111–120 of 464 posts
Earlier quoted context omitted.
Would more time or money prevented the log4j bug? If anything that strikes me as coming from too much time spent on overarchitecting something.
Money spent on dedicated testing might have discovered it earlier perhaps?
Earlier quoted context omitted.
You need a proper "asshole" in such organizations that will go and threaten complete lack of support if the bill isn't paid. Of course there is a lot more detail in such negotiations, but the fact is that he/she will be facing similar "assholes" from the side of the copros. The entire thing is essentially just a game of standard capitalism. You have to know how to play that game, though. FFmpeg should be able to pull…
> You need a proper "asshole" in such organizations that will go and threaten complete lack of support if the bill isn't paid. That's the point, they don't pay, and they don't get support. But they still complain when there is a major CVE. > For comparison, $1M is the total yearly cost of ~3 average engineers at FAANGs. I wish we got that...
[1]: From what I've seen this ~50% number seems to be pretty close to the mark across virtually all industries and jobs. I.e. it's pretty safe to assume that the total cost to your employer to retain you is around double your take home pay.
Earlier quoted context omitted.
You need a proper "asshole" in such organizations that will go and threaten complete lack of support if the bill isn't paid. Of course there is a lot more detail in such negotiations, but the fact is that he/she will be facing similar "assholes" from the side of the copros. The entire thing is essentially just a game of standard capitalism. You have to know how to play that game, though. FFmpeg should be able to pull…
> You need a proper "asshole" in such organizations that will go and threaten complete lack of support if the bill isn't paid. That's the point, they don't pay, and they don't get support. But they still complain when there is a major CVE. > For comparison, $1M is the total yearly cost of ~3 average engineers at FAANGs. I wish we got that...
Once upon a time, the best way to get a software job was to demonstrate your ability to build useful open source projects. 10 years ago the Principal Engineers I would work with had super sized open source portfolio's which leant them both credibility and experience building products people liked. Junior devs would search (sometimes in vain) for issues where they could contribute a few PRs Now the best way to get a j…
I don't know if that is objectively true. There are numerous small companies who will leetcode every candidate. Then there are Google and Microsoft and the other bigs who hire thousands of people every week, where the best way to get hired is to have a Ph.D and get referred by insiders. Mediocre candidates getting leetcoded by mediocre companies may be a highly visible pattern but on industry scale I am not convinced…
> Now is the perfect time for Open Source maintainers to become legible to the big companies that depend on them—and that want to get more out of them—and send them five-to-six figure invoices. Well, this is exactly what I've been doing around VideoLAN (VLC, x264) and FFmpeg for the last few years. In order to do that, I've created 2 official companies Videolabs and FFlabs (besides the non-profit orgs) and I've gone…
Would following an open core model work better, like it has for Hashicorp, Sidekiq, Tailwind, etc? Also, would focusing more on the low 4 figures result in more revenue? I feel the crowd sensitive to open source has that kind of spending authority, but once you get into the enterprise amounts, it's out of our reach to effect change.
> Now is the perfect time for Open Source maintainers to become legible to the big companies that depend on them—and that want to get more out of them—and send them five-to-six figure invoices. Well, this is exactly what I've been doing around VideoLAN (VLC, x264) and FFmpeg for the last few years. In order to do that, I've created 2 official companies Videolabs and FFlabs (besides the non-profit orgs) and I've gone…
Would following an open core model work better, like it has for Hashicorp, Sidekiq, Tailwind, etc? Also, would focusing more on the low 4 figures result in more revenue? I feel the crowd sensitive to open source has that kind of spending authority, but once you get into the enterprise amounts, it's out of our reach to effect change.
Yes, I think this might be a better model, indeed.
But I did not start either of those projects, I came on board later; and those models are difficult to back-fit into an existing project.
Earlier quoted context omitted.
> So, large SV companies and startup should also start agreeing to pay for open source, when it's the core of the tech. Companies usually have a reason to keep their expenses low. Sometimes they are a public company with fiscal responsibilities. A startup will only have so much runway and is likely trying to reduce expenses. Given this situation, why will they pay for what they can get for free?
> Sometimes they are a public company with fiscal responsibilities. Public companies also have accounts for goodwill in their books, don't they? Also, I'd even say that depending on volunteers for everything when you aren't in dire straits isn't to responsible.
Goodwill in that context is towards the company, an intangible asset comprising the value in its brand etc.
Everything stated about the risks and current deficiencies is true. Meanwhile the OP works for Google on OSS, one of the "untenable" approaches to funding it that is lamented. Nothing else presented is close to an alternative solution; there's no "ask" that would fix the situation, let alone an attempt to lead by example, so what's the point of this post?
In what way is this not an ask?
Once upon a time, the best way to get a software job was to demonstrate your ability to build useful open source projects. 10 years ago the Principal Engineers I would work with had super sized open source portfolio's which leant them both credibility and experience building products people liked. Junior devs would search (sometimes in vain) for issues where they could contribute a few PRs Now the best way to get a j…
Not only does it feel like I'm stolen value, open source work tends to be the most interesting, and as more and more is done and offered for free, my work becomes less and less interesting, and the job becomes more about connecting and configuring all these open source systems together.
Needing to contribute free work in open source before getting a job therefore sounds like the biggest of scams to me.
Earlier quoted context omitted.
> So, large SV companies and startup should also start agreeing to pay for open source, when it's the core of the tech. Companies usually have a reason to keep their expenses low. Sometimes they are a public company with fiscal responsibilities. A startup will only have so much runway and is likely trying to reduce expenses. Given this situation, why will they pay for what they can get for free?
It seems like you haven't quite got the concept of open source. If everybody consumes and nobody contributes, how long will that last? A while back I bought a cheap robot vacuum. Their scheduling feature didn't meet my needs, so I reverse-engineered the protocol and open-sourced a cron-friendly CLI tool and a library so people could do other things with it: https://github.com/wpietri/sucks Honestly, this was a mistak…
I think that's a pretty unfair characterization of the previous post.