Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Open source” is broken

christine.website

Post reply on HN
Print view View original

181–190 of 357 posts

Re: “Open source” is broken

#181

Post by bachmeier »

kelnos wrote: post #25

Open source isn't broken. The software will continue to get built regardless of funding levels, clearly. But when vulnerabilities like this are found, no one -- especially corporate users -- gets to complain. Any complainers should be immediately told to fund the software they use, or shut their entitled mouths. Open source is fine. The culture of companies -- nearly all of them, including the one I work for -- that…

> The culture of companies -- nearly all of them, including the one I work for -- that freeload off this work is what's broken.

Absolutely. Originally, we had free as in freedom software. Then businesses did their best to redefine it as free as in free labor software. That's the entirety of the anti-GPL movement. The thing about the GPL is that you can dual-license your software for companies that don't like the GPL. It works marvelously as a way to monetize your open source work. Releasing under one of their preferred licenses guarantees there's no way to monetize your work beyond charity. That's what businesses want so many open source developers fall into the trap of donating their labor.

Re: “Open source” is broken

#182

Post by kube-system »

IiydAbITMvJkqKf wrote: post #67
zaarn wrote: post #43

Earlier quoted context omitted.

Except you can't because hundreds of thousands of project have "log4j" in their dependency list not "wyldfire-fixed-log4j". If log4j broke and there was no maintainer, a fork would not fix things.

Sure you can fix it, change the "log4j" in your dependency list to "wyldfire-fixed-log4j". You can't do that with closed source (either because you care about legalities, or because you have no way of obtaining a compilable and readable source code).

The problem is, my dependencies also have dependencies. If the problematic dependency is any more than one degree of separation removed, you're back to square one.

Re: “Open source” is broken

#183

Post by threatofrain »

thr0wawayf00 wrote: post #162
charcircuit wrote: post #157

Earlier quoted context omitted.

No one is entitled to money. There's nothing broken about that. If you want to make money it would be a good idea to make a business plan. Making and maintaining a piece of software and giving it away for free isn't a great business plan, or at best it's an incomplete one.

> No one is entitled to money. There's nothing broken about that. If you want to make money it would be a good idea to make a business plan. This attitude totally ignores how hard it is to actually run a software tooling business and collect when you have a free/community offering. Take the Obsidian note app, for example. It's technically free until you start using it for revenue-generating, work-related activity per…

I'm not sure that many people are using Obsidian for work, specifically because Obsidian does not have collaboration or any kind of "team" concept. It truly is a knowledge-for-one app.

Re: “Open source” is broken

#184

Post by matkoniecz »

> If you use software made by others in their spare time and find it useful, pay them. This should not be a controversial opinion. This should not be a new thing.

It is not necessarily the only or preferable model. I am spending significant time on developing OpenStreetMap editor and it is funded by grants (currently NLnet foundation). Without such grant I would not have time to work on it.

In at least some cases work can be funded by someone who wants some software to exist. Not by direct users.

> Why I Don't Write Useful Software Unless You Pay Me

Though I admit that I am not getting why someone would maintain for free software used primarily by enterprise software.

"Yet nothing is stopping people to bash us, for work we aren't paid for, for a feature we all dislike yet needed to keep due to backward compatibility concerns."

If I would be developing logging software like this I would happily deprecate such unwanted feature and announce that I expect X$ in funding to keep it alive for the next year. And remove it if such funding would not appear. Repeat next year.

> If log4j2 is responsible for your company's success, you have a moral obligation to donate to the person who creates this library thanklessly.

I am not convinced that I agree with that. It was released for free also as in free chocolate.

Though log4j2 developers have also no ethical obligation to continue working on it so you should fund them due to good business sense.

But if log4j2 developers wants funding and then work for free to support unwanted features... I am not surprised that they do not get funding, I really think that they should list features that will be dropped unless funding appears. With focus on features used by major projects and not useful for hobby developers.

Re: “Open source” is broken

#185

Post by xena »

zebraflask wrote: post #168
montroser wrote: post #73

No, it's not broken -- it's thriving. Everyone involved has their own incentives, and gets to make their own decisions about when and where to invest their time and money. Some devs are in it for the passion, some for the experience, some for the challenge, some for the learning, some so their work will live on when they change employers. Startups get to use well-tested community supported libraries and don't have to…

Just out of curiosity - I wouldn't use vehicular manslaughter as a point of comparison for open source projects? Is there a reference I'm missing with that part of the comment?

See https://www.theregister.com/2020/03/26/corejs_maintainer_jai... for more context.

Re: “Open source” is broken

#186

Post by kube-system »

whateveracct wrote: post #102
TheRealPomax wrote: post #39

Earlier quoted context omitted.

You say that as if you even know your full dependency chain. Reality doesn't quite work that way. No one knew their codebase even relied on leftpad until it broke millions of applications the world over when it got pulled. Some projects have the benefit of notoriety (log4j falls in that category) but plenty of projects are just "plumbing" and the only thing you know is the name of the dependencies you have in your de…

> You say that as if you even know your full dependency chain. Reality doesn't quite work that way. No one knew their codebase even relied on leftpad until it broke millions of applications the world over when it got pulled. We're professionals - we in fact simply can do that with some elbow grease. Doesn't take a genius to understand how software is built.

The only professionals who actually do this are in heavily regulated industries that require it, which are often criticized as being stuck with "ancient tech".

It seems there's currently two ways to tackle this issue: move fast and break things, or move slowly and don't break things.

Re: “Open source” is broken

#188

Post by rovr138 »

thr0wawayf00 wrote: post #162
charcircuit wrote: post #157

Earlier quoted context omitted.

No one is entitled to money. There's nothing broken about that. If you want to make money it would be a good idea to make a business plan. Making and maintaining a piece of software and giving it away for free isn't a great business plan, or at best it's an incomplete one.

> No one is entitled to money. There's nothing broken about that. If you want to make money it would be a good idea to make a business plan. This attitude totally ignores how hard it is to actually run a software tooling business and collect when you have a free/community offering. Take the Obsidian note app, for example. It's technically free until you start using it for revenue-generating, work-related activity per…

Or just use the honor system in combination with a liability standpoint.

They might loose out on smaller companies that abuse it, but teams and people in larger companies that use it will pay.

If I want to use something, I can pay for it and submit it to get reimbursed or if it's a bigger purchase, I use a company card. I don't have to worry about putting the company in liability and that's something that's understood by many.

Another example, how does Jetbrain make sure that the people paying for their software via personal licenses aren't getting money for it from their companies?

Re: “Open source” is broken

#189

Post by icambron »

CaptArmchair wrote: post #148
montroser wrote: post #73

No, it's not broken -- it's thriving. Everyone involved has their own incentives, and gets to make their own decisions about when and where to invest their time and money. Some devs are in it for the passion, some for the experience, some for the challenge, some for the learning, some so their work will live on when they change employers. Startups get to use well-tested community supported libraries and don't have to…

I think this argument massively ignores the underlying message of this blogpost: addressing that the human beings that make and use software aren't always treated as, well, human beings. > A maintainer goes to jail for vehicular manslaughter and a bugs needs fixing, no problem The author didn't seem to hint that open bugs in core-js or its usefulness to its community of users are / is problematic. They hinted that ma…

ESR doesn't get to decide how it works; the revealed preferences of the participants do. And those revealed preferences are that everyone pretty much does what they want, and nobody owes anybody anything. And it seems to have clearly created a vibrant ecosystem.

If you're in it for money or the fame, you're going to end up very unhappy. If you prioritize OSS work above addressing your real life problems, you're going to end up unhappy. If you invest your ego into the success of the project, you'll probably end up unhappy Those aren't broken properties of the system; they're the consequences of transparently poor decisions by participants. Those people would be better served by simply not doing OSS instead of trying to convince everyone else to fund their coding adventures.

I am the sole maintainer of a project with almost 12k stars on GH and 2M weekly downloads from NPM. It would be a massive amount of work if I let it be. The entitlement and indifference of users would eat me alive if it were a real workplace. And the pay would be hilariously bad if I expected income from it. But none of those predicates are true.

No one asked me to make it, no one pays me for it, and no one controls what I spend my time on. Those mutual obligations are properties of jobs, exactly what I don't want out my hobby work. When I don't want to work on it, I just don't. When a bunch of people want a feature I have no wish to add, I don't add it and they're free to fork. When I write or merge a bug, I lose no sleep over it. When people "threaten" to use a "competing" library, I laugh: who cares? Building it is fun for me and it's apparently useful to others. What's the problem?

Since all that seems to work pretty well, the right answer is to keep doing it. Sure, you'll end up with occasional log4j RCEs, but it's not like anyone is going to look at that and say, "I guess I won't use OSS". It was always caveat emptor.

Re: “Open source” is broken

#190

Post by jsnell »

gorgoiler wrote: post #131

The market value of an open source library is the price you’d have to pay to replace it. How much would it cost Google to hash out a minimum viable rewrite of log4j2? Probably not much. Why don’t they? Because the cost of just using log4j2 is 0… until it isn’t. The externalities of the damage caused were never priced into that zero dollar price. I think about this every single time I depend on a third party library.…

Why do you think they're using log4j to any significant extent? I'd be a bit surprised if they ever did rather than rolling their own, because for something this simple the cost of writing your own is far cheaper than dealing with a dependency. We're not talking about Linux or Clang here...

In particular, from https://github.com/google/flogger#yet-another-logging-api:

> Flogger is now the sole recommended Java logging API within Google.

Post reply on HN