Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Professional maintainers: a wake-up call

blog.filippo.io

Post reply on HN
Print view View original

91–100 of 464 posts

Re: Professional maintainers: a wake-up call

#91

Post by jbk »

mfer wrote: post #84
jbk wrote: post #74

> Now is the perfect time for Open Source maintainers to become legible to the big companies that depend on them—and that want to get more out of them—and send them five-to-six figure invoices. Well, this is exactly what I've been doing around VideoLAN (VLC, x264) and FFmpeg for the last few years. In order to do that, I've created 2 official companies Videolabs and FFlabs (besides the non-profit orgs) and I've gone…

> So, large SV companies and startup should also start agreeing to pay for open source, when it's the core of the tech. Companies usually have a reason to keep their expenses low. Sometimes they are a public company with fiscal responsibilities. A startup will only have so much runway and is likely trying to reduce expenses. Given this situation, why will they pay for what they can get for free?

> Given this situation, why will they pay for what they can get for free?

See the article...

Re: Professional maintainers: a wake-up call

#92

Post by watwut »

jjoonathan wrote: post #28
finnh wrote: post #20

Earlier quoted context omitted.

Would more time or money prevented the log4j bug? If anything that strikes me as coming from too much time spent on overarchitecting something.

That's more an argument against old-school "no amount of architecture is ever enough" Java -- not so much an argument against the principle that engineer-time can fix bugs.

This bug was not consequence of not enough developers. And there will never be guaranteed "no security issue" situation. That level of certainly is simply too expensive.

Re: Professional maintainers: a wake-up call

#93

Post by jsiepkes »

taberiand wrote: post #76
finnh wrote: post #20

Earlier quoted context omitted.

Would more time or money prevented the log4j bug? If anything that strikes me as coming from too much time spent on overarchitecting something.

Money spent on dedicated testing might have discovered it earlier perhaps?

I don't really see how the Log4J2 issue would have been uncovered by testing. It's not really a bug but more of a design flaw.

The reason is that the whole JNDI string interpolation feature by itself opens a door to a whole world of layered complexity which you can't comprehend. And even if you could comprehend it all Java could add some feature to JNDI which introduces an issue which wasn't there when it was all tested.

Re: Professional maintainers: a wake-up call

#94

Post by jbk »

H8crilA wrote: post #81
jbk wrote: post #74

> Now is the perfect time for Open Source maintainers to become legible to the big companies that depend on them—and that want to get more out of them—and send them five-to-six figure invoices. Well, this is exactly what I've been doing around VideoLAN (VLC, x264) and FFmpeg for the last few years. In order to do that, I've created 2 official companies Videolabs and FFlabs (besides the non-profit orgs) and I've gone…

You need a proper "asshole" in such organizations that will go and threaten complete lack of support if the bill isn't paid. Of course there is a lot more detail in such negotiations, but the fact is that he/she will be facing similar "assholes" from the side of the copros. The entire thing is essentially just a game of standard capitalism. You have to know how to play that game, though. FFmpeg should be able to pull…

> You need a proper "asshole" in such organizations that will go and threaten complete lack of support if the bill isn't paid.

That's the point, they don't pay, and they don't get support. But they still complain when there is a major CVE.

> For comparison, $1M is the total yearly cost of ~3 average engineers at FAANGs.

I wish we got that...

Re: Professional maintainers: a wake-up call

#95

Post by simonw »

moksly wrote: post #48

The alternative to what we have now is not going to be a healthy OSS community. The alternative is going to be big companies insourcing more of their libraries. The only reason why OSS has seen the up-pick it has is because major companies profit from it. Microsoft didn’t embrace open source because it had a change or morals, it embraced open source because it started making so much more money from enterprise orgs sw…

"Your tech stack isn’t actually in danger if you review that code you use."

Tell that to everyone who depended on Log4j for the past 8 years!

Re: Professional maintainers: a wake-up call

#96

Post by bogwog »

Everyone does open source work for different reasons, and I'm not sure if more money is always enough of a motivator. I have a handful of projects that you couldn't pay me to provide commercial support for because I no longer have any interest in them. Working on boring projects for money is what full-time jobs are for (and most full-time eng jobs are much easier than maintaining a popular open source project).

With that said, I could totally see how paid OSS work as the norm would be a catalyst to improving the status quo. It would certainly lead to more and better OSS projects. Even if the current OSS ecosystem doesn't like it, it will 100% lead to new projects and new devs pursuing the money.

Maybe part of the solution is to form agencies which work with OSS devs to pursue contracts/sponsorships/donations from commercial users of their projects? The legal/business/sales part of the process is non-trivial. This makes me think of "content creators" on social media that make a ton of money producing free videos/streams. OSS devs are maybe like the B2B version of that? :P

Re: Professional maintainers: a wake-up call

#98

Post by bdcravens »

jbk wrote: post #74

> Now is the perfect time for Open Source maintainers to become legible to the big companies that depend on them—and that want to get more out of them—and send them five-to-six figure invoices. Well, this is exactly what I've been doing around VideoLAN (VLC, x264) and FFmpeg for the last few years. In order to do that, I've created 2 official companies Videolabs and FFlabs (besides the non-profit orgs) and I've gone…

Would following an open core model work better, like it has for Hashicorp, Sidekiq, Tailwind, etc? Also, would focusing more on the low 4 figures result in more revenue? I feel the crowd sensitive to open source has that kind of spending authority, but once you get into the enterprise amounts, it's out of our reach to effect change.

Re: Professional maintainers: a wake-up call

#99

Post by skinkestek »

mfer wrote: post #84
jbk wrote: post #74

> Now is the perfect time for Open Source maintainers to become legible to the big companies that depend on them—and that want to get more out of them—and send them five-to-six figure invoices. Well, this is exactly what I've been doing around VideoLAN (VLC, x264) and FFmpeg for the last few years. In order to do that, I've created 2 official companies Videolabs and FFlabs (besides the non-profit orgs) and I've gone…

> So, large SV companies and startup should also start agreeing to pay for open source, when it's the core of the tech. Companies usually have a reason to keep their expenses low. Sometimes they are a public company with fiscal responsibilities. A startup will only have so much runway and is likely trying to reduce expenses. Given this situation, why will they pay for what they can get for free?

> Sometimes they are a public company with fiscal responsibilities.

Public companies also have accounts for goodwill in their books, don't they?

Also, I'd even say that depending on volunteers for everything when you aren't in dire straits isn't to responsible.

Re: Professional maintainers: a wake-up call

#100

Post by foothall »

geerlingguy wrote: post #38

No thanks. Maintaining business relationships with $megacorp is one of the primary reasons OSS maintainers (maybe just speaking for myself, but I don't think so) do their OSS work, and don't develop proprietary software and market and sell it around a business venture. If you start writing up contracts or accepting direct payments with any strings attached at all, the dynamic is completely changed.

+1.

This can lead to corporate capture. We see this in some projects already.

Post reply on HN