Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Open source” is broken

christine.website

Post reply on HN
Print view View original

151–160 of 357 posts

Re: “Open source” is broken

#151

Post by indymike »

armchairhacker wrote: post #63
betwixthewires wrote: post #17

I don't think it's that big of a deal honestly. If some guy in Nebraska maintains some library that is very useful and your company relies on it and does not pay him, you're asking to wind up relying on an unmaintained project eventually. If I maintained something extremely valuable and found out a core google product relied on it, I'd stop maintaining it.

This is what I was thinking: it seems like any security and reliability vulnerabilities from OSS are at least as bad, if not worse, in paid software or closed-source. You can pay someone a lot to make a product and they can do a shitty job. You can have a company install a backdoor in a closed-source software for whatever reason. You can have a well-trusted organization with competent developers mess up a single line…

> This is what I was thinking: it seems like any security and reliability vulnerabilities from OSS are at least as bad, if not worse, in paid software or closed-source.

This is wrong: it's better in open source land. Closed source means you, the user have to wait for the vendor to ship a fix. With closed source, the answer sometimes is the version you are on is no longer maintained, and you must buy a new licenses to fix the vulnerability in your closed-source product. Other times, the answer is, sorry, we discontinued that product and will not be patching it.

With open source, you have options when a maintainer says the version is too old: fix yourself, use a patched fork, or migrate. Any way you go, the situation is substantially better than closed source.

> OSS actually gives you a benefit that you can see the code and technically discover any bugs or exploits (even though of course nobody will).

People can and do find and report bugs and exploits in OSS all the time. It's what makes open source work so well.

Re: “Open source” is broken

#152

Post by blitzar »

ravenstine wrote: post #34

Open-source is only broken in the sense that we frequently conflate it with free as-in beer . IMO, fewer things should be free in general, regardless of whether the source is open. Charging money limits the amount of low-value users and the problems that come with them, it rewards the those contributing their expertise, and it can be a replacement for junkvertising. So I agree with the author, but perhaps not in the…

> Open-source is only broken in the sense that we frequently conflate it with free as-in beer.

Sadly many open-source evangelists are advocating for it because of the price tag not because it is free.

Re: “Open source” is broken

#153

Post by aeldidi »

rakoo wrote: post #50

This is a point I've been pondering about recently, especially since the attacks against Free Software and RMS. I've been convinced of the inherent good that openly available software is, both for users and developers, and for society at large. I want to continue contributing to the common goods. But I am also fully aware that Google, Facebook, Twitter, Instagram, Snapchat, Tiktok, and all other platforms exploiting…

Companies will use whatever is at their disposal to grow faster and more efficiently, this is the free market working as intended (and isn't a bad thing by itself: see free software companies like SourceHut benefiting as well).

I think the core of the problem lies in distribution. We've gotten so used to other people distributing our code for us (through the use of package managers and such) that we've made it hard to actually have a dialogue with our users. Many consumers of packages just know their dependencies by the npm package name, rather than actually seeing what the person has to say about the software, how they plan to maintain it and for how long, etc.

Even things like licenses are really just ignored at large, with there being a general mentality of "it's on Github therefore it's probably MIT". There was something I remember reading a bit ago about a Go project whose license was simply "you do not have permission to use for any reason ever" which was depended on by projects from big organizations such as AWS[0].

This is mostly just a rambling and I don't have any concrete way to solve this, but I think it should be taken into account when assessing whether the problem really lies in the individual license choices of developers, or whether this is some kind of effort by big market actors to keep open source solutions at a subpar level of quality in comparison to commercial offerings (for example: some of Microsoft's VsCode extensions only work on the proprietary version, not any open source forks[1]).

[0]: https://fossa.com/blog/bouk-monkey-importance-knowing-your-d...

[1]: https://github.com/VSCodium/vscodium/issues/240

Re: “Open source” is broken

#154

Post by charcircuit »

whateveracct wrote: post #102
TheRealPomax wrote: post #39

Earlier quoted context omitted.

You say that as if you even know your full dependency chain. Reality doesn't quite work that way. No one knew their codebase even relied on leftpad until it broke millions of applications the world over when it got pulled. Some projects have the benefit of notoriety (log4j falls in that category) but plenty of projects are just "plumbing" and the only thing you know is the name of the dependencies you have in your de…

> You say that as if you even know your full dependency chain. Reality doesn't quite work that way. No one knew their codebase even relied on leftpad until it broke millions of applications the world over when it got pulled. We're professionals - we in fact simply can do that with some elbow grease. Doesn't take a genius to understand how software is built.

There is too much information out there to know all of it. Sure everyone knows how to do it, but it's often not worth the time to do so.

Re: “Open source” is broken

#155

Post by eldelshell »

kelnos wrote: post #25

Open source isn't broken. The software will continue to get built regardless of funding levels, clearly. But when vulnerabilities like this are found, no one -- especially corporate users -- gets to complain. Any complainers should be immediately told to fund the software they use, or shut their entitled mouths. Open source is fine. The culture of companies -- nearly all of them, including the one I work for -- that…

Log4J is far from being the standard. As a matter of fact, JBoss, Quarkus, etc, aren't affected by this because they don't use log4j.

Re: “Open source” is broken

#156

Post by kortilla »

> If log4j2 is responsible for your company's success, you have a moral obligation to donate to the person who creates this library thanklessly.

This is absolutely not what open source is about. The author just sounds completely against open source, which is fine, but don’t lecture people for not paying for that which was intended to be free.

Re: “Open source” is broken

#157

Post by charcircuit »

littlestymaar wrote: post #150
montroser wrote: post #73

No, it's not broken -- it's thriving. Everyone involved has their own incentives, and gets to make their own decisions about when and where to invest their time and money. Some devs are in it for the passion, some for the experience, some for the challenge, some for the learning, some so their work will live on when they change employers. Startups get to use well-tested community supported libraries and don't have to…

Yes it's thriving, but it's also broken. From a tweet[1] cited in the article: > This is the maintainer who fixed the vulnerability that's causing millions(++?) of dollars of damage. > "I work on Log4j in my spare time" > "always dreamed of working on open source full time" > "3 sponsors are funding @rgoers's work: Michael, Glenn, Matt" [1]: https://twitter.com/FiloSottile/status/1469441487175880711

No one is entitled to money. There's nothing broken about that. If you want to make money it would be a good idea to make a business plan.

Making and maintaining a piece of software and giving it away for free isn't a great business plan, or at best it's an incomplete one.

Re: “Open source” is broken

#158

Post by c-smile »

wyldfire wrote: post #26

> I simply do not want to be in a situation where my software that I develop as a passion project on the side is holding people's companies together. People love to hate on Richard Stallman but he was really clear about the motivation for Free Software (which is not the same as Open Source but shares some tenets). What companies do with the source is their thing. They get all of the benefits and all of the responsibi…

> Which is very difficult / nigh impossible for closed source.

Closed source does not mean that the customer has no access to it.

In case of my Sciter, for example, customers are getting access to SVN server with sources. Some of them are sending patches with fixes and features.

Sciter's [1] core customers are antivirus vendors - highly professional, dedicated and disciplined teams that know very well what they are doing.

It is not an open source but not a closed source either. Rather a professional club where members value each other time and efforts.

[1] https://sciter.com

Re: “Open source” is broken

#159

Post by rakoo »

jevoten wrote: post #87
rakoo wrote: post #50

This is a point I've been pondering about recently, especially since the attacks against Free Software and RMS. I've been convinced of the inherent good that openly available software is, both for users and developers, and for society at large. I want to continue contributing to the common goods. But I am also fully aware that Google, Facebook, Twitter, Instagram, Snapchat, Tiktok, and all other platforms exploiting…

A good analysis of what open source enables - Facebook et al. were able to build their companies more easily using it. But you forget to compare it to the alternative, where there is no significant open source or libre software available. You can't run Linux, you have to trust Windows not to backdoor you. There is no Signal or Matrix or other encrypted messaging - or if there is, you have no way of verifying it. If y…

Indeed Open Source also benefits Libre Software today. But do we really know what the ecosystem would be like today in a world where only Copyleft existed ?

Linux itself is GPL, so are some of the distributions. Hurd hasn't seen adoption, probably because the alternative is good enough. Signal is still there, client and server. But maybe it wasn't needed because ejabberd, one of the biggest XMPP servers, was already there and powering all messenger platforms.

You're assuming that if developers didn't license under non-copyleft, they'd license under proprietary instead; there's no real reason to believe this. And as many examples have shown, many of the tools we use aren't actually made by billion-dollar companies but by single developers on their free time. The examples in the article show it, Werner Koch (the guy behind OpenPGP) has been asking for funding for years (decades ?). ssh, curl, ...

Anyway, that world is so different that we'll probably never know how it'll work, so here is the area where the optimism of people are visible and I myself believe Copyleft could have been a success.

Re: “Open source” is broken

#160

Post by tonetheman »

That tweet listed in that article ... gah. So bad so full of stupid.

The moron who wrote it is a GOOG programmer who thinks that 300k is what programmers make.

That is a tech-bro who lives in a place of privilege. And from the comment I am guessing not a programmer? Or very young and not so mature.

Open source is not broken.

Open source has always been a programmer scratching their own itch. If other people have the same itch and the code is used in more places... and so on until a larger company uses it.

And then god help that company they are evil for exploiting the guy at the bottom? Yeah nope.

Would it be great if everyone did pay that dude for his open source library? Yes it would.

Figuring out how to pay people all the way down the open source stack would be an incredibly hard problem. You could pay the one guy who started the project but what about all the other people who have worked on it?

I mean if I contributed even 1 line of code to log4j I would like a cut of the 300k the GOOG guy is going to donate.

Post reply on HN