Live data from Hacker News

Professional maintainers: a wake-up call

blog.filippo.io

21–30 of 464 posts

Re: Professional maintainers: a wake-up call

#22
I agree that appropriate compensation is necessary, but I don't think it's sufficient. There's a lack of visibility and tooling for dependency management/auditing. I can't even find a proper list of critical OSS along with their donation links.

Moreover, there needs to be a fundamental re-thinking of the security model of languages and runtimes, i.e. even if I can eval() user input or load a plugin from the network, it should not be game over. There should be finer-grained access control in programs, both at the type-level and with how they interact with the OS. The global view of "your program can do anything unless said otherwise" needs to change.

Re: Professional maintainers: a wake-up call

#23

Please define "unsustainable". It has worked great for decades, both for the free market side, and for the FOSS community.

there is no past tense for unsustainable, so if one wants to indicate something was unsustainable in the past they say it 'was unsustainable' but if they want to indicate something will be unsustainable for the future they just say it is unsustainable, one of the downsides of English; also, past performance is no indicator of future performance applies to many things outside investing.

In other words open source as it was practiced was sustainable up until the point it got taken advantage of too much by big players not putting things back into the system. At this point it has become unsustainable.

Re: Professional maintainers: a wake-up call

#24

Please define "unsustainable". It has worked great for decades, both for the free market side, and for the FOSS community.

It has certainly 'worked great' for leeches, if you ignore bombs like this logging bug destroying Western civilization. Can you explain a bit more how it worked great for the bulk of maintainers / authors who don't see any return on their work, burn out and have to do something else?

> It has certainly 'worked great' for leeches,

And for communities, and for sponsoring companies, and for some (although not all) authors.

> if you ignore bombs like this logging bug destroying Western civilization.

...yeah, no; a library had a bug. Somehow, Western civilization is still here.

> Can you explain a bit more how it worked great for the bulk of maintainers / authors who don't see any return on their work, burn out and have to do something else?

Can you explain why you think the majority of authors/maintainers burn out?

Re: Professional maintainers: a wake-up call

#25

Please define "unsustainable". It has worked great for decades, both for the free market side, and for the FOSS community.

It has certainly 'worked great' for leeches, if you ignore bombs like this logging bug destroying Western civilization. Can you explain a bit more how it worked great for the bulk of maintainers / authors who don't see any return on their work, burn out and have to do something else?

> authors who don't see any return on their work, burn out and have to do something else?

I don't understand this argument. Nobody starts an open source project - and posts it in the open to share freely - expecting to make any money. Are there even any significant amount of projects with a donation or a Patreon page?

Webnovels I read on RoyalRoad all have it and are much more successful that I would ever have thought given that the stories are all coimpletely free and all any one who pays a story author gets is a few chapters ahead of others, but I can't remember any of the numerous OS projects I use one way or another to even try to make any money.

I did see burnout in some projects. I once joined as co-maintainer of a medium sized project and was left as the sole maintainer because the main author just up and left and was unreachable (we only heard of him again over a year later, and he never touched that particular project again).

All the stories I saw had nothing to do with money at all though, just getting fed up with the expectations. In "my" project's case it also was the large amount of complexity and technical debt that made the original owner's attempts at adding and/or refactoring a huge time sink, and he probably would have been better off to start again from scratch (it's what happens after adding more and more features in a complex cross-mobile phone platform library project's code).

None of those "disillusioned open source maintainer" stories I saw ever included any attempt of making money with it. Disappointment of not being able to get money from anyone only ever comes from people starting a commercial project (a new company), if that kind of disappointment exists for freely shared open source software then I must have missed all instances of such a thing happening.

> It has certainly 'worked great' for leeches, if you ignore bombs like this logging bug destroying Western civilization.

All of life and especially commercial life in anything slightly sophisticated or at scale is "muddling through" to some degree. The same as biological life actually.

So overall I agree with the previous statement that it worked quite well. Nobody should be called a "leech" for using projects that were meant to be shared openly and freely, given the license and method of distribution (e.g. freely on Gitlab or Github).

Re: Professional maintainers: a wake-up call

#26
I'm an open source author and maintainer of a somewhat-popular python package[0] (~1M downloads/month) that I've maintained for over 10 years. I don't recall ever receiving a donation. I am still maintaining it, but I just don't have time to add the improvements that it needs to keep up with the ecosystem (asyncio, for example). If organizations who use it got together and chipped in some non-negligible amount, I would be much more serious about keeping up with it, but $0, or $5-20/month, is just not realistic incentive to compete with other priorities in my life. I don't know the answer, but that's my thought process.

0. https://github.com/amoffat/sh

Re: Professional maintainers: a wake-up call

#27

> But! Maintainers need to be legible to the big company department that approves and processes those invoices. I imagine this could be a hard sell to people who just want to build some cool software and maintain it. Setting up an account, okay, that may be possible, but that's not the end of it. Companies pay invoices FOR something. That something means contracts, potentially about substantial sums, that means getti…

We have software licenses and yet every open source project doesn’t employ a lawyer. The solution is probably the same: canned, off-the-shelf contracts. If a company wants to negotiate a custom contract, then the maintainer can decide whether or not it’s worth hiring a lawyer.

Even if the contract itself might be commodified, the relationship won't be. Business will want what it wants, regardless of what the contract says. Maintainers will certainly be subject to influence campaigns by business, which will sometimes conflict with other "clients". Even saying "no, read the contract" to a persistent VP has a psychological and social cost. I can't really imagine this decreasing the pressure on maintainers: it's basically turning the project into a startup.

Re: Professional maintainers: a wake-up call

#28
post #20

Earlier quoted context omitted.

"Being considerate" and "accepting" can't fix bugs. Time and money can fix bugs. We need to get these projects more time and more money.

Would more time or money prevented the log4j bug? If anything that strikes me as coming from too much time spent on overarchitecting something.

That's more an argument against old-school "no amount of architecture is ever enough" Java -- not so much an argument against the principle that engineer-time can fix bugs.

Re: Professional maintainers: a wake-up call

#29
The only reason I’m able to maintain a reasonably successful open source library is because it is part of an open core business model. Without that I couldn’t justify the development effort or relentless support to myself, or my family. Getting a few hundred dollars a month wouldn’t cut it either.

Building a business on a stack of other people’s hobbies isn’t sustainable. I mean, just tell that to anybody outside of tech and watch their reaction.

Post reply on HN