Why pay for something that's being offered for free?
I know that there are many good reasons to support valuable open source projects with money. But you can also _not_.
“Open source” is broken
111–120 of 357 posts
Re: “Open source” is broken
#112Earlier quoted context omitted.
Except you can't because hundreds of thousands of project have "log4j" in their dependency list not "wyldfire-fixed-log4j". If log4j broke and there was no maintainer, a fork would not fix things.
Code doesn't just "break". It still works the same. If a vulnerability is discovered you either update the package or switch to a fork. Switching is not really that much extra work compared to updating. This issue has really nothing to do with open source except that you have the extra option of forking.
I argue that if your code gets assigned a 10/10 Severity CVE, then it broke, even if nothing changed. It just broke a while ago.
Switching one library is not much work. But if it becomes the standard approach then the first time you fire up your java project you either spent 30 minutes to put in all the exclusions to provide your favorite forks of dead projects or your pom.xml will already be 5KB large on generation just for those exclusions and patches.
Re: “Open source” is broken
#113The strange thing to my mind is not that people will use things for free given a chance, because of course they will, but rather the developers of popular open source packages are having trouble getting jobs. Back when I was a CTO, if any of my applicants could claim to be developers / maintainers of popular open source projects, I would consider that to be a major plus. Wouldn't everyone?
If you think of the world as a giant corporation, in the short term it's more efficient if these workaholics are not paid at all. Think of a typical workaholic who's always happy to do more and take on more responsibility - why would you increase their salary if they don't ask for it?
Re: “Open source” is broken
#114Earlier quoted context omitted.
Hot patching a jar is not a scalable solution in the long term, especially if you're considering that in a larger project there may be multiple unmaintained projects that now need permanent hotpatching.
At least with gradle you can easily add some logic to the buildscript to substitute all instances of a specific dependency for a java library/application with a fork. It's only a handful of lines of code and it is technically a bit hacky but it's really no worse than any of the other jank you are forced to do when building any moderate to complex gradle based java project.
And when another library is unmaintained and breaks, you add those few lines again. And again and again and again, until your gradle file is 90% hotpatching your dependencies.
Re: “Open source” is broken
#115If I had a nickel for every time I've seen an article claiming "open source is broken", I'd have enough nickels to live on for some time. The other side is that everything else is broken, too. How much should you really trust a package that you cannot audit and that is maintained by an unknown group of people with unknown skills who are also subject to the whims of quarterly earnings reports? Oh, and you'll never hea…
Can you really trust those average 3 engineers you work with to build any sort of complex piece of software more reliably just to get started with the project you're actually building?
Re: “Open source” is broken
#116Earlier quoted context omitted.
Hot patching a jar is not a scalable solution in the long term, especially if you're considering that in a larger project there may be multiple unmaintained projects that now need permanent hotpatching.
As others mentioned, for any companies relying on this software, that's their problem, and it's nothing more funding and resourcing can't solve.
This isn't only about companies, people who develop open source software on their own are just as affected by log4j. Funding and resourcing can at least help people and maybe incentive handing the project to someone else.
Re: “Open source” is broken
#117Earlier quoted context omitted.
But again, that means EVERY single product, open source or not, will have to patch their deployment to use the fork instead of simply using the updated version of upstream. Permanently no less if it's unmaintained. Meaning every single Java product would have to include that "if you want to use log4j, you have to include this patch line to use a fork, because of unmaintained dependencies". That just ossifies log4j an…
You can fix it for your own applications and libraries. The tooling exists. You can't force other people to use your fork.
Correct, all those other people will have to manually find some fork or make their own, repeating the same work thousands of times and ossifying that some part of your java build system now permanently includes a section to patch log4j dependencies.
Re: “Open source” is broken
#118[deleted]
Re: “Open source” is broken
#119I'd also imagine someone who lost their shirt in the stock market (or crypto) might get whiny and complain "Math is broken."
Open source is just a process. It never promised you anything.
Either way, this is why, even if annoying, the concept of "Free Software" is a better one. Its goal may not be perfect -- but at least it has one.
Re: “Open source” is broken
#120I don't think it's that big of a deal honestly. If some guy in Nebraska maintains some library that is very useful and your company relies on it and does not pay him, you're asking to wind up relying on an unmaintained project eventually. If I maintained something extremely valuable and found out a core google product relied on it, I'd stop maintaining it.
You say that as if you even know your full dependency chain. Reality doesn't quite work that way. No one knew their codebase even relied on leftpad until it broke millions of applications the world over when it got pulled. Some projects have the benefit of notoriety (log4j falls in that category) but plenty of projects are just "plumbing" and the only thing you know is the name of the dependencies you have in your de…
[deleted]