in other messages, the Boost Foundation *is* the Steering Committee, or rather continues the tradition of the Steering Committee with the same people onboard (not all, obviously), and with the same ideals. In order to honour them and in appreciation of their work, I think the new setup should not intercept this name. Regarding the question of attracting or repelling new contributors, I find it hard to believe that the enforced Code of Conduct could have a significant impact on the results. In my opinion, what could have a bigger impact is when Boost becomes modular, people can afford to use it more in more contexts, appreciate it more, and some of them decide to contribute. Regarding the Foundation's counter-proposal. I do not find anything material in it. I read it as "let's leave the things as they are, but let's enforce the CoC and increase transparency and efficiency". As I said, I cannot see how the enforced CoC could make a substantial difference. Regarding the efficiency and transparency, I do not find anything substantially wrong with them today: they are good enough. Today we are facing a crisis, but other than that I think the Boost Foundation is doing a good job. The Boost Foundation also mentions the modularization and the new communication platform, but even the Foundation members admit they do not believe that making such big projects would work with the Boost's consensus-based philosophy. In closing, I would like to say that I am grateful to the members of both the C++ Alliance and the Boost Foundation for your contributions to the Boost project and community. I have certainly benefited from your work, in many ways. I recommend accepting the Fiscal Sponsorship Agreement from the C++ Alliance, as I see the potential in it to significantly improve the situation of Boost, and other good libraries out there (I mean the new documentation tool), while recognizing that this is a risky decision. Regards, &rzej;

2 1

Boost Asset Stewardship Review from Ruben
by Ruben Perez 13 Sep '24

13 Sep '24

DISCLAIMER: I'm a C++ Alliance employee Hi all, I'm the author and current maintainer of Boost.MySQL. I'd first like to thank both the Boost Foundation and the C++ Alliance for their contributions and efforts, especially when done in their free time. On the technical side, I particularly appreciate the infrastructure contributions the C++ Alliance has made. The Drone CI has been really important for me even when I was a volunteer, as it's fast and supports Windows Docker images. I also appreciate their efforts regarding documentation, as I share the need to update Boost in this aspect. Of course, their recent sponsorship regarding Boost.MySQL has allowed me to develop the library much further than my otherwise scarce free time would have allowed me. I think the C++Al proposal is good, as it will allow other authors like me to also benefit from infrastructure improvements like the ones I mentioned. C++Al people are pretty technically enthusiastic, which I also like. The concern of letting too much of Boost's decision power in a single organization's hands seems legit. However, the proposal seems to take this into account, proposing several measures to mitigate the risk, with a Steering Committee composed of respected Boost developers. I also support adding Peter and Glen to the committee. I also appreciate the contributions that the Boost Foundation members have made to Boost, and would like to thank them for that. I'd like to echo a point made by others in the mailing list throughout this discussion and also somewhat reflected in The Boost Foundation's proposal, about mailing list friendliness to newcomers. When I first reached out to evaluate the potential usefulness of what would become Boost.MySQL (https://lists.boost.org/Archives/boost//2020/03/248301.php) I received a couple of really discouraging comments, which almost made me abandon the idea. These comments were based on the (somehow understandable) misconception that my library was a wrapper around the official C API. Thanks to other people's support (Richard, Chris, Vinnie and some others, IIRC) I managed to move forward. But it could have not been the case. As a community, we could try to improve instances of this to make things better for newcomers. That said, I think the C++ Alliance proposal moves in the right direction, so I vote to ACCEPT it. Thanks, Ruben.

8 11

The Future of Boost Governance
by Dave Abrahams 13 Sep '24

13 Sep '24

I'm writing to represent the spirit in which Boost was founded and in which we ran it, as a community, up until 2013. I realize the review is nominally about asset stewardship, but IIUC the more fundamental change being discussed is about governance, not who holds Boost's property. Before I moved on to other things, I participated in setting up a steering committee that was supposed to step in and make important decisions when Boost's default "community-based leadership and decision making" process got stuck or was otherwise inadequate. That body, I gather, evolved into the Foundation board. For some purposes, that governance structure has worked, but when it comes to managing Boost's assets, it seems the ball was dropped, and the Foundation did not self-correct. Therefore, I very much understand why one might want to transfer Boost governance to an organization with more apparent energy. All that said I am deeply concerned about recent actions by the C++ Alliance. Please correct me if I'm misinformed about any of this, because as I've said I've been out of the loop. It is my understanding that the Alliance did not communicate to the Foundation or publicize its efforts to gain control of the boost.org <http://boost.org/> domain name. Effective or not, the Foundation is the nominal governing body for Boost, and coordination with the Foundation would have been the appropriate, aboveboard course to take. It is my understanding that despite an agreement to coordinate the launch of a new Boost website with the Foundation board, the Alliance decided to launch boost.io <http://boost.io/> in parallel with boost.org <http://boost.org/>. That move is problematic for all the same reasons. It also creates confusion for the user community about where the real Boost is. These aggressive and unilateral actions seem to be at odds with the spirit of Boost and to be harmful to the coherence of its community. IMO it's very much to the Foundation's credit that they did not respond in kind, but instead opened a discussion about Boost's future governance and offered to abide by the community's decision. That is what I'd expect from a group that truly had Boost's interests at heart. All that is great but it does seem very wrong that the conversation should be prompted by actions like the above, and for me, any outcome that transfers Boost governance to the instigators of those actions compounds the problem. It saddens me greatly that a rift exists between the Alliance and the Foundation, because the energy and commitment of the Alliance members is admirable, and communication here on the mailing list looks like it has been productive. My ideal outcome would be to repair whatever is needed to make the Foundation work as a governing body, and to repair the relationships so that Alliance members can continue to make great technical contributions without feeling like the Foundation is holding up their progress. I'm sure that would be asking a great deal of the participants on both sides, but that's what I'd like. It seems to me any correctives that would result from a governance transition could equally well be applied to the Foundation itself. - Dave

6 6

Domain Transfer Update
by Kristen Shaker 13 Sep '24

13 Sep '24

Hello, I wanted to give everyone an update regarding what is happening with the boost.org domain. We are working with the lawyer representing the Dawes estate to transfer control. However, Beman Dawes was the only one with the credentials, and the transfer process without them is onerous. It may take many months. We intend to continue to provide updates. Warm Regards, Kristen

10 11

Asset Stewardship Review - Halfway mark
by Glen Fernandes 12 Sep '24

12 Sep '24

Everyone, We are halfway through the review period. Thank you to everyone that has participated so far, even if you haven't contributed a review yet. If anyone has yet to submit a review because they are unsure of how to format it, or what you can contribute, hopefully the responses thus far have helped inform that. If not, then I would suggest starting with a vote and your reason, and we can elicit additional information with follow up questions. So far, nobody that has sent me any questions or feedback privately, has expressed that they would like to post a review but don't know how. I have yet to compose (or source) answers to the last set of questions I received, but I will do that this Saturday. Glen

1 0

Asset Stewardship Review
by Vladimir Prus 12 Sep '24

12 Sep '24

Hi, I vote for the C++ Alliance proposal. Right now, my contribution to Boost is limited to accepting small PRs for the program_options library, I don't expect to be very active in the future, so my vote should be suitably discounted. On the other hand, I wrote one library, contributed changes for some others, and worked on building/testing infrastructure, so probably know something. I have no affiliation with either party, though I criticized Boost Foundation before. Many open-source projects have solved the matter of asset management and financial support without much drama. For example, there is the LLVM foundation ( (https://foundation.llvm.org/) which pays for infra, and sponsors developer meetings. There are 9 people on the board, and their bios all mention LLVM contributions. There is a public process to nominate new board members candidates (the current board votes on them, though). The activity of the foundation is fairly visible. There's also the Apache Foundation (https://www.apache.org/) It hosts a lot of projects, and committers run each one. Matters are resolved by committer vote, new committers are added by vote, and inactive members lose their commit/vote privileges. The foundation itself provides resources, like magic garden gnomes. Probably, with a bit more goodwill and introspection, we could have worked out the details and reached the level of those examples. But, we saw divorce paperwork sent in public, and both parties have a long list of grievances, so here we are, deciding who gets the custody. Boost Foundation, in my opinion, has a real identity and credibility crisis. Originally, in the steering committee times, it consisted of project founders, who were active in the project, and contributed lots of hours and probably personal money, while preferring consensus for all decisions. It gradually changed, and these days, Boost Foundation has largely checked out and consists mostly of people privileged enough to travel to Aspen and other conferences. Still, it occasionally issues decrees for the project to follow. Consider the recent events. There was a decree to stop working with a large sponsor. Per meeting notes, 7 people met to make the decision. I see only 2 with obvious connections to the project. Kristen's post with the announcement was her first-ever post to the list. The board members were not nominated, voted, or announced on the list. Despite many raised questions, foundation members had no timely answers. Even during this crisis, most members did not say anything. And then, just today, one member has it was not a degree, but a recommendation and the alliance can still sponsor everything. That's a clear failure. Maybe it would be OK if the foundation provided vast resources, and let developers decide, Apache-style. But right now it's only paying for the webserver. (I am unsure whether that's the foundation, as opposed to a generous foundation member using personal funds). There are no IT resources to keep the server up-to-date, no money to pay for CI/CD and downloads, and official filings merely say "less than $50K of income per year"). Finally, the fact that boost.org domain ownership remains unresolved even after it already expired couple years ago illustrates the lack of time/interest. The foundation's proposal is weak, brief, and seems hastily written. It does not acknowledge or address the issues above. There's no significant revamp of the board, there's no plan to to procure funding, and there's no plan to obtain IT resources. Instead, it proposes a few other things that might be good. However, those things can be decided on the list. It does not require that the foundation holds the assets. Finally, the proposal does not mention the "Beman Project" at all. It's not clear how the foundation plans to support the Boost project, while simultaneously working on an almost identical one. (I wonder if this proposal was intentionally written to lose, and move on) The C++ Alliance, organizationally, is not much better. Its board is Vinnie and his friends. As an extra plot twist, one member of the alliance board was previously on the foundation's board, and at least partially responsible for the current situation. But, things take a dramatic turn after that. The alliance is way more active in the project. Two board members are active contributors. It employs other contributors. There are quarterly blog posts from employers explaining what they have done. There are "transparency reports" about overall activity. That's easily 10x more transparency. They also have considerable financial resources. The last IRS filing claims over $2M per year. There are full-time employees and there is no doubt that they can handle Boost's relatively simple infrastructure. The alliance proposal is fairly smart. It proposed essentially the Apache model. In turn, that means we no longer have to be concerned about the alliance's board - the arrangement lets committers decide everything, while infrastructure just magically works. I do, of course, have some concerns about the alliance. It is sponsored by Vinnie himself, while the foundations I mentioned above have more diverse income sources. Also, some people might consider voting for the alliance as supporting Vinnie personally, or even taking his side in some outside-of-Boost conflicts. (Obviously, it's not). Alliance, at times, has too much money. I doubt that a "modern logo" is at all necessary, seems like a distraction. The estimated costs for the new, still essentially static, website would seem sufficient to run a few AI startups. I am worried that any change in the financial situation will leave us with way too expensive infrastructure. Like, the current server can be sponsored by literally a single developer. The "new website", at $10K per year, is not so much. At the end of the day, I don't see any choice. The Boost Foundation, as an organization, and as individual board members, made a lot of contributions, but as of 2024, there appears to be little financial and human resources, and no willingness to work with the developers. The C++ Alliance, on the other hand, already pays most of the bills and has proposed a schema that will empower the developers. I think others already commented on the details of the agreement. My only proposal/condition is that the members of the new Boost Steering Committee be provided with access to all relevant IT resources (DNS registrar, DNS hosting, any cloud providers) and that they meet with the alliance periodically, like twice per year, and verify that all the access still works. We want to make sure that in the case of any emergency, we're prepared. Thanks, -- Vladimir Prus http://vladimirprus.com

3 2