Professional maintainers: a wake-up call • Hacker News Board

Re: Professional maintainers: a wake-up call

#11

Post by usrbinbash » Sat, Dec 11, 2021, 7:51 PM UTC

1_player wrote: post #7

daemonhunter wrote: post #3

Side note: dang there are salary discrepancies in the SWE community.

There are salary discrepancies everywhere in the world. If you mean the salaries across countries, you're comparing apples and oranges. €100k in Berlin goes much further than $100k in Houston (a random big city in the US, I don't think Berlin is comparable to NYC)

Not to mention the person in Berlin has access to state funded medical support, a state funded pension, paid sick leave, paid ma/paternity leave, ...

Salaries are lower, but expenses for essential services are simply A LOT less in most of Europe.

Re: Professional maintainers: a wake-up call

#12

Post by didibus » Sat, Dec 11, 2021, 7:52 PM UTC

I feel like the examples of log4j and ua-parser aren't that great, because it would be relatively easy for any other similar lib to take their place, as it's mostly straightforward to implement, even though it still takes time.

But there are some things like Kafka, PostgressSQL, Spring Boot, Tomcat, Apache Math, ZooKeeper, the OpenJDK, and all that which are definitely non-trivial and a huge amount of time and effort, and you couldn't just take an extra month or two and have a dev on your team implement a replacement, unlike log4j and ua-parser.

I think those would be better example to discuss, and my impression has been that those things often have a company behind them offering support or offering them as a service that in some ways pays for some real devs to contribute to them, but maybe I'm mistaken.

Like for example, the author mentions working on the GO team at Google, and Go I would consider one of those big open source projects that truly are foundational and would be non-trivial and huge effort to replace. So that shows that the really big pieces do have companies hired and paid staff behind them.

Re: Professional maintainers: a wake-up call

#13

Post by throwaway894345 » Sat, Dec 11, 2021, 7:53 PM UTC

usrbinbash wrote: post #10

> But! Maintainers need to be legible to the big company department that approves and processes those invoices. I imagine this could be a hard sell to people who just want to build some cool software and maintain it. Setting up an account, okay, that may be possible, but that's not the end of it. Companies pay invoices FOR something. That something means contracts, potentially about substantial sums, that means getti…

We have software licenses and yet every open source project doesn’t employ a lawyer. The solution is probably the same: canned, off-the-shelf contracts. If a company wants to negotiate a custom contract, then the maintainer can decide whether or not it’s worth hiring a lawyer.

Re: Professional maintainers: a wake-up call

#14

Post by beiller » Sat, Dec 11, 2021, 7:53 PM UTC

jjoonathan wrote: post #6

tomxor wrote: post #2

Unpopular opinion: Maybe there is nothing wrong with the "status quo", maybe we don't need yet another attempt to finance small FOSS projects where it's hard to explain how money will actually solve any of these issues. Maybe people just need to be more considerate of what they depend upon. And in the case that a popular yet well maintained project has a CVE on day, maybe we need to accept that popularity does not ma…

"Being considerate" and "accepting" can't fix bugs. Time and money can fix bugs. We need to get these projects more time and more money.

Open source always trails professional software solutions. Yet always time after time will eventually surpass it as the bleeding edge moves further. Maybe we can view it in such a way that major companies have become too reliant on free open software. If you want secure software, pay for it. The knowledge will eventually flow down to free software because it's ultimately run by hobbyists. I like the way it is and I don't see it changing because so many are just donating free time to open free software. Maybe something we could do is make open source contributions tax deductible (if we could somehow price it accurately)

Re: Professional maintainers: a wake-up call

#15

Post by vmception » Sat, Dec 11, 2021, 7:54 PM UTC

You can get a closer view of this sentiment in action within communities built on open source with distributed governance. Very many communities in the blockchain space routinely discuss how to compensate the development work necessary, and the recurring theme is that people imagine a nonexistent cheap developer:

An engineer with in Micronesia with specialized skillsets.

Try to convince these communities about the need for a well compensated team of people including product managers and designers all making 6-figures and honestly people just don’t believe you. The truth is that cost of living discussion doesn’t even matter, people should be compensated on the value they bring (and in those communities that is very easy to quantify.)

This has wildly slowed down many projects as UI and usability are completely neglected.

Its pretty much only been one year that an engineer in this space can reliably land compensation packages somewhat competitive to a tour in NAAAM

Re: Professional maintainers: a wake-up call

#16

Post by fivelessminutes » Sat, Dec 11, 2021, 7:54 PM UTC

the_gipsy wrote: post #5

Please define "unsustainable". It has worked great for decades, both for the free market side, and for the FOSS community.

It has certainly 'worked great' for leeches, if you ignore bombs like this logging bug destroying Western civilization.

Can you explain a bit more how it worked great for the bulk of maintainers / authors who don't see any return on their work, burn out and have to do something else?

Re: Professional maintainers: a wake-up call

#17

Post by throwaway5371 » Sat, Dec 11, 2021, 7:57 PM UTC

no, people should commit security vulnerabilities on purpose; anarchy and chaos should arise

reign of chaos

Re: Professional maintainers: a wake-up call

#18

Post by rglullis » Sat, Dec 11, 2021, 7:58 PM UTC

jjoonathan wrote: post #6

tomxor wrote: post #2

Unpopular opinion: Maybe there is nothing wrong with the "status quo", maybe we don't need yet another attempt to finance small FOSS projects where it's hard to explain how money will actually solve any of these issues. Maybe people just need to be more considerate of what they depend upon. And in the case that a popular yet well maintained project has a CVE on day, maybe we need to accept that popularity does not ma…

"Being considerate" and "accepting" can't fix bugs. Time and money can fix bugs. We need to get these projects more time and more money.

No doubt. The question is who should be paying them?

Re: Professional maintainers: a wake-up call

#19

Post by beebmam » Sat, Dec 11, 2021, 7:59 PM UTC

The solution to this, along with many other socioeconomic problems, isn't going to be solved through voluntarism.

This is easily solved with a universal basic income. Some of us would gladly forever maintain and contribute to free software if we had our basic needs guaranteed.

I certainly would

Re: Professional maintainers: a wake-up call

#20

Post by finnh » Sat, Dec 11, 2021, 8:00 PM UTC

jjoonathan wrote: post #6

tomxor wrote: post #2

Unpopular opinion: Maybe there is nothing wrong with the "status quo", maybe we don't need yet another attempt to finance small FOSS projects where it's hard to explain how money will actually solve any of these issues. Maybe people just need to be more considerate of what they depend upon. And in the case that a popular yet well maintained project has a CVE on day, maybe we need to accept that popularity does not ma…

"Being considerate" and "accepting" can't fix bugs. Time and money can fix bugs. We need to get these projects more time and more money.

Would more time or money prevented the log4j bug? If anything that strikes me as coming from too much time spent on overarchitecting something.