131–140 of 357 posts
How much would it cost Google to hash out a minimum viable rewrite of log4j2? Probably not much.
Why don’t they? Because the cost of just using log4j2 is 0… until it isn’t.
The externalities of the damage caused were never priced into that zero dollar price. I think about this every single time I depend on a third party library. Free now, but potentially pay very dearly later.
As a developer I both expect tools and libraries to be free and have been burned by this as someone working on developer tools and as an open source maintainer on my personal projects.
The frustrating part to me is that this doesn't apply to apps, saas apps, services, or a lot of AI/ML related things. Most developers expect to make money off those things while at the same time demanding everything they used to build it be free because it's just code and they love open source. It feels unfair, and in that way I agree, open source is broken, or at least unsustainable for small projects long term.
Earlier quoted context omitted.
At least with gradle you can easily add some logic to the buildscript to substitute all instances of a specific dependency for a java library/application with a fork. It's only a handful of lines of code and it is technically a bit hacky but it's really no worse than any of the other jank you are forced to do when building any moderate to complex gradle based java project.
And when another library is unmaintained and breaks, you add those few lines again. And again and again and again, until your gradle file is 90% hotpatching your dependencies.
Luckily those few lines can mostly be shared and you end up with a handful of lines and a map from old dep to new dep which makes it not too painful.
This whole issue is why I don't like these ecosystems but at the very least in the Java space dealing with this issue isn't too painful. I can't speak for the JS space but this is also a pretty trivial fix in the Rust space and it isn't too painful with C++ or C projects. Nix (mostly used for Haskell but it's a pretty solid universal package manager) has some pretty good tooling for modifying upstream dependencies. Spack (package manager specialised for HPC and embedded projects) has really good support for this as well.
My point being that people have run into these issues in the past a lot in certain spaces and as a result those spaces have come up with solutions for this problem a long time ago. It just so happens that for the most part the average dev doesn't see a lot of that because these issues get dealt with upstream or just aren't common in most industries. The embedded industry is particularly used to this considering how much of the kit from manufacturers is just outright wrong or broken 3 levels deep. The only reason I'm as well versed with this as I am is because I've been in the embedded space patching over broken HALs and I've bled my blood dealing with legacy enterprise applications that were initially written in Java 1.1 and haphazardly dragged along over the decades.
TLDR: This is an ugly fix but ultimately it's the best ugly fix to an ugly problem and every software ecosystem eventually gets to deal with it once they get old and crusty enough.
When I look at https://apache.org/foundation/thanks I see a huge list of Big Name Tech companies who are presumably donating a lot to Apache. So, what exactly is the issue? Perhaps one of allocation of existing resources?
Earlier quoted context omitted.
> no one -- especially corporate users -- gets to complain Do corporate users of open source really do all that much complaining without contributing? IME the people with the biggest complaint/contribution ratio in open source projects are individual devs (or trolls) who are not participating as a representative of any company.
In the case of core-js the issue isn't that "nobody is contributing", the issue is that there is one guy with commit authority and he's an asshole who reportedly spends most of his days rejecting PRs from people he doesn't like. IBM, Oracle, Apple, Microsoft could submit all the PRs in the world and it won't do any good if he says "I don't like your coding style" or "this takes core-js in a direction I don't like." O…
Literally every time I find an esoteric library on Github the first thing I do before forking it or adding it to my dependencies is immediately pull up the "network" tab to see if there's are active branch downstream I should follow.
Perhaps Github can do a better job of highlighting hidden downstream forks to direct people to find more updated and supported dependencies?
> Consider something as basic as running an SSH server on the Linux kernel. In the mix you would have at least 10 vendors (assuming a minimal Alpine Linux system in its default configuration), which means that there are at least 10 separate organizations that still have bills to pay with actual money dollars regardless of the number of users of the software they are giving away for free.
And your judgment 2 ? :
> If log4j2 is responsible for your company's success, you have a moral obligation to donate to the person who creates this library thanklessly.
Let’s say that you convince me of 2. I have 603 packages on my production server, with no obvious way to know how much distinct maintainers this is, or how they accept funding. One node application on it developed by my company has 991 dependencies, 129 of those "are looking for funding", according to npm.
How do I even start to fulfill that responsibility in a fair way ? Just picking the 5 (or, hell, even 10) most "visible" or "obvious" projects would be a significant burden, and I don’t see how prioritizing by visibility is fair or fixes anything about "that obscure but important library maintained by that guy in nebraska".
I'm the author of the post in case you have any questions for me.
> This is why I am very careful about how I make "useful" software and release it to the world without any solid way for me to get paid for my efforts. I simply do not want to be in a situation where my software that I develop as a passion project on the side is holding people's companies together. Isn't this the best position to be in if you want to get paid? "You've built your company on top of my project and now y…
Someone should write a package that goes through your existing codebase to see which open source projects you make the most use of (however that is measured). Then a company could run it once a year, say around tax write off time, and build a list to donate to I would have happily given to log4j, but I didn't know that they were in need. Someone has to make it easy to keep track of this because it's never going to be…
This is a half-baked idea right now, but I think there’s something to it. A lot of the issues with open source stem from the friction of donating. Reducing that would incentivize people to work on libraries that are popular but neglected. It would also help devs capture some of the value they create.
No, it's not broken -- it's thriving. Everyone involved has their own incentives, and gets to make their own decisions about when and where to invest their time and money. Some devs are in it for the passion, some for the experience, some for the challenge, some for the learning, some so their work will live on when they change employers. Startups get to use well-tested community supported libraries and don't have to…
I mostly agree with your argument. But, if we just de facto accept everything for how it has been in the past. Then we stop making things better, for everybody involved. Is Open-Source thriving? yes. Can we make fix the places where it's broken? Also, Yes.
I'm the author of the post in case you have any questions for me.
I'm curious on your thoughts about the difference between publishing this post and publishing oss/foss code. To me, it seems like this blog post is something you've shared freely with the world, with no expectation of getting direct financial compensation for it. You have an idea you want others to read and think about, so you wrote it down. To me, this act of publishing and sharing your thoughts freely in the hopes…
As for the time to write these posts, yeah I'm making nowhere near my market value for this kind of writing. I've considered adding ads to my blog, but I still feel kind of philosophically uncomfortable with "selling out" like that. My job really does make sure that all my needs are accounted for and I am blessed to be in a state where I have financial excess and can make additional private contributions to other projects.
At some level though my blog is really a sink for my anxiety. Just being able to put words out into the void and knowing that someone is gonna read them helps a lot when it comes to making things a lot less scary in the world. I really do just throw them over the wall when I'm done though lol. Sometimes I'll do a typo pass but most of the time I write well enough that my first pass turns out to be the last pass unless some critical problem is found. This doesn't happen often though.
I do occasionally make volumes out of my writing and sell them on Itch (https://withinstudios.itch.io/), but I have only ever made $250 on there in total; nowhere near enough to fund the creation of the media in question. I also don't advertise my Itch shop very well so that may be partially on me.
Mostly though the goal of this post was to make people think about the issue. I have succeeded.