Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Open source” is broken

christine.website

Post reply on HN
Print view View original

11–20 of 357 posts

Re: “Open source” is broken

#11

Post by rvense »

Open source software is free to take is a practical measure as much as anything. It's because having the left-pad package surrounded by a paywall would suck, and would create all kinds of weird incentives to mess with both the software and the ecosystem. And we absolutely want an ecosystem where one person makes left-pad, and someone else builds on top of that and in the end you have React, or whatever, and that doesn't work if everything is an app store.

We (programmers) need to explain this to the money people somehow. No company I've worked for in my 10-year career would have been able to exist without open source. They would have had no product. If you're extracting significant value from this ecosystem, you should help fund it, even though there isn't a toll booth on the way in.

Re: “Open source” is broken

#13

Post by politelemon »

Yes it's in a bad state and unsustainable, especially with the recent (and welcome) focus on security these days. I wouldn't consider it broken however, that's implying an unrecoverable state. There do exist sponsored projects in the open source world which have been running successfully, though those are few and far between relative to the number of 'Nebraska' projects.

Those outliers aside, consider the alternatives. The first one I can think of is to put trust in closed source software, in many cases written by MAMAA. We have enough historical evidence to know that represents a nightmare scenario that we should actively be working to get away from.

That's why I agree, we should be trying to make the open source ecosystem sustainable. What I think we'll need, as a bunch of normal users, is a way to present these cases to our $workplaces, to get the funding or sponsorship in place. And an easy way for companies to do that, which slots in with their own practices.

Re: “Open source” is broken

#14

Post by xena »

senko wrote: post #7
xena wrote: post #3

I'm the author of the post in case you have any questions for me.

You mentioned you don't want your passion project to be critical to someone without getting paid for your work. How do you ensure that's not the case? Careful license choice, "you're on your own" wording or something else? Like, if someone created a unicorn startup rivaling Slack using Elemental-IRCd, how would you react? (I have massive respect for anyone maintaining an ircd, btw, having attempted to contribute to o…

Careful license choice and intentionally crippling things such that they are objectively useless unless you meet the exact needs that I have.

I've kind of given up on elemental-ircd and left it unmaintained and archived, but I would probably send a job application in to that place if said unicorn startup happened. A few people have tried to take over elemental in the past, but as a whole the IRC ecosystem is on a downturn so they don't last long. It's a complicated situation though. At some level I'd be shocked that they managed to turn that pile of shit into something usable!

Re: “Open source” is broken

#15

Post by blondin »

xena wrote: post #3

I'm the author of the post in case you have any questions for me.

thank you.

it's a well written article and you got me agreeing with what you are saying. it's surprising to read comments here that start with "open source is not broken" but proceed to repeat everything you wrote in the article...

Re: “Open source” is broken

#16

Post by jrpt »

hooande wrote: post #6

Someone should write a package that goes through your existing codebase to see which open source projects you make the most use of (however that is measured). Then a company could run it once a year, say around tax write off time, and build a list to donate to I would have happily given to log4j, but I didn't know that they were in need. Someone has to make it easy to keep track of this because it's never going to be…

Stuff like that already exists. Companies barely donate. In my opinion, more packages should require licensing fees from companies.

Re: “Open source” is broken

#17

Post by betwixthewires »

I don't think it's that big of a deal honestly.

If some guy in Nebraska maintains some library that is very useful and your company relies on it and does not pay him, you're asking to wind up relying on an unmaintained project eventually. If I maintained something extremely valuable and found out a core google product relied on it, I'd stop maintaining it.

Re: “Open source” is broken

#18

Post by wisty »

hooande wrote: post #6

Someone should write a package that goes through your existing codebase to see which open source projects you make the most use of (however that is measured). Then a company could run it once a year, say around tax write off time, and build a list to donate to I would have happily given to log4j, but I didn't know that they were in need. Someone has to make it easy to keep track of this because it's never going to be…

Or they could get a list of deps, and just get their engineers to occasionally keep tabs on a few random deps. Random would be almost as good as systematic if a few companies did it.

Check the security of the infrastructure (is it one guy?), check whether some the code is correct (either randomly or systematically, not just checking the first file you see), etc.

What's the incentive? Well, checking your dependencies is a way to upskill. You learn as much reading code (especially the code you are relying on) as you do writing code, and most of a programmer's job is learning.

Re: “Open source” is broken

#19

Post by yumaikas »

hooande wrote: post #6

Someone should write a package that goes through your existing codebase to see which open source projects you make the most use of (however that is measured). Then a company could run it once a year, say around tax write off time, and build a list to donate to I would have happily given to log4j, but I didn't know that they were in need. Someone has to make it easy to keep track of this because it's never going to be…

I mean, `npm donate` is a thing, I'm pretty sure. Just need to build it for other ecosystems.

Re: “Open source” is broken

#20

Post by esarbe »

uniqueuid wrote: post #8
esarbe wrote: post #5

I seriously doubt that open-source is broken. What is broken is companies using open-source to build their products, expanding to billion dollars total revenue and not giving anything back in the long run. This will - as shown in the latest example - come back to bite them. It's the classic tragedy of the commons; everyone is willing to profit from the public good and nobody is willing to invest resources into it.

I agree. What's broken is liability of those companies relying on open source but not taking responsibility. One way to hold them accountable is to apply regulatory pressure in case of security breaches, which has started to happen (albeit not nearly enough). Is there any other way I'm not seeing?

Another way would be to enforce open-source requirements for any public spending including/producing code. You want a city to buy your traffic control system? Open source the code first. You want a state to use your voting machines? Open source your code first. Any public money going should necessitate that software being released as open source.

Not only would this lower the risk of fatally flawed public software projects, maintenance of these systems in the long run would also not depend on just one company with an artificial monopoly anymore. This would also create a healthy ecosystem of paid open source developers.

Just an idea.

Post reply on HN