Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backyourstack: discover and sponsor your open-source dependencies

backyourstack.com

Post reply on HN
Print view View original

21–30 of 65 posts

Re: Backyourstack: discover and sponsor your open-source dependencies

#21

Post by kanzure »

wongarsu wrote: post #17
kanzure wrote: post #15

I've been wondering whether a for-pay alternative to the open-source ecosystem could be developed. The problem seems to be that open-source gratis software contributes nearly zero friction to a company building out its tech, so any alternative would have to compete against that near-zero friction. I just don't see each company negotiating separate prices with 100,000 package maintainers to use all of their software o…

How would that be different from the regular Microsoft Ecosystem? I can spin up a quick testserver using Windows Server, running an IIS webserver and Microsoft SQL Server, with my software stack written in C#, programmed in Visual Studio. It covers pretty much everything I could need, and involves ordering à la carte instead of negotiations. Obviously it costs more and unless I spin up a cloud server I can't "just sp…

My understanding is that Microsoft does not auto-publish+sell third-party libraries in a package repository. So the difference is basically the distinction made in the old cathedral/bazaar analogies.

Re: Backyourstack: discover and sponsor your open-source dependencies

#22

Post by rpeden »

wongarsu wrote: post #17
kanzure wrote: post #15

I've been wondering whether a for-pay alternative to the open-source ecosystem could be developed. The problem seems to be that open-source gratis software contributes nearly zero friction to a company building out its tech, so any alternative would have to compete against that near-zero friction. I just don't see each company negotiating separate prices with 100,000 package maintainers to use all of their software o…

How would that be different from the regular Microsoft Ecosystem? I can spin up a quick testserver using Windows Server, running an IIS webserver and Microsoft SQL Server, with my software stack written in C#, programmed in Visual Studio. It covers pretty much everything I could need, and involves ordering à la carte instead of negotiations. Obviously it costs more and unless I spin up a cloud server I can't "just sp…

You can do pretty much the same with ASP.NET core + Kestrel, too. Substitute Postgres for SQL Server if you want to stay all open source. But even with SQL Server, you can deploy the whole stack on Linux.

Re: Backyourstack: discover and sponsor your open-source dependencies

#24

Post by wongarsu »

kanzure wrote: post #21
wongarsu wrote: post #17

Earlier quoted context omitted.

How would that be different from the regular Microsoft Ecosystem? I can spin up a quick testserver using Windows Server, running an IIS webserver and Microsoft SQL Server, with my software stack written in C#, programmed in Visual Studio. It covers pretty much everything I could need, and involves ordering à la carte instead of negotiations. Obviously it costs more and unless I spin up a cloud server I can't "just sp…

My understanding is that Microsoft does not auto-publish+sell third-party libraries in a package repository. So the difference is basically the distinction made in the old cathedral/bazaar analogies.

They do have nuget for packages, but that doesn't have an integrated payment system. Despite this, there are plenty of paid C# packages you can buy around the web.

Re: Backyourstack: discover and sponsor your open-source dependencies

#27

Post by Vinnl »

pferde wrote: post #16
Spacemolte wrote: post #14

Earlier quoted context omitted.

Consider how many layers of dependencies are in use today, and you have no idea who the commenter is, what position he has in the business you assume he is 'running'.

If they're running that business, they are either paying people who can tell them the dependencies (if not, those people are being paid too much), or they are responsible for the code themselves (small co. or early startup), and should already know, or with small effort be able to identify all the dependencies whenever necessary. Anything else would be irresponsible. If they're not running that business and have enou…

Which technology are you using that does not have this problem?

Re: Backyourstack: discover and sponsor your open-source dependencies

#28

Post by ajdlinux »

znarfor wrote: post #13
deadbunny wrote: post #10

Earlier quoted context omitted.

Yup, tested it out on a few python projects I have/use and it has 0 dependencies listed which is very, very wrong.

We effectively don't support Python yet but it should not be far away. It's 100% Open Source and we're looking for contributions. https://github.com/opencollective/backyourstack/issues/34

Understandable that you're adding support for languages and packaging ecosystems as you go, and JS + PHP is as good a place as any to start, but it would be helpful if this were explicitly highlighted. For those who are unfamiliar with the ecosystems in question, package.json and composer.json are just filenames that don't actually tell you anything.

Re: Backyourstack: discover and sponsor your open-source dependencies

#29

Post by ajdlinux »

Vinnl wrote: post #27
pferde wrote: post #16

Earlier quoted context omitted.

If they're running that business, they are either paying people who can tell them the dependencies (if not, those people are being paid too much), or they are responsible for the code themselves (small co. or early startup), and should already know, or with small effort be able to identify all the dependencies whenever necessary. Anything else would be irresponsible. If they're not running that business and have enou…

Which technology are you using that does not have this problem?

I work on the opposite end from the web stack - firmware development - and even we have layers upon layers of dependencies that are problematic to track.

Re: Backyourstack: discover and sponsor your open-source dependencies

#30

Post by dschep »

oliwarner wrote: post #20

> If you want to analyze non-public repositories, sign in with your GitHub account Do people really expose their or their employer's source code to random third party convenience services? I do understand the convenience factor here, I just think it's dodgy to encourage developers to be so flippant with privileged access.

It also has the option to upload a package.json which is far less exposure, and can easily be tweaked to omit anything sensitive.
Post reply on HN