Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Open source” is broken

christine.website

Post reply on HN
Print view View original

121–130 of 357 posts

Re: “Open source” is broken

#121

Post by kristjansson »

zaarn wrote: post #92
the_duke wrote: post #90

Earlier quoted context omitted.

Some package managers (eg yarn , cargo) have a solution for that and allow you to specify a local resolution override that will apply to all dependencies.

But again, that means EVERY single product, open source or not, will have to patch their deployment to use the fork instead of simply using the updated version of upstream. Permanently no less if it's unmaintained. Meaning every single Java product would have to include that "if you want to use log4j, you have to include this patch line to use a fork, because of unmaintained dependencies". That just ossifies log4j an…

Does it matter that other products don’t patch something that yours does? Like, sure, it’s unsatisfying from an ecosystem perspective, and one would hope for fixes to be incorporated upstream. But if they aren’t, who cares if other products are broken after you’ve patched the ones you’re responsible for?

Re: “Open source” is broken

#122

Post by zaarn »

kristjansson wrote: post #121
zaarn wrote: post #92

Earlier quoted context omitted.

But again, that means EVERY single product, open source or not, will have to patch their deployment to use the fork instead of simply using the updated version of upstream. Permanently no less if it's unmaintained. Meaning every single Java product would have to include that "if you want to use log4j, you have to include this patch line to use a fork, because of unmaintained dependencies". That just ossifies log4j an…

Does it matter that other products don’t patch something that yours does? Like, sure, it’s unsatisfying from an ecosystem perspective, and one would hope for fixes to be incorporated upstream. But if they aren’t, who cares if other products are broken after you’ve patched the ones you’re responsible for?

It does because now I pull in a dependency that indirectly relies on log4j instead of my favorite fork of log4j and I end up having the same CVE in the project anyway. Yes this needs to work ecosystem wide, otherwise you have fixed nothing at all.

Re: “Open source” is broken

#123

Post by KennyBlanken »

ralph84 wrote: post #88
kelnos wrote: post #25

Open source isn't broken. The software will continue to get built regardless of funding levels, clearly. But when vulnerabilities like this are found, no one -- especially corporate users -- gets to complain. Any complainers should be immediately told to fund the software they use, or shut their entitled mouths. Open source is fine. The culture of companies -- nearly all of them, including the one I work for -- that…

> no one -- especially corporate users -- gets to complain Do corporate users of open source really do all that much complaining without contributing? IME the people with the biggest complaint/contribution ratio in open source projects are individual devs (or trolls) who are not participating as a representative of any company.

In the case of core-js the issue isn't that "nobody is contributing", the issue is that there is one guy with commit authority and he's an asshole who reportedly spends most of his days rejecting PRs from people he doesn't like.

IBM, Oracle, Apple, Microsoft could submit all the PRs in the world and it won't do any good if he says "I don't like your coding style" or "this takes core-js in a direction I don't like."

Or he ends up in jail. I thought the author was joking about him going to jail for killing two pedestrians. They were not: https://www.theregister.com/2020/03/26/corejs_maintainer_jai...

Re: “Open source” is broken

#124

Post by TheDong »

xena wrote: post #3

I'm the author of the post in case you have any questions for me.

I'm curious on your thoughts about the difference between publishing this post and publishing oss/foss code.

To me, it seems like this blog post is something you've shared freely with the world, with no expectation of getting direct financial compensation for it. You have an idea you want others to read and think about, so you wrote it down.

To me, this act of publishing and sharing your thoughts freely in the hopes others might find them interesting shares similarities to free software. You wrote something that you think others might find interesting or useful, and you want to share it. That statement applies equally well to FOSS and blog posts.

What do you see as the major difference? Is it that OSS rejects copyright, so the code can be used for profit, while your post can't freely appear in, say, a published for-profit book of opinions on OSS? Would you be opposed to this post being published by someone else and you not getting money for similar reasons that you blog about here?

Is the difference in expectations, that people expect support for software, while people expect nothing of blog posts? That a blog post is finished and may be thrown over the wall, comments ignored, typos uncorrected, and that feels "fine", while software thrown over the wall with issues ignored and no future changes planned feels "weird"?

Is there some bigger difference?

Is there a way to reduce this difference, to create an environment or structure where you would share code, just as you currently willingly share your thoughts and writings on this blog?

Re: “Open source” is broken

#125

Post by webmaven »

sneak wrote: post #60

> If log4j2 is responsible for your company's success, you have a moral obligation to donate to the person who creates this library thanklessly. This is false. Free software is given away by those who produce it. When you receive a gift, no moral or ethical obligation is created. This idea that you can do things with free software that are contrary to the spirit (such as create a profitable company around it and not…

> This is false. Free software is given away by those who produce it. When you receive a gift, no moral or ethical obligation is created.

The ethical obligation is to your own users: you should be making a reasonable good-faith effort to ensure that your software's dependency projects are healthy as a transitive consequence of ensuring the health of your own software project. This has nothing to do with the ethics of accepting a gift, and everything with professional ethics (which raises the debate of whether writing software should be a profession).

Arguably, the dependency projects also have a similar obligation, or at least the obligation to make the health status of their project explicit.

Re: “Open source” is broken

#126

Post by hgs3 »

There are already strategies for monetizing OSS, like selling GPL exceptions or support, but it's up to the individual developer to figure this out. The OSS ecosystem could do more to encourage monetization. For instance, GitHub could add a "buy" button with payment processor for maintainers to easily sell closed source licenses. Package managers could include payment options too. It's not just about payment either, but they could also offer prewritten contracts and other legal templates for maintainers. I can easily envision a world where maintainers are properly funded. I suspect, however, that enterprising forces would prefer OSS remain charity work.

Re: “Open source” is broken

#128

Post by suriyaG »

montroser wrote: post #73

No, it's not broken -- it's thriving. Everyone involved has their own incentives, and gets to make their own decisions about when and where to invest their time and money. Some devs are in it for the passion, some for the experience, some for the challenge, some for the learning, some so their work will live on when they change employers. Startups get to use well-tested community supported libraries and don't have to…

I mostly agree with your argument. But, if we just de facto accept everything for how it has been in the past. Then we stop making things better, for everybody involved.

Is Open-Source thriving? yes. Can we make fix the places where it's broken? Also, Yes.

Re: “Open source” is broken

#129

Post by jchw »

Any time there’s a big vulnerability in an open source project, I brace myself for the inevitable barrage of reactionary statements making the same claims about open source maintainers, compensation, etc.

But while there’s some truth to the factual information, I simply disagree with the notion that open source is broken because of this. And there’s one specific pull quote I'd like to draw attention to:

> If log4j2 is responsible for your company's success, you have a moral obligation to donate to the person who creates this library thanklessly.

This is an interesting statement. I happen to disagree with it in a fairly vehement fashion; open source works specifically due to the lack of moral obligations. Part of what I am intentionally doing when I release code is waiving any legal obligations, and I in no way want to imply that I am replacing them with unspoken moral expectations. I just release software because I feel like it, and offer best-effort support (not great!) because I want to. For free. For other people to benefit off of, and for me to benefit mutually from in the form of bug fixes. (And if I even cared about it, GitHub stars.)

But the other reason it’s interesting is because it actually knocks at another truth:

Most users of a logging library like log4j have collectively very little credit to give to log4j for their success. As great of a library as it may be, it’s simply a tertiary concern for most software, which, most of the time, will be using very little of its functionality.

Instead, log4j offers the applications the ability to have better logging facilities at a relatively low cost thanks to open source and the lack of obligations it gives users. It’s usually not that important, but the collective quality-of-life improvement across the industry was evidently of great importance, seeing how much use it garnered.

Am I saying people shouldn’t go and donate to log4j? Absolutely not. But no, I disagree that you really have a moral obligation to pay maintainers for libraries you import. It’s extremely good that the maintainers of log4j are selfless enough to tirelessly provide support during this obviously volatile moment, but they are not required to, anymore than anyone is required to donate.

In any case, reactionary action every time something goes wrong sure as hell won’t fix anything that might be broken about open source.

If you want to be paid for something, consider not using the open source model, or using a dual-licensing model. Not all software simply must be open source. But: The largest net benefit to the world for something like log4j could only be seen with open source, and that is literally because of the lack of obligation, not in spite of it.

Post reply on HN