Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Open source” is broken

christine.website

Post reply on HN
Print view View original

91–100 of 357 posts

Re: “Open source” is broken

#91

Post by CuriousCosmic »

zaarn wrote: post #82
CuriousCosmic wrote: post #78

Earlier quoted context omitted.

Strictly speaking in the Java space that's a perfectly reasonable assumption. It's a bit more work but you can just substitute the jar/modules for log4j following the build with the patched versions. At the end of the day it is just a bunch of class files in jars/zips which makes patching a lot easier.

Hot patching a jar is not a scalable solution in the long term, especially if you're considering that in a larger project there may be multiple unmaintained projects that now need permanent hotpatching.

At least with gradle you can easily add some logic to the buildscript to substitute all instances of a specific dependency for a java library/application with a fork.

It's only a handful of lines of code and it is technically a bit hacky but it's really no worse than any of the other jank you are forced to do when building any moderate to complex gradle based java project.

Re: “Open source” is broken

#92

Post by zaarn »

the_duke wrote: post #90
zaarn wrote: post #80

Earlier quoted context omitted.

Until all hundreds of thousands of projects have changed that, it'll take time. That doesn't mention the fact you now also have to fork unmaintained projects relying on log4j to use the new version. If you're developing a major java projects, that's potentially thousands of dependencies you have to patch. I'm not suggesting that closed source is the solution, I'm saying the current system is not sustainable and neith…

Some package managers (eg yarn , cargo) have a solution for that and allow you to specify a local resolution override that will apply to all dependencies.

But again, that means EVERY single product, open source or not, will have to patch their deployment to use the fork instead of simply using the updated version of upstream. Permanently no less if it's unmaintained.

Meaning every single Java product would have to include that "if you want to use log4j, you have to include this patch line to use a fork, because of unmaintained dependencies".

That just ossifies log4j and fixes nothing. Patching dependencies in Cargo is not meant to permanently replace code, it's to be used while you're waiting for an upstream merge.

Re: “Open source” is broken

#93

Post by ecnahc515 »

zaarn wrote: post #82
CuriousCosmic wrote: post #78

Earlier quoted context omitted.

Strictly speaking in the Java space that's a perfectly reasonable assumption. It's a bit more work but you can just substitute the jar/modules for log4j following the build with the patched versions. At the end of the day it is just a bunch of class files in jars/zips which makes patching a lot easier.

Hot patching a jar is not a scalable solution in the long term, especially if you're considering that in a larger project there may be multiple unmaintained projects that now need permanent hotpatching.

As others mentioned, for any companies relying on this software, that's their problem, and it's nothing more funding and resourcing can't solve.

Re: “Open source” is broken

#94

Post by anxrn »

A tool that inspects a company's software dependencies and generates a report of open source dependencies, state of support, and easy ways to fund (direct corporate funding, or even employee + corporate match) would be super useful.

Re: “Open source” is broken

#95

Post by jevoten »

xena wrote: post #3

I'm the author of the post in case you have any questions for me.

> This is why I am very careful about how I make "useful" software and release it to the world without any solid way for me to get paid for my efforts. I simply do not want to be in a situation where my software that I develop as a passion project on the side is holding people's companies together.

Isn't this the best position to be in if you want to get paid? "You've built your company on top of my project and now you need this bug fix/feature yesterday? My hourly rate is $$$"

Re: “Open source” is broken

#96

Post by [deleted] »

the_duke wrote: post #90
zaarn wrote: post #80

Earlier quoted context omitted.

Until all hundreds of thousands of projects have changed that, it'll take time. That doesn't mention the fact you now also have to fork unmaintained projects relying on log4j to use the new version. If you're developing a major java projects, that's potentially thousands of dependencies you have to patch. I'm not suggesting that closed source is the solution, I'm saying the current system is not sustainable and neith…

Some package managers (eg yarn , cargo) have a solution for that and allow you to specify a local resolution override that will apply to all dependencies.

[deleted]

Re: “Open source” is broken

#97

Post by blibble »

zaarn wrote: post #43
wyldfire wrote: post #26

> I simply do not want to be in a situation where my software that I develop as a passion project on the side is holding people's companies together. People love to hate on Richard Stallman but he was really clear about the motivation for Free Software (which is not the same as Open Source but shares some tenets). What companies do with the source is their thing. They get all of the benefits and all of the responsibi…

Except you can't because hundreds of thousands of project have "log4j" in their dependency list not "wyldfire-fixed-log4j". If log4j broke and there was no maintainer, a fork would not fix things.

the documentation also needs to include the 5 line dependency exclusion that you place in your pom to exclude the bad version

Re: “Open source” is broken

#98

Post by mborch »

The problem is that many projects (open or closed source) don't respect the exponential cost in bringing in a new dependency, i.e. code that's not under your own management.

Bringing in a shitty old bloated logging library with functionality you don't need or want compounds the interest even more.

Re: “Open source” is broken

#100

Post by gweinberg »

The strange thing to my mind is not that people will use things for free given a chance, because of course they will, but rather the developers of popular open source packages are having trouble getting jobs. Back when I was a CTO, if any of my applicants could claim to be developers / maintainers of popular open source projects, I would consider that to be a major plus. Wouldn't everyone?
Post reply on HN