Shout-out to Toitū Te Whenua LINZ, the New Zealand government mapping authority, for actually funding several projects in the geospatial field.
“Open source” is broken
81–90 of 357 posts
Re: “Open source” is broken
#82Earlier quoted context omitted.
Except you can't because hundreds of thousands of project have "log4j" in their dependency list not "wyldfire-fixed-log4j". If log4j broke and there was no maintainer, a fork would not fix things.
Strictly speaking in the Java space that's a perfectly reasonable assumption. It's a bit more work but you can just substitute the jar/modules for log4j following the build with the patched versions. At the end of the day it is just a bunch of class files in jars/zips which makes patching a lot easier.
Hot patching a jar is not a scalable solution in the long term, especially if you're considering that in a larger project there may be multiple unmaintained projects that now need permanent hotpatching.
Re: “Open source” is broken
#83I don't think it's that big of a deal honestly. If some guy in Nebraska maintains some library that is very useful and your company relies on it and does not pay him, you're asking to wind up relying on an unmaintained project eventually. If I maintained something extremely valuable and found out a core google product relied on it, I'd stop maintaining it.
You say that as if you even know your full dependency chain. Reality doesn't quite work that way. No one knew their codebase even relied on leftpad until it broke millions of applications the world over when it got pulled. Some projects have the benefit of notoriety (log4j falls in that category) but plenty of projects are just "plumbing" and the only thing you know is the name of the dependencies you have in your de…
> plenty of projects are just "plumbing" and the only thing you know is the name of the dependencies you have in your dependency list.
Maybe in the web world. .Net/Java/C/C++/etc projects have a well understood dependency chain, most of the time. Mostly because there is an actual stdlib and having dependencies upon dependencies upon dependencies is very rare. Projects I've worked on with over 150 dependencies (which is an awful lot for an Android project as it was) had a dependency tree that wasn't that deep (5 at most), and all of that was on standard, well known modules (androidx, etc.)
The shitshow that is JS dependency management is a self-inflincted wound. Knowing your dependency tree _is part of your job_ as a software engineer.
Re: “Open source” is broken
#84this is the second time i see this author... wtf are the characters between paragraphs? i guess its to make the article more readable or to express multiple perspectives or something? Kinda distracts from the main content
Author of the post here. I have found that I tend to insert asides in my articles a lot. The characters are there not only to help space things out and make it easier to read, there's also room for the Socratic Method of dialogue based teaching. I also slightly compartmentalize the kind replies based on which character is speaking, which allows for people to build otherwise unspoken associations about what kind of aside they are going to get. Mara with the split keyboard is usually for a pedantic aside or another place a concept can be applied, etc. This really is a bit of experimentation that I'm doing by playing with the writing style in a way that better suits my thought processes and allows me to take it beyond text.
Also the more people complain about the furry characters in the blog posts, the more furries there will be. I am waiting for a few refsheets that I will use in various things in the future.
Re: “Open source” is broken
#85What happened to those who find it fix it?
Re: “Open source” is broken
#86Earlier quoted context omitted.
I think the issue, which is so well depicted in that XKCD cartoon, is that transitive dependencies can make it nearly impossible to not depend on some low-level, unmaintained library. It's not like tens of thousands of projects decide to pull in left-pad. But tens of thousands of projects do decide to use React, which (I'm guessing through its own gaggle of many dependency layers) happened to pull in left-pad. Taking…
"I think the real fix is that dependency management tools like NPM and Maven need to make it much easier to "override" dependency package names so that, if a critical issue is discovered, you are not at the mercy of the current maintainers of that package to quickly get a fix into production." I'm probably mistaken, but I thought in maven managedDependencies was exactly this. Please correct me if I'm wrong.
Maven/Gradle does exactly that. Provided the dependency you're replacing is compatible with the new one (same packages, same methods, etc), it's fully transparent. It's just that once again, the web world is running with awful tools that keep making the same mistakes that have been done years before them.
Re: “Open source” is broken
#87This is a point I've been pondering about recently, especially since the attacks against Free Software and RMS. I've been convinced of the inherent good that openly available software is, both for users and developers, and for society at large. I want to continue contributing to the common goods. But I am also fully aware that Google, Facebook, Twitter, Instagram, Snapchat, Tiktok, and all other platforms exploiting…
A good analysis of what open source enables - Facebook et al. were able to build their companies more easily using it.
But you forget to compare it to the alternative, where there is no significant open source or libre software available.
You can't run Linux, you have to trust Windows not to backdoor you. There is no Signal or Matrix or other encrypted messaging - or if there is, you have no way of verifying it. If you want to write a .txt file, you must pay for a close-source text editor. Or a very expensive compiler, if you're a programmer. Is the compiler backdooring your code? Maybe. You must find paid alternatives for all the free software you rely on, for work, or for your hobbies.
And who builds that paid software? Not a garage shop - they could never afford all the compilers and libraries and tools necessary. Only billion-dollar+ companies, engaging in incestuous cross-licensing, letting each-other use their tools, and crushing any upstarts.
If open source (or even copyleft) benefits those in power, closed source benefits them infinitely more.
Re: “Open source” is broken
#88Open source isn't broken. The software will continue to get built regardless of funding levels, clearly. But when vulnerabilities like this are found, no one -- especially corporate users -- gets to complain. Any complainers should be immediately told to fund the software they use, or shut their entitled mouths. Open source is fine. The culture of companies -- nearly all of them, including the one I work for -- that…
> no one -- especially corporate users -- gets to complain
Do corporate users of open source really do all that much complaining without contributing? IME the people with the biggest complaint/contribution ratio in open source projects are individual devs (or trolls) who are not participating as a representative of any company.
Re: “Open source” is broken
#89I see lots of sentiment in this thread that amounts to "I didn't know you were going to get rich off of my work." That's anathema to Open Source. How do I know? Check "The Open Source Way" [1]. If you feel uncompensated, use a license that prevents commercial use. [1] https://opensource.com/open-source-way
I get the feeling that you misunderstand the gist of the article. The gist of the article is not "I didn't know you were going to get rich off of my work (and I'm pissed off by that)". The premise is - in my reading - "Don't point the finger at me for writing bad software in my own free time, when you didn't even consider contributing to it and don't try to shift the blame when you have to face the consequences of yo…
my interpretation was a little different
I see the author annoyed that companies don't want to to be their patron to just pay them to work on random things that they have fun working on
and attempting to leverage this issue to try to draw attention to this "injustice"
as someone with a full time software job: I wish I could only work on things that interest me...
rather than spending 80% of my time working on boring things and dealing with customers who set deadlines and expect to receive a specific product that they're paying for
Re: “Open source” is broken
#90Earlier quoted context omitted.
Sure you can fix it, change the "log4j" in your dependency list to "wyldfire-fixed-log4j". You can't do that with closed source (either because you care about legalities, or because you have no way of obtaining a compilable and readable source code).
Until all hundreds of thousands of projects have changed that, it'll take time. That doesn't mention the fact you now also have to fork unmaintained projects relying on log4j to use the new version. If you're developing a major java projects, that's potentially thousands of dependencies you have to patch. I'm not suggesting that closed source is the solution, I'm saying the current system is not sustainable and neith…
Some package managers (eg yarn , cargo) have a solution for that and allow you to specify a local resolution override that will apply to all dependencies.