If you give your work away for free then you are signalling to the world that the value of your work is $0. So don’t get surprised or complain when the world then treats your work as being worth nothing and therefore unworthy of support. You are effectively devaluations the skills, work, and income potential of yourself and everybody else doing similar work.
“Open source” is broken
201–210 of 357 posts
Re: “Open source” is broken
#202I feel like code security blogs are always loaded with Furry/Anime avatars, memes, artwork, etc...
Probably because furries are the people in charge of code security. People just don't wanna admit it.
Re: “Open source” is broken
#203> If log4j2 is responsible for your company's success, you have a moral obligation to donate to the person who creates this library thanklessly. This is false. Free software is given away by those who produce it. When you receive a gift, no moral or ethical obligation is created. This idea that you can do things with free software that are contrary to the spirit (such as create a profitable company around it and not…
Does that also mean that it is morally OK for the author to backdoor their code or sell zero days they discover in it? A direct reading of the license says there's no warranty so they have no grounds to complain, right?
Yes, I would say it does. It expressly disclaims even fitness for a particular purpose - if you don't read it, it could very well be example backdoor code.
Re: “Open source” is broken
#204The market value of an open source library is the price you’d have to pay to replace it. How much would it cost Google to hash out a minimum viable rewrite of log4j2? Probably not much. Why don’t they? Because the cost of just using log4j2 is 0… until it isn’t. The externalities of the damage caused were never priced into that zero dollar price. I think about this every single time I depend on a third party library.…
> The market value of an open source library is the price you’d have to pay to replace it.
Nope not at all. As long as somebody is willing to provide the code for $0 then the market value is $0. It is basic economics. The value of something is whatever you can get somebody to pay for it.
Re: “Open source” is broken
#205> I simply do not want to be in a situation where my software that I develop as a passion project on the side is holding people's companies together. People love to hate on Richard Stallman but he was really clear about the motivation for Free Software (which is not the same as Open Source but shares some tenets). What companies do with the source is their thing. They get all of the benefits and all of the responsibi…
Except you can't because hundreds of thousands of project have "log4j" in their dependency list not "wyldfire-fixed-log4j". If log4j broke and there was no maintainer, a fork would not fix things.
Off-topic but very important:
The widespread misuse of the word 'dependency' is very very icky, linguistically speaking. This word originally meant: 'in a state of being dependent'. Usage: "Ronny hated his dependency on the kindness of strangers.". But it's being used to refer to the 'dependent', as well as the 'dependee', which is very poor form:
https://english.stackexchange.com/questions/25575/what-is-th...
Re: “Open source” is broken
#206Well, I agree but no solution in the horizon yet. Yes, the companies which profit from open source "should" fund the open source. But nothing forces (or even reminds) them to do so.
Why should they? The developers giving away their work for $0 are telling the world that their work is worth $0. So why should the companies pay more than $0 for it? That doesn’t make sense at all.
Re: “Open source” is broken
#207No, it's not broken -- it's thriving. Everyone involved has their own incentives, and gets to make their own decisions about when and where to invest their time and money. Some devs are in it for the passion, some for the experience, some for the challenge, some for the learning, some so their work will live on when they change employers. Startups get to use well-tested community supported libraries and don't have to…
I think this argument massively ignores the underlying message of this blogpost: addressing that the human beings that make and use software aren't always treated as, well, human beings. > A maintainer goes to jail for vehicular manslaughter and a bugs needs fixing, no problem The author didn't seem to hint that open bugs in core-js or its usefulness to its community of users are / is problematic. They hinted that ma…
> Yes, open source licensing allows forking, but that's not something you'd do, for instance, because a maintainer fails to respond to your issues on GitHub.
Huh? Not getting satisfaction, however you want to define that, from upstream is the main reason forking occurs.
Re: “Open source” is broken
#208Earlier quoted context omitted.
You can fix it for your own applications and libraries. The tooling exists. You can't force other people to use your fork.
Correct, all those other people will have to manually find some fork or make their own, repeating the same work thousands of times and ossifying that some part of your java build system now permanently includes a section to patch log4j dependencies.
You can not force your dependencies to do what you want. You can only patch the problem for yourself and maintain that patch in the build system, or you can fork each dependency in the chain, maintain those and then your build system is cleaner.
There is nothing wrong with these options.
Re: “Open source” is broken
#209It's not "Open Source" (making code public and free to use and modify) that's broken. It's how people rely on it without any consideration about the sourcing of it. It's not that it's free to pick and to use. It's that some/most people too often associate "it's free" to be equivalent to "I don't need to care about it, like, at all". It's that some/most people don't understand that, whatever they take, they become dep…
It absolutely is $0 free to pick and use. So that’s what people/companies will obviously do. Why should they pay more than $0 for something that is worth $0 in the market place?
Re: “Open source” is broken
#210It would be nice to see public grants like those in the EU for software here in the US. If you want to replicate SV, get rid of non-competes first, then try doing something like this along with tax breaks.
Hey there is a system in place that can already take care of all of this. It’s called “the market place”. Put a licence in place that force companies to pay for the code but leaves it free for everybody else. That’s it. It isn’t rocket science.