Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Open source” is broken

christine.website

Post reply on HN
Print view View original

71–80 of 357 posts

Re: “Open source” is broken

#71

Post by j-bos »

hn_throwaway_99 wrote: post #32
betwixthewires wrote: post #17

I don't think it's that big of a deal honestly. If some guy in Nebraska maintains some library that is very useful and your company relies on it and does not pay him, you're asking to wind up relying on an unmaintained project eventually. If I maintained something extremely valuable and found out a core google product relied on it, I'd stop maintaining it.

I think the issue, which is so well depicted in that XKCD cartoon, is that transitive dependencies can make it nearly impossible to not depend on some low-level, unmaintained library. It's not like tens of thousands of projects decide to pull in left-pad. But tens of thousands of projects do decide to use React, which (I'm guessing through its own gaggle of many dependency layers) happened to pull in left-pad. Taking…

"I think the real fix is that dependency management tools like NPM and Maven need to make it much easier to "override" dependency package names so that, if a critical issue is discovered, you are not at the mercy of the current maintainers of that package to quickly get a fix into production."

I'm probably mistaken, but I thought in maven managedDependencies was exactly this. Please correct me if I'm wrong.

Re: “Open source” is broken

#73

Post by montroser »

No, it's not broken -- it's thriving.

Everyone involved has their own incentives, and gets to make their own decisions about when and where to invest their time and money.

Some devs are in it for the passion, some for the experience, some for the challenge, some for the learning, some so their work will live on when they change employers.

Startups get to use well-tested community supported libraries and don't have to build everything from scratch. Big companies get tech branding cred and can attract better talent, etc, etc.

And yes, maintainers sometimes get burnt out, consumers sometimes act inappropriately entitled, massively profitable enterprises often give back relatively little in return.

But that's all part of the deal going in, and everyone is fully aware of all the trade-offs straight from the onset.

What's so beautiful is that there are so many options whenever conditions change for any party. A maintainer goes to jail for vehicular manslaughter and a bugs needs fixing, no problem. Stand up a fork and the project continues on. A company's new leadership takes its own source project in a questionable direction and consumers are upset, no problem. Community forks and the project lives on.

And the result is we have this thriving, organic, creative, productive ecosystem which benefits us all in the end.

Re: “Open source” is broken

#74

Post by xena »

mcguire wrote: post #65
xena wrote: post #14

Earlier quoted context omitted.

Careful license choice and intentionally crippling things such that they are objectively useless unless you meet the exact needs that I have. I've kind of given up on elemental-ircd and left it unmaintained and archived, but I would probably send a job application in to that place if said unicorn startup happened. A few people have tried to take over elemental in the past, but as a whole the IRC ecosystem is on a dow…

Are you familiar with Kant's categorical imperative? ( https://open.library.okstate.edu/introphilosophy/chapter/the... )

I am now. I'll need to digest it for a while.

Re: “Open source” is broken

#75

Post by penjelly »

this is the second time i see this author... wtf are the characters between paragraphs? i guess its to make the article more readable or to express multiple perspectives or something? Kinda distracts from the main content

Re: “Open source” is broken

#77

Post by mcguire »

uniqueuid wrote: post #8
esarbe wrote: post #5

I seriously doubt that open-source is broken. What is broken is companies using open-source to build their products, expanding to billion dollars total revenue and not giving anything back in the long run. This will - as shown in the latest example - come back to bite them. It's the classic tragedy of the commons; everyone is willing to profit from the public good and nobody is willing to invest resources into it.

I agree. What's broken is liability of those companies relying on open source but not taking responsibility. One way to hold them accountable is to apply regulatory pressure in case of security breaches, which has started to happen (albeit not nearly enough). Is there any other way I'm not seeing?

I'm not sure. Wouldn't that mean forcing the companies to pay someone to take that liability but not necessarily providing any benefit to the original software developers---like whatever Red Hat Enterprise Linux is called today?

Re: “Open source” is broken

#78

Post by CuriousCosmic »

zaarn wrote: post #43
wyldfire wrote: post #26

> I simply do not want to be in a situation where my software that I develop as a passion project on the side is holding people's companies together. People love to hate on Richard Stallman but he was really clear about the motivation for Free Software (which is not the same as Open Source but shares some tenets). What companies do with the source is their thing. They get all of the benefits and all of the responsibi…

Except you can't because hundreds of thousands of project have "log4j" in their dependency list not "wyldfire-fixed-log4j". If log4j broke and there was no maintainer, a fork would not fix things.

Strictly speaking in the Java space that's a perfectly reasonable assumption. It's a bit more work but you can just substitute the jar/modules for log4j following the build with the patched versions.

At the end of the day it is just a bunch of class files in jars/zips which makes patching a lot easier.

Re: “Open source” is broken

#79

Post by fileeditview »

hn_throwaway_99 wrote: post #32
betwixthewires wrote: post #17

I don't think it's that big of a deal honestly. If some guy in Nebraska maintains some library that is very useful and your company relies on it and does not pay him, you're asking to wind up relying on an unmaintained project eventually. If I maintained something extremely valuable and found out a core google product relied on it, I'd stop maintaining it.

I think the issue, which is so well depicted in that XKCD cartoon, is that transitive dependencies can make it nearly impossible to not depend on some low-level, unmaintained library. It's not like tens of thousands of projects decide to pull in left-pad. But tens of thousands of projects do decide to use React, which (I'm guessing through its own gaggle of many dependency layers) happened to pull in left-pad. Taking…

> Taking the option of "I'll just build everything myself" then is not really a viable process in today's world, where all of your competitors will be using tons of prebuilt stuff [...]

It obviously depends on the scope of things but I tend to see a future where this building everything yourself might be an advantage again. Because most of "this prebuilt stuff" adds layers of complexity because of generalizations you don't need and other abstractions.

In my experience this gets worse and worse every year. We software developers are already drowning in a flood of languages, frameworks and so on. How often do I see a framework Y built on top of library/framework X to abstract away something from X. Not only you have now both dependencies but at some point Y lacks a feature you need (which is provided by X). Now you have to pull up X and mix with Y and everything just got worse than just using X from the get go..

I more and more think we need some back to the root movement and also keep in mind to always choose the simplest solution.

Re: “Open source” is broken

#80

Post by zaarn »

IiydAbITMvJkqKf wrote: post #67
zaarn wrote: post #43

Earlier quoted context omitted.

Except you can't because hundreds of thousands of project have "log4j" in their dependency list not "wyldfire-fixed-log4j". If log4j broke and there was no maintainer, a fork would not fix things.

Sure you can fix it, change the "log4j" in your dependency list to "wyldfire-fixed-log4j". You can't do that with closed source (either because you care about legalities, or because you have no way of obtaining a compilable and readable source code).

Until all hundreds of thousands of projects have changed that, it'll take time.

That doesn't mention the fact you now also have to fork unmaintained projects relying on log4j to use the new version. If you're developing a major java projects, that's potentially thousands of dependencies you have to patch.

I'm not suggesting that closed source is the solution, I'm saying the current system is not sustainable and neither is just forking projects. Because which fork do you follow, and how do you make sure all your dependencies follow the fork you want and not an unmaintained fork?

Post reply on HN