Professional maintainers: a wake-up call • Hacker News Board

Re: Professional maintainers: a wake-up call

#71

Post by F6F6FA » Sat, Dec 11, 2021, 8:41 PM UTC

indymike wrote: post #66

F6F6FA wrote: post #54

I feel this is a problem of companies being cheapskates, not of OSS maintainers. So do not make it their problem. I do not make OSS for companies, but for enthusiasts, contributing to building cool stuff, students and researchers. Don't really want a commercialization of OSS maintainers. Does not seem in the spirit of OSS, but a convoluted way to contract a single dev to work on your stack. If you are this big compan…

> I feel this is a problem of companies being cheapskates, not of OSS maintainers. So do not make it their problem. I do not make OSS for companies, but for enthusiasts, contributing to building cool stuff, students and researchers. I'm starting to do something different at my company. I'm finding the package maintainers for the non-commercial stuff we use in our product and making a donation. I'm also going to start…

If this becomes a cultural thing, part of OSS, then more employees inside big companies will start to advocate for funding the OSS they rely on. Companies found to be profiting of OSS, while keeping a closed wall, complaining, but not contributing patches or funding, will lose market mind share, and a percentage of the best developers.

Seems doable, but still hard without centralized control and PR.

Re: Professional maintainers: a wake-up call

#72

Post by rightbyte » Sat, Dec 11, 2021, 8:42 PM UTC

jedberg wrote: post #43

When I worked at eBay, our policy was that we had to use RedHat and that any open source we used had to be provided by RedHat or we had to get a support contract from someone else who would be willing to 1)Support the software and 2)Accept legal liability if it failed. #2 was the big sticking point. RedHat made a lot of money accepting that legal responsibility, but very few others were willing to do so. It made usin…

Heh ... I recall somewhere in a Emacs manual it says "prints the non-warranty, or the warranty if you version of Emacs comes with one".

I thought that was a joke. What did the warranty disclaimers say on your system?

Re: Professional maintainers: a wake-up call

#73

Post by baskethead » Sat, Dec 11, 2021, 8:42 PM UTC

If the US government had any sense of strategy, they would employ these maintainers en masse, not only to create good will but to make sure that other bad actors don’t get to them first.

Re: Professional maintainers: a wake-up call

#74

Post by jbk » Sat, Dec 11, 2021, 8:42 PM UTC

> Now is the perfect time for Open Source maintainers to become legible to the big companies that depend on them—and that want to get more out of them—and send them five-to-six figure invoices.

Well, this is exactly what I've been doing around VideoLAN (VLC, x264) and FFmpeg for the last few years. In order to do that, I've created 2 official companies Videolabs and FFlabs (besides the non-profit orgs) and I've gone through all the hoops to get paid (PO, billing, invoices, registering to large companies is a lot of paperwork, tbh, but well..) and we try and bill small to large companies that depends on those projects.

And FFmpeg and x264 are the core of the online video.

So I did exactly what Filippo is saying we should do.

But the result is really not impressive. Seriously, asking for money for support from those companies feels like we're pulling the nails, even if their full business depends on it. Getting 30-50k$ from those companies for support for one year can be very challenging, long or leading to nowhere at all.

So, large SV companies and startup should also start agreeing to pay for open source, when it's the core of the tech.

Re: Professional maintainers: a wake-up call

#75

Post by [deleted] » Sat, Dec 11, 2021, 8:45 PM UTC

[deleted]

Re: Professional maintainers: a wake-up call

#76

Post by taberiand » Sat, Dec 11, 2021, 8:45 PM UTC

finnh wrote: post #20

jjoonathan wrote: post #6

Earlier quoted context omitted.

"Being considerate" and "accepting" can't fix bugs. Time and money can fix bugs. We need to get these projects more time and more money.

Would more time or money prevented the log4j bug? If anything that strikes me as coming from too much time spent on overarchitecting something.

Money spent on dedicated testing might have discovered it earlier perhaps?

Re: Professional maintainers: a wake-up call

#77

Post by gumby » Sat, Dec 11, 2021, 8:46 PM UTC

daenz wrote: post #53

javajosh wrote: post #49

Earlier quoted context omitted.

First, I don't use it, but thanks. (I know, being a maintainer is a thankless job, but I'm a rebel.) Second, the OP addresses this issue directly. He's talking about "making OSS maintenance legible " (emphasis mine) to BigCorps via 5-6 figure invoices "on letterhead". It's a grand idea, and I hope it works. The path to not working is too achingly obvious though. Budgets are always tight (even if you're Apple and you…

If I could figure out for certain which big companies were using my software, I might try the invoice idea for fun. I expect it would be ignored, but I would send it anyways to prove the idea one way or the other.

Big companies don't just pay random invoices;* you need to indicate what project and account (usually IDs from their CRM). So it would merely be chucked out.

* In really big companies it's possible for admins to buy routine stuff below a threshold just to save on paperwork. So there's a scam in which someone sends out a bunch of $100 invoices for "printer paper" -- account payable assumes the department code was left off by the vendor but it seems legit so they pay it. Seems like a hard way to collect money.

Re: Professional maintainers: a wake-up call

#78

Post by f311a » Sat, Dec 11, 2021, 8:47 PM UTC

didibus wrote: post #12

I feel like the examples of log4j and ua-parser aren't that great, because it would be relatively easy for any other similar lib to take their place, as it's mostly straightforward to implement, even though it still takes time. But there are some things like Kafka, PostgressSQL, Spring Boot, Tomcat, Apache Math, ZooKeeper, the OpenJDK, and all that which are definitely non-trivial and a huge amount of time and effort…

There are some maintainers for Postgresql that get paid. It’s a part of their job in consulting companies (they specialize in postgresql). Not sure about the other projects though.

Re: Professional maintainers: a wake-up call

#79

Post by josteink » Sat, Dec 11, 2021, 8:47 PM UTC

daenz wrote: post #53

javajosh wrote: post #49

Earlier quoted context omitted.

First, I don't use it, but thanks. (I know, being a maintainer is a thankless job, but I'm a rebel.) Second, the OP addresses this issue directly. He's talking about "making OSS maintenance legible " (emphasis mine) to BigCorps via 5-6 figure invoices "on letterhead". It's a grand idea, and I hope it works. The path to not working is too achingly obvious though. Budgets are always tight (even if you're Apple and you…

If I could figure out for certain which big companies were using my software, I might try the invoice idea for fun. I expect it would be ignored, but I would send it anyways to prove the idea one way or the other.

If you hosted the package/library yourself instead of in closed silos/package repos, you could directly check the IPs of whoever regularly pulls your stuff.

We all opted for centralized package repos though, so now only they know. And they’re not telling us.

Just another “free” opportunity lost to centralization, I guess.

Re: Professional maintainers: a wake-up call

#80

Post by tomxor » Sat, Dec 11, 2021, 8:48 PM UTC

er4hn wrote: post #46

tomxor wrote: post #2

Unpopular opinion: Maybe there is nothing wrong with the "status quo", maybe we don't need yet another attempt to finance small FOSS projects where it's hard to explain how money will actually solve any of these issues. Maybe people just need to be more considerate of what they depend upon. And in the case that a popular yet well maintained project has a CVE on day, maybe we need to accept that popularity does not ma…

I would say that this is different from "hard to explain". What is being proposed is essentially "OSS with a paid model for premium support / feature development." It shifts the language from "donations", which companies don't understand, to "consulting", which companies do understand. It's not completely novel, projects such as openssl and sqlite do offer paid consulting, but it's not normalized among companies to p…

> OSS with a paid model for premium support / feature development.

Adding features do not reduce likelihood of bugs, if anything the opposite.

It's very difficult to come up with a paid model that specifically encourages a preventative strategy towards bugs and security flaws. Currently the best we have is getting people who care about those things to build software.