21–30 of 357 posts
I don't think it's that big of a deal honestly. If some guy in Nebraska maintains some library that is very useful and your company relies on it and does not pay him, you're asking to wind up relying on an unmaintained project eventually. If I maintained something extremely valuable and found out a core google product relied on it, I'd stop maintaining it.
This is a pretty unlikely situation.
Someone already thought of all this and made Tidelift, btw.
I don't think it's that big of a deal honestly. If some guy in Nebraska maintains some library that is very useful and your company relies on it and does not pay him, you're asking to wind up relying on an unmaintained project eventually. If I maintained something extremely valuable and found out a core google product relied on it, I'd stop maintaining it.
may I ask why you would stop maintaining it in this case? aren't you then limiting yourself in your self-expression?
I don't think it's that big of a deal honestly. If some guy in Nebraska maintains some library that is very useful and your company relies on it and does not pay him, you're asking to wind up relying on an unmaintained project eventually. If I maintained something extremely valuable and found out a core google product relied on it, I'd stop maintaining it.
may I ask why you would stop maintaining it in this case? aren't you then limiting yourself in your self-expression?
Open source is fine. The culture of companies -- nearly all of them, including the one I work for -- that freeload off this work is what's broken. If you are equating this state of affairs with "open source", I think that does everyone involved a disservice.
I work on and release some things under open source licenses. I've been doing this on and off for nearly 20 years. None of it these days is as remotely as popular as something like log4j (the only popular thing I worked on for a while was Xfce, during the 00s). But that's the thing: I don't care (and kinda don't want) that kind of popularity. And if there's a critical bug in my stuff that lingers for a few weeks -- even if it's a security bug -- that's just life. If people want something with faster bug fixes or to-the-minute security responses, they submit patches, or they can pay me. Or, better yet, use an alternative that is already better supported, because I don't want to be paid for this stuff, and take on the burden of the added expectations.
An aside:
> Now let's turn our eyes to log4j2. This project is effectively in the standard library for Java users.
Is that really true? All my (professional and hobby) JVM projects use slf4j+logback. If I depend on anything that pulls in log4j (most of which pulls in v1, not the vulnerable v2), I exclude that and add the log4j-over-slf4j library, which replaces log4j with simple classes that delegate to slf4j.
People love to hate on Richard Stallman but he was really clear about the motivation for Free Software (which is not the same as Open Source but shares some tenets).
What companies do with the source is their thing. They get all of the benefits and all of the responsibilities. But the beautiful thing is that if that maintainer is dead or missing or no longer interested, you CAN fix it. Which is very difficult / nigh impossible for closed source.
I'm the author of the post in case you have any questions for me.
I also know there are organizations like the Software Freedom Conservancy who helps to handle these kinds of things who I would highly recommend [1].
I used to donate to a lot of FOSS projects, most recently FOSSHOST. Both the project and myself were heavily attacked and accused of all sorts of things for doing so [2]. It has left a chilling effect on me and others I have spoken to. Most of the people who engaged in the online attack were not even developers, but simply "IRC Admins" of projects.
How does a company or individual support projects financially with this kind of social ecosystem?
I'm the author of the post in case you have any questions for me.
It doesn't make sense that businesses don't invest enough in the software they use (paid commercial software or otherwise). That is only to the detriment of the businesses that don't care to invest (their unique use-cases are not improved). It's not quite a tragedy of the commons because nothing prevents the people who do care (Google, MS, Amazon, FB, IBM, to name the large ones) from contributing their improvements back to the ecosystem, and they retain the full benefit of their work.
It is absolutely an unequal exchange of goods for labor for most businesses but the near+zero marginal cost of replicating software means that it's a negligible loss for the authors, if that. The solid benefit for most programmers and system administrators is that they get to use high-quality Free/OS software in the jobs where they do earn money. At least for me, business concerns are secondary; I want to use quality software with a good ecosystem rather than know for sure that my employer paid money for the software that I have to use.
I'm the author of the post in case you have any questions for me.
thank you. it's a well written article and you got me agreeing with what you are saying. it's surprising to read comments here that start with "open source is not broken" but proceed to repeat everything you wrote in the article...
And I disagree with both of these statements. Open source is not broken and I'll continue to write useful software, even if you don't pay me, because it's fun.
The actual problem is concisely present in the article:
> There is this culture of taking from open source without giving anything back.
The problem is not with open source, but with how capitalistic systems interface with open source - the same way the interface with any public good. It's the capitalist culture that's broken; the capitalist culture of rent extraction and of short-term profit optimization.
My apologies if this is flame-bait. I really don't know what the solution is. I certainly could admit that shaming people into contributing on an individual level is a valid tactic and that a good state to be in is to have individual and corporate sponsorship for a long tail of FOSS projects. I worry that focusing on the failings of individuals to fund projects takes attention away from other alternatives.
I really don't know what the alternative could be. UBI? A wide array of government grants for FOSS?