Most people never notice when they’re relying on open-source software. It runs behind video and audio streaming, powers ticket machines in public transport, drives countless websites — including many online stores — and supports most of the digital services we use every day. Germany’s Federal Government has repeatedly acknowledged this, and has explicitly named open source as a key requirement for achieving digital sovereignty.

Yet despite this recognition, the people who build, maintain, and secure these technologies often do not receive the same legal or fiscal recognition as volunteers in more traditional civic roles. This is why I’m adding my voice to support a petition that aims to change this: Recognition of Work on Open Source as Volunteering in Germany.

A call we should all stand behind

The petition, initiated by the TYPO3 Association Board member Boris Hinzer, calls for open-source work to be formally recognized as volunteer work in Germany. If adopted, this change would place digital volunteerism alongside long-established categories such as youth work, rescue services, and civic association roles. It would acknowledge that contributing code, documentation, translations, security fixes, and community support is every bit as valuable to society as volunteering offline.

Those of us working in the open-source ecosystem know this firsthand. Platforms like TYPO3, Joomla, Shopware, and countless others are built on a foundation of open-source software and thrive because of community contributions. Every improvement, every security patch, every documentation update, and every new idea often starts with individuals who give their time because they believe in open knowledge and shared responsibility. Recognizing this work as volunteering is overdue.

The open-source dependency crisis

Have you ever run composer install, npm update, or pip install today? For most of us in tech, these commands are as routine as turning on our computers. They pull in the building blocks of our applications, open-source packages maintained by developers around the world.

But what happens when that stops?

Imagine waking up to find Packagist, NPM, and PyPI all offline. Not just slow, but gone. In his powerful piece, “Open Source Blackout,” Sebastian Bergmann paints this chilling picture. It’s a scenario where global software development grinds to a halt, taking a significant chunk of the $8.8 trillion economy built on open source down with it.

This dystopian vision highlights a stark reality: our industry’s critical infrastructure is largely sustained by goodwill, unpaid weekends, and the burnout of a few dedicated souls. It’s a system we’ve normalized, but it’s not sustainable.

Which brings me to a small but significant step happening right here in Germany: a petition that aims to officially recognize work on open source as volunteering.

The petition: a simple ask with deep implications

The petition “Recognition of Work on Open Source as Volunteering in Germany” might sound bureaucratic, but its goal is profoundly important. It calls on the German government to formally acknowledge that contributing to open-source software is a valuable form of civic engagement, on par with volunteering at a sports club, your local fire department or even the Schreber garden association around the corner.

What does a petition actually do in Germany?

For my international readers, it’s helpful to understand the mechanism. In Germany, petitions are a formal tool for citizens to bring issues to the attention of their parliament (the “Bundestag”). If a petition gathers enough public support, it can be heard in a parliamentary committee. Lawmakers must then discuss the matter publicly and issue an official response.

It’s not a direct law-making tool, but it’s a powerful amplifier. It forces a conversation at the highest level. Signing this petition is a way to tell the German government: “This matters. The digital infrastructure of our country, and our economy, relies on this unpaid work. It’s time to look at the rules.”

The volunteer status complication: why this matters legally

So, why is getting this “volunteer” status such a big deal? It comes down to the legal and fiscal framework for non-profit organizations in Germany.

Currently, if a group of open-source developers wants to get tax benefits or receive tax-deductible donations, they typically need to form a registered association and successfully apply for non-profit status. This works for some, but it’s a poor fit for the decentralized, often global, and informal nature of many open-source projects. It creates a huge barrier.

The situation becomes even clearer when you look at past struggles. Consider the case of J and Beyond, the organization behind the Joomla! content management system. In 2016, the German tax authorities moved to strip them of their non-profit status. The core question was: is supporting open-source software truly a charitable purpose under German law?

As detailed in (sorry, German only) articles like “Ist ein Verein zur Unterstützung von Open-Source-Software gemeinnützig?” and coverage by heise online, the organization won its case. But the fight took years, consumed significant financial resources, and caused immense stress. They succeeded, but the underlying legal ambiguity remains. The system is set up to recognize traditional volunteering, not digital infrastructure building.

This petition aims to fix that ambiguity at its root, making it clear that maintaining the code our economy runs on is a charitable, volunteer activity.

Why you should care (and sign)

Whether you’re a developer pushing commits, or an online merchant whose entire storefront depends on open-source plugins and frameworks, this directly affects you.

• For developers: It’s about sustainability and fairness. It’s a step toward a system where the countless hours you pour into open source can be legally acknowledged, and the projects you love can receive support without jumping through impossible bureaucratic hoops. It helps prevent the burnout Bergmann describes.
• For online merchants and businesses: A healthy, legally recognized open-source ecosystem is more resilient. When maintainers have the backing of a supportive legal and fiscal environment, the risk of critical projects being abandoned due to burnout or lack of funds decreases. Your business, which relies on this “free” infrastructure, gains stability.

As Bergmann points out, “commercial-scale use without commercial-scale support is unsustainable.” The joint statement from OpenSSF, Packagist, Maven Central, PyPI, crates.io and others is a desperate plea for help. While this German petition is just one piece of a much larger puzzle, it’s a concrete, actionable step we can take right now to build a more sustainable foundation.

It’s a gentle nudge to the system, asking it to recognize the world as it is today: a world where maintaining digital public infrastructure is one of the most important forms of volunteer work there is.

Please, take a moment, read the petition, and add your name. Let’s help build a future where the “Open Source Blackout” remains just a thought experiment.

➡️ Sign the Petition: Recognition of Work on Open Source as Volunteering in Germany

If you’re a developer or just a keen bean who uses Shopware, your two cents are not just welcome – they’re explicitly wanted. The place to have your say is on the Shopware GitHub Discussions page.

The core team uses this space to float ideas, propose major changes, and ask the community, “Right then, what do you think?” This is where the future of dev features, APIs, and the whole architecture gets debated out in the open.

How to get stuck In

It’s proper simple to join the conversation. Here’s the lowdown:

1. First things first, you’ll need to have a GitHub account. If you haven’t got one yet (which would be strange for a developer), it’s a five-minute job to sign up. It’s free and easy.
2. Once you’re sorted, navigate to the main Shopware repository. Click on the tab right next to and .
3. Have a scroll through the ongoing discussions. See a topic you’re passionate about? Don’t be shy and leave a comment, share your experience, or ask a clarifying question. Your perspective is valuable.

Don’t fancy missing out? Get updates delivered!

You don’t have to constantly check the page to see what’s new. You can get all new discussions sent straight to your inbox. It’s the best way to stay in the loop without lifting a finger.

Just go to the main Shopware repository page and look for the button in the top right. Click it, and a dropdown menu will appear. Instead of just “All activity,” select “Custom” and then make sure the box for “Discussions” is ticked. Then hit “Apply”.

And that’s it! You’ll now get e-mail notifications for new discussions and comments of ongoing discussions. Dead easy, isn’t it?

Why Bother?

This is more than just feedback; it’s about co-creation. By participating, you’re helping to build a better, more practical Shopware for everyone. You can warn about potential pitfalls, suggest alternative approaches, or simply voice your support for an idea the team is considering.

Go on and give it a go. Your opinion could shape the next dev feature.

She saw a bid on ebay for a 7/8 cello initially for 900 EUR and bid along. She lost this bid at 1.430 EUR. In the mean time, this site was gone and not available to the public any more.

The bid was about a cello by the Italian violin maker, Ettore Soffritti, built between 1923 and 1927. My wife said that colleagues of hers were lucky bidding on such instruments sometimes, as the owners found it on their attic and don’t know how to use it nor what it is worth.

Some days later, the pictures for the same instrument appeared quoka.de so she got in touch with the seller (@_Schroder) which apparently resides in Zirndorf (closed to Nuremberg) via the Quoka PM services.

The seller answered to her e-mail address in German, sending along his alleged ID card of the person “Maria Concepcion Nuez de La Fuente”:

The price is 1750 euros. If I have aroused your interest, please let me know where it is (postcode and town) so that I can calculate the shipping costs. I will take care of the shipping. I’ll let you know after I find out how much it will cost. I look forward to your reply.
Thank you,
Maria

My wife answered briefly with our snail mail address via e-mail.

Now alleged Maria came up again (in German) via e-mail:

Hello,
As I have everything here in Spain, I don’t think I could personally pick it up for you here. Maybe only if you happen to be here in Spain or if you have a friend here who can buy it for you. Calle la Seguidilla, San Cristóbal de La Laguna, Santa Cruz de Tenerife, Spain.
The unit is technically and visually in perfect condition! As I said, I will pay the shipping costs. To start the delivery, I need your full name and the address where you want to receive the package.
I use Quoka payment services to pay, and for your security I provide my ID and address. After the payment is made, I ship it with DHL, and the delivery takes no more than 2-3 days.
A refund is also available, if you are not satisfied you can send it back and the money will be refunded to your account.
If you agree, please provide your confirmation, full name and delivery address so that I can arrange delivery.
Yours sincerely,
Maria

So I took a look at her ad (sorry, I didn’t take a screenshot and the ad is not longer available), and some things became really interesting:

• Why is she using the same pictures as on ebay before?
• Why is she starting to talk about a cello in her product description and uses “fiddle” in the end?
• Why is the seller new on Quoka and doesn’t have any other product to sell?

Other questions:

• Why did “Maria” send her passport scan unsolicitedly?
• Why did she answer via e-mail instead of using Quoka PM?
• Why did she insist in taking over the delivery costs? And – this is well-known – she talks about 2-3 days delivery as it is much longer from Fuerteventura via DHL to Germany, isn’t it?
• Quoka.es doesn’t exist, it seems to be a German-only marketplace. Why would she utilize it?
• What is she talking about quoka payments as quoka paymants apparently do not exist?
• Why is she using the term “item” for a beautiful instrument?

Additionally, we tried to reach Maria Concepcion Nuez de La Fuente on Linkedin to ask her if her ID card was stolen. Unfortunately, she didn’t answer yet (as she might not be that internet prone…)

Also, it was very helpful to visit these Quoka pages (sorry, German only):

• https://info.quoka.de/sicherheitstipps/
• https://hilfebereich.quoka.de/hc/de/articles/4410224131601

With other words, I said: “Baby, please do not transfer any money, I don’t trust it, it is a very vague business, although the chance seems to be too good to be missed.

At the end of the day, my wife uses quoka PM to ask if it was not possible to pick the instrument up in Zirndorf. She gets an answer in Hungarian language: “As I told you, I am based in Spain!” That’s it. Ad is reported to quoka, ad removed by quoka.

I admit, that this was a really good trick and maybe nobody not used to be in Internet affairs might have seen this. Thanks to my wife, she’s just had a bad gut feeling.

Stay safe!

After a nine-hours flight, I arrived very late in the night in our apartment in Brooklyn. However, I managed to go to our office on the very next morning, a Friday. The office is based on the 34th floor of one of these sky scrapers in lower Manhatten, right on the banks of the East River. We left the office in the afternoon and could still use the sunny day to take some pictures:

On the next day it was poring down rain which I used to get familiar with the apartment, unpack my luggage and do the necessary shopping. In the evening, I went out to a bar to socialize with the colleagues.

On Sunday, the weather was fine again so I could take a walk through Brooklyn, then went to the waterfront and took a round up to Dumbo from where I returned home. Later that day, we went to see an NFL basketball game Brooklyn Nets on Boston Celtics – what a great experience!

I will post more pictures over the next few weeks. Stay tuned!

And now I finally have got the chance to stay for three whole month, from December 1st till February 28th, to see New York City as well as the East Coast, yee-ha!

As announced on the last Shopware Community Day, my new company opened an office in New York City. In order to bring our corporate culture to this new market and to provide concrete set-up support on site, teams are sent there on a regular basis. I’m glad to join one of the first teams in my role as Community Manager. Of course, my tasks will be very similar to what I am usually doing in my job with an additional fokus on the Northern American economic area, for example visiting developer events and meetups around, up to determine so called ‘barriers of entry’ into the software as well as into our existing community.

I’m very much looking forward to meeting you over there, old friends, new colleagues, community members or other Community Managers! Please leave a comment or drop me a note if you want to see me.

Intentionally, especially senior level developers were addressed to join this event. In summary, about 15 people came together to hack on projects of their choosing in an open and very heartful atmosphere in this stylish villa. The event organization couldn’t be more perfect: Kellerkinder took care of the food and drinks, bribed us with their giveaways and sent their best developers into the game. Highlights of course were The One and Only Betty who gave us an unbelievably professional massage, an entire food truck just for us and Timo who showed us his archery equipment ✌️.

Also, something really interesting happened: in the beginning, the lads organized themselves in small groups. Latest on the second day, all of us sat together in just one room, coding, talking to each other and having fun – nearly a perfect momentum to see friendly and open people sharing knowledge with each other.

Here I took some photo impressions of the event for you:

Nearly without wasting time, an astonishing amount of projects where mostly brought to an end and found their way as pull requests to the Shopware platform or as separate projects inside the ecosystem. Here are the topics:

• Rafał took care about Redis caching. There where a lot of small requests which could be optimized in Shopware’s Redis implementation. A small plugin was written that collects all of these requests and reduces them by ~50%.
• Uwe and Jan aimed to create a pull request that allows to re-use rules or create a rule on the basis of another rule. Here it is: https://github.com/shopware/platform/pull/2487
• @tinect, Timo & Hauke took a deeper look into the cart object and analyzed what actually is safed. By optimizing the code they could spare ~30%. Thanks for the idea BTW, @wkreminger! Here is their pull request for this project: https://github.com/shopware/platform/pull/2485
• @tinect also took care about the project 301/302 redirects and made this function a bit more comfortable with his plugin: https://github.com/tinect/TinectRedirects
• Filters and groups in storefront (AKA layered navigation) were optimized by Oli and Stephan. The filters are now loaded via Ajax.
• Furthermore, Oli was working on the admin search and connected elasticsearch with it. With a bit of luck, this feature will be available for everybody using Shopware and will be delivered with the core with one of the next releases.
• Another very interesting project is HTTP cache for the store API & Rector where Soner and Manuel where working on. Rector can save a lot of time with refactoring after updates of any kind – be it PHP or Shopware versions – in your projects. Here is the repository for Shopware integration: https://github.com/FriendsOfShopware/shopware-rector
• Olli W. was working on a Shopware CLI in Go. Configuration should be possible via YAML files, but still seems to be bit of a challange 😉 https://github.com/FriendsOfShopware/shopware-cli

Feel free checking out or joining any of the above named projects – everything is open! Hope to see you on one of the next Hackathons or Hockethons!

[Update]: more posts about Hockethon:

• https://shyim.me/blog/shopware-rector-project/
• https://blog.timo-helmke.de/2022/05/17/kellerkinder-shopware-hockethon-may-2022

This is an absolutely valid request as this is good practice in other CMSses in order to prevent from brute force attacks, isn’t it.

However, it seems to be not necessary as I have learned shortly:

• Shopware doesn’t host all admin panel files in a folder called /admin like one might expect. Instead, there is only a so called SPA (single-page application) for the login. The real content goes to the API endpoints at /api.
• This SPA provides a JavaScript form that cannot be filled by usual brute force attacks – and even if so, the API endpoint is not suffering from it.

Additionally, Shopware comes with the native Symfony rate limiter to prevent brute force attacks which can be configured like described here: https://developer.shopware.com/docs/guides/hosting/infrastructure/rate-limiter

Many thanks to my dear work mate @shyim who answered this request.

$ Write failed: Broken pipe
$ fatal: The remote end hung up unexpectedly

Apparently, there were already some big files like PDFs, high resolution images and a database backup in the project.

Instead of picking out these huge files manually, this hint https://stackoverflow.com/a/54238315 was helpful, whatever magic that might be ^^:

$ git gc --aggressive --prune

This past period of my life took a lot of time. And even if it is coming to an end now: it has never been boring until the end.

I started in support in May 2007, and after a short phase in sales I went straight into community management when OXID decided to release a core version of the OXID eShop software under the GPLv3 open source license in October 2008.

During this entire period I was able to learn a lot about software development, processes and of course community management (DevRels), and as a community advocate I was able to influence decisions and processes myself, which I look back on with pride. I was often the first point of contact in the ecosystem, was allowed to be a member of the Security Counsel, took care of hosting partners technically and was allowed to look after the OXID Savvy Programme as a direct contact.

I helped to push platforms like OXIDforge, our new forum, the translation platform or the dev-channel (currently Slack) together with a good handful of volunteers and loved to sacrifice some weekends for it together with you.

I traveled with and through OXID to San José, Paris, Kaunas, Poznań and countless German cities, even to those that hardly anyone knows.

I was always at the forefront of events, sought personal contact, introduced you to each other, and learned to listen and, if possible, take what I heard back to the company as valuable feedback. We have had some heated discussions with each other there and/or in the forums.

I got to know you as wonderful colleagues as well as developers in agencies and at the customer directly, with whom I would like to work again and again, and we have celebrated together really wild parties 😉

And yet I can no longer go along with the current path OXID now wants to take – a separation is therefore logical, good and inevitable for both sides. I wish OXID all the best and best success on these paths!

Thank you for all the years, for all the great hours together, for all the feedback, for your active support, flag waving, pull requests on GitHub, translations, questions, comments and all other kinds of contributions to the community!

I take my leave with one laughing and one crying eye. And remember: we always see each other twice in life. Please consider this a threat 😉

If you want to stay in touch, please use:

• Social media: https://about.me/marco.steinhaeuser
• Make an appointment
• E-mail: info[at]marco-steinhaeuser.de
• Phone: +49 151 57144312

On March 19th, a press release originally written by Saxony’s Minister of Education PR Manager Dirk Reelfs was published. Headline: “Home schooling: Learning platform will become more powerful” in German.

This Saxon Minister of Education, Christian Piwarz, is a member of the conservative CDU party and the Saxon Parliament. He used to be President of the Young Union for Saxony and Silesia (which actually seems to be completely Polish since at least 70 years – just wondering).

However, this platform with the lurid name “LearnSax” was not available over the last weekend as announced in the press release. Wondering why announcing a software platform that isn’t available in a press release? More about that later…

I still had a chance to have a first look at it last Thursday, and I was totally shocked: On the surface, it looks quite okay (well, just “okay”) but digging a bit deeper with just a bit of a technical understanding: alas, what a complete mess…

• The triplication of user accounts (as announced in the press release) is absolutely explainable as there is no Captcha validation for the registration forms, nor any honey pot: gosh – bots love that behaviour!
• This is 2020. And honestly, there are Session-IDs in the URIs! Do you bl**dy dabblers have a clue what “Session Fixation” means? What you presently sold is standard of 20 years ago!
• By the way, the demo suffers from missing demo data. Which doesn’t make it a demo because nobody can learn from it.
• On Thursday, I read a lot of the “cloud” words on your home page. Did you really understand what “cloud” means? It is definitely not your ill-hosted SaaS solution!
• The down time of 56(!) hours over the last weekend literally documents your flaws.

Actually, the entire LernSax platform will be reported to the BSI (Bundesamt für Sicherheit im Internet, German Authority for Internet Security) because it is – at least IMO – not reliable: the fact of handing over Session IDs within the URL is negligent at best. This is a security issue discussed many times before (google it if you don’t trust me).

Nevertheless, Saxony’s Minister of Education, Christian Piwarz, isn’t afraid to sensationalize it in a press release. His subordinates praise LernSax as the official tool of one’s choosing, schools ought to use it!

Let’s go ahead and take a technical view at it. From Friday 10PM until Monday, 6AM, LernSax has been switched off. Instead they render a picture of the entire website including text (in German). Here you go:

First, read the caption of this picture once again and shake your head as I do:

Attention: LernSax will not be available fro FR 2020/03/20 10 PM until MO 2020/03/23 06AM..

Have you guys ever heard about downtime-less deployment before? You dare to re-arrange your stuff over 56 hours? Wow… and certainly: Change Management could be done more professionally.

In their “deep analysis” (in the text, rendered in a picture, without referring to any source), they admit that LernSax still runs close to or even over the limit. Presently, the peak is between 8:30 and 11:39 CET – typical school hours. In parallel, they “have suffered from DOS attacks”.

DOS attacks

At least at this point, I am certainly convinced that the provider of this platform is completely incompetent, along with the consultants which had have to approve it. Either this or they’re smoking some very strange stuff.

A DoS (Denial of Service) can be defended very simply, for example leading requests to Nirvana via UDP in your own firewall / have an own instead of a shared hardware firewall for your web space etc. whilst DDoS attacks need a bit more brains. Cloudflare would be another good and proven service provider apart from hosting this application in a real cloud like AWS (linked a good service provider from Saxony for that 😉

E-Mail handling

In your maintenance picture, you’re stating that you are convinced that the problems in delivering e-mails are not because of the huge attachments but in the massive jams and grey lists of the other (evil) e-mail providers. You assume that LernSax might have been black listed because of the massive increase of the users.
What you actually want to say is that all the others are wrong, and you’re not guilty. This assumption is stupid in many ways:

• Check if LernSax is not used as a spam slingshot (as it is vulnerable as said before).
• Make sure the SPF record is set correctly in your DNS.
• Make sure your e-mails will be send tick-wise.
• Make sure you use SMTP via port 587 (TLS) when using PhpMailer library.
• If all of that doesn’t work, look up my personal advisories I gave nine (!) years ago to another audience.

Conclusion:

LernSax is a massive turd, looking at it from a security as well as a bit of a technical point of view. From other sources I heard that even usability is disgusting. I am wondering why it is sensationalized by the officials of this province.

Later this year

All above I started writing nine months earlier, in March 2020, never published it because there was a little chance to get direct, personal influence. Unfortunately, nothing has happened since.

Shortly before the next complete lockdown, we got the following message from the teacher of the school where my 2nd grade (kid #3) now attends:

In order to ensure data protection, teachers are encouraged to gradually transfer our communication with you and the children to LernSax. Emails can be sent there. I (teacher) can also use it to post assignments online and the children in turn can indicate whether they have completed the assignments.

In the mean time, I got a little insight in LernSax’s usability. Let me pick that apart:

• Indeed, teachers can send their tasks to pupils, and they will receive them, if they confirm their pre-defined accounts.
• Pre-defined accounts, however, no matter if they are used or not, are a security incident!
• The LernSax system provides a messaging service. However, it will not forward to SMTP servers so one would be able to receive an information via e-mail. Instead you ought to use LernSax at least a couple of times per day in order to receive messages, tasks etc.
• It is possible to print the material that comes with tasks, resolve, scan and upload them again.
• File and folder conventions are completely missing, except the teacher has a good definition of conventions for himself: all parents may (and do!) upload anything with any file extension to any folder.
• In case you uploaded into another folder than intended by chance, everybody else can see your homework fail – I spare to upload a picture of what I’ve seen today.

In a matter of fact, there’s no advantage at all in using this super nova “digitized” platform: receiving tasks, scanning results and sending them back can be done using any other system (even via e-mail) as well, in most cases on a higher level of user experience, efficiency, security and even data protection.

And once again, with the date of closing down schools, LernSax is not available for hours during the regular schooling times. Piwarz is talking about a hacking attack again (this time using the term “DDoS”) in his press releases. Maybe they just don’t know how many pupils are working with this platform on an every day basis – in other words: “I can no longer get rid of the ghosts I called”? However, I can’t even understand why LernSax is hosted at the implementation agency bringe.net in Karlsruhe as we have good and reliable professional hosting providers and management services in Saxony.

Let’s talk about GDPR compliance. You guess it, don’t you?

• You as a pupil, or her/his parents are forced to use this useless platform, there’s no other chance as to accept or refuse their terms of data protection, as crude as they are. For example, this is stated already in the prologue: “The use of LernSax for direct teaching purposes by pupils and their teachers is not subject to consent. The Saxon State Ministry of Education and Cultural Affairs and the Saxon Data Protection Commissioner share the view that internal electronic communication between teachers and pupils is covered by the educational mandate according to § 1 SächsSchulG and therefore does not require any further consent.” Excuse me, how again is it connected?
• Where is the cookie consent tool on the LernSax site? Isn’t it mandatory for any website or is it “no subject to consent” as well?

And what about user support for the platform, training courses for pupils, teachers and parents or responsibility?

Well, I found something like a basic online training for parents at a totally different institution, not announced anywhere else and (state of Oct 8th, 2020) fully booked until the end of this year.

Responsibilities are wide splattered, beginning with teachers, schools and at last, the Saxon State Ministry of Education. The vendor of this software is completely out of these essential inquiries as they have kind of a “service contract”.

And for all of you who argue that “it is better then nothing”: Anything else (as mentioned above) is better than this – am sorry to be that negative about the “great efforts” our Ministry of Education made. But turned out as nothing, from the depth of my heart.

Hope you had a Merry Christmas, wishing a Happy New Year. Stay home and stay save and healthy!