Professional maintainers: a wake-up call • Hacker News Board

Re: Professional maintainers: a wake-up call

#101

Post by WJW » Sat, Dec 11, 2021, 8:59 PM UTC

kam wrote: post #86

WJW wrote: post #61

Earlier quoted context omitted.

Not to mention that the dynamic would completely shift in terms of community contributions. If I submit a patch to a free project where the maintainers make nothing, I wouldn't even think of asking for anything in return (even if it is a project used by bigcorps, such as Redis or GHC). If I know that the maintainers get paid a full salary for maintaining the software, it becomes a much weirder thing to send them bugf…

"Sending them bugfixes for free" is both a benefit and a burden to an open source project. It takes maintainer time and effort to review the fix, test, make releases, etc, and that's a thankless job. When a company pushes their patches upstream, they're gaining a benefit for themselves (avoiding maintaining a fork), and potentially benefiting any other users who might be affected by the bug or want the same feature.…

Fair enough, but I didn't mean sending in bugfixes because I need it for my employer, I meant sending in bugfixes (or features) to a project that I wanted to make because it bothered me. For example, some time ago I sent in a patch to use better data structures in an event loop library that I think is cool but otherwise don't use.

Should OSS devs optimize for my (probably quite rare) use case? Probably not, but the feeling when making a patch for something that I like is still different when the maintainer runs it as a business compared to when they run it as a hobby.

(This is what the whole discussion seems to be about btw. Some people like to program in their free time as a hobby and other people would REALLY like guarantees about the software that cannot be made without losing the essential hobby-ness of it)

Re: Professional maintainers: a wake-up call

#102

Post by rgrmrts » Sat, Dec 11, 2021, 9:03 PM UTC

qnsi wrote: post #51

Can someone help me find whos idea was it? Basically kill free open source. Make every "new open source" (NOS) program dual licensed, free for non commercial use and paid for conmercial use. He proposed companies paying 1% of revenue to license this software. But it would all go through a proxy company that would gather payment and send it to participating companies, I dont remember how it would be split. I think thi…

Doesn’t answer your question but something I’ve wondered about as well. I don’t maintain any open source software (yet?) but if I were to start a project I’d likely use a permissive license.

I don’t want to start a philosophical flame war about licenses, but this idea makes sense to me. The details will likely take work to iron out, but why not have open source licenses with a clause for companies with over a certain amount of annual net profit. Does anyone have examples of this in practice? As far as I know, licensing models like Mongo or Elasticsearch are a bit more binary.

I’d be fine letting individuals, small businesses, and startups use the software for free in perpetuity unless they hit some metric like “greater than $x in annual profit” or whatever. I guess a counterpoint to this might just be that companies that get to that scale would just develop the same thing in-house instead.

Re: Professional maintainers: a wake-up call

#103

Post by fatcat500 » Sat, Dec 11, 2021, 9:03 PM UTC

If there was a button on Github that donated small amounts of money to the maintainer(s) of a project, I would press it frequently for many libraries I depend on.

For example, donating 25 or 50 cents every time I visit gofiber/fiber would be fine with me.

However, there is no way to feasibly charge small quantities of money without the majority of it getting raked in processing fees. For example, Stripe charges 30 cents plus 2.9 percent (last I checked), meaning only ~20 cents would make it to the maintainer(s).

The same issue exists with rewarding content creators. You either donate a non-trivial amount of money (often recurring) like $10 a month (which means you have to keep track of that expense, which is arguably an even greater disincentive for donating), or you don't donate at all.

Re: Professional maintainers: a wake-up call

#104

Post by bogwog » Sat, Dec 11, 2021, 9:03 PM UTC

jbk wrote: post #94

H8crilA wrote: post #81

Earlier quoted context omitted.

You need a proper "asshole" in such organizations that will go and threaten complete lack of support if the bill isn't paid. Of course there is a lot more detail in such negotiations, but the fact is that he/she will be facing similar "assholes" from the side of the copros. The entire thing is essentially just a game of standard capitalism. You have to know how to play that game, though. FFmpeg should be able to pull…

> You need a proper "asshole" in such organizations that will go and threaten complete lack of support if the bill isn't paid. That's the point, they don't pay, and they don't get support. But they still complain when there is a major CVE. > For comparison, $1M is the total yearly cost of ~3 average engineers at FAANGs. I wish we got that...

1) Create a funding report newsletter for FFMPEG

2) When funding is low, big scary exclamation marks all over the place

3) Include a bulleted list of doomsday scenarios showing what could happen to YOU if a bug/vulnerability is found

4) Add a picture of a sad kitten or crying baby for good measure

Now just subscribe all of the non-tech business people at organizations that use FFMPEG, and wait for them to panic. (Make sure that they need to call you to unsubscribe from the newsletter, especially if they work at the New York Times)

Re: Professional maintainers: a wake-up call

#105

Post by rubyist5eva » Sat, Dec 11, 2021, 9:04 PM UTC

It's a double edge sword. They can you use your stuff AS-IS WITHOUT WARRANTY, but if something goes wrong it is AS-IS WITHOUT WARRANTY.

We've gotten complacent that open source just exists and is maintained and it's sunshine and rainbows. We've been able to build amazing things on the backs of these maintainers, but you have to factor in that they don't owe you anything. So keep that in mind when you're just gonna install some random library from the public package repository because "not invented here" or something.

Re: Professional maintainers: a wake-up call

#106

Post by pdonis » Sat, Dec 11, 2021, 9:06 PM UTC

daenz wrote: post #26

I'm an open source author and maintainer of a somewhat-popular python package[0] (~1M downloads/month) that I've maintained for over 10 years. I don't recall ever receiving a donation. I am still maintaining it, but I just don't have time to add the improvements that it needs to keep up with the ecosystem (asyncio, for example). If organizations who use it got together and chipped in some non-negligible amount, I wou…

> organizations who use it

Do you know which organizations these are?

Re: Professional maintainers: a wake-up call

#107

Post by wpietri » Sat, Dec 11, 2021, 9:07 PM UTC

mfer wrote: post #84

jbk wrote: post #74

> Now is the perfect time for Open Source maintainers to become legible to the big companies that depend on them—and that want to get more out of them—and send them five-to-six figure invoices. Well, this is exactly what I've been doing around VideoLAN (VLC, x264) and FFmpeg for the last few years. In order to do that, I've created 2 official companies Videolabs and FFlabs (besides the non-profit orgs) and I've gone…

> So, large SV companies and startup should also start agreeing to pay for open source, when it's the core of the tech. Companies usually have a reason to keep their expenses low. Sometimes they are a public company with fiscal responsibilities. A startup will only have so much runway and is likely trying to reduce expenses. Given this situation, why will they pay for what they can get for free?

It seems like you haven't quite got the concept of open source. If everybody consumes and nobody contributes, how long will that last?

A while back I bought a cheap robot vacuum. Their scheduling feature didn't meet my needs, so I reverse-engineered the protocol and open-sourced a cron-friendly CLI tool and a library so people could do other things with it: https://github.com/wpietri/sucks

Honestly, this was a mistake on my part. It was a demanding audience of home-automation hobbyists mostly without programming skills. The company was thoroughly unhelpful. When my vacuum finally broke, I was relieved, as I had a good excuse for trying to hand off the project. Nobody stepped up, so I shut it down. I just ran out of interest in doing free work to support a company worth billions.

I really admire the community spirit of open source But it's not sustainable if companies making their money off it keep depending on the niceness and generosity of others without giving back enough to keep them happy, healthy, productive people.

Re: Professional maintainers: a wake-up call

#108

Post by kazinator » Sat, Dec 11, 2021, 9:08 PM UTC

This is completely wrongheaded.

The people responsible for the logging library security are 100% the people who decided to integrate that piece, not some open source person who provides a patch and his three sponsors.

The Log4j library has a LICENSE.txt with clauses "7. Disclaimer of Warranty." and "8. Limitation of Liability."

The wake up call is that programmers should take responsibility for everything that they integrate, including all that they recursively integrate. If you put it in the image, it's your fault.

Re: Professional maintainers: a wake-up call

#109

Post by watwut » Sat, Dec 11, 2021, 9:09 PM UTC

skinkestek wrote: post #99

mfer wrote: post #84

Earlier quoted context omitted.

> So, large SV companies and startup should also start agreeing to pay for open source, when it's the core of the tech. Companies usually have a reason to keep their expenses low. Sometimes they are a public company with fiscal responsibilities. A startup will only have so much runway and is likely trying to reduce expenses. Given this situation, why will they pay for what they can get for free?

> Sometimes they are a public company with fiscal responsibilities. Public companies also have accounts for goodwill in their books, don't they? Also, I'd even say that depending on volunteers for everything when you aren't in dire straits isn't to responsible.

No, the companies are supposed to generate value for shareholders. They are supposed to have infinite financial growth and that is pretty much it.

Re: Professional maintainers: a wake-up call

#110

Post by kazinator » Sat, Dec 11, 2021, 9:09 PM UTC

jbk wrote: post #74

> Now is the perfect time for Open Source maintainers to become legible to the big companies that depend on them—and that want to get more out of them—and send them five-to-six figure invoices. Well, this is exactly what I've been doing around VideoLAN (VLC, x264) and FFmpeg for the last few years. In order to do that, I've created 2 official companies Videolabs and FFlabs (besides the non-profit orgs) and I've gone…

Throwing money at some outside parties will not ensure that your in-house developers aren't carelessly in including snippets of code from the wild into your product.