Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Open source” is broken

christine.website

Post reply on HN
Print view View original

261–270 of 357 posts

Re: “Open source” is broken

#261

Post by tommek4077 »

fivelessminutes wrote: post #227
tommek4077 wrote: post #45

Earlier quoted context omitted.

Those audits are your duty. We've did this in programming a long time until recently the JavaScript craze took over.

FOSS programmers owe you nothing, please read the license. You can keep dreaming otherwise and enjoy a steady stream of security problems from your leeching.

I hope you are answering the parent. Because rhis is exactly what I said. You as a user of any foreign library have to look through it. You can't trust code you didn't write. That is also one of the reasons why in the past so many parts where reinvented. Those guys where not stupid, but why on eaeth would you risk the security of your work just to not write the login process yourself? And then some smarty pants came and told you this is all unnecessary and it is "best practice" to just include some library, package or whatever it is called nowadays.

Re: “Open source” is broken

#262

Post by zaarn »

alexvoda wrote: post #208
zaarn wrote: post #117

Earlier quoted context omitted.

Correct, all those other people will have to manually find some fork or make their own, repeating the same work thousands of times and ossifying that some part of your java build system now permanently includes a section to patch log4j dependencies.

You can not force your dependencies to do what you want. You can only patch the problem for yourself and maintain that patch in the build system, or you can fork each dependency in the chain, maintain those and then your build system is cleaner. There is nothing wrong with these options.

Forking yourself is not scalable for fixing a 10/10CVE and I don't get how people think that somehow "fork it" is a viable solution across the entire industry.

This is not about forcing my dependencies to do anything, this is about caring about maintainers and maybe ensuring that the bedrock of our ecosystems aren't maintained by unpaid volunteers in their free time, exploiting the sweat on their backs for our amusement for free. Forking the project is just spitting on their efforts on top of that.

Re: “Open source” is broken

#263

Post by zaarn »

kristjansson wrote: post #200
zaarn wrote: post #176

Earlier quoted context omitted.

My argument is not closed source. My argument is that "just fork it" does not magically fix all problems. Closed source makes this worse but "fork it" is no answer either. I believe I made this very clear on my very first comment.

Right … open source doesn’t guarantee an absence of problems, only that, in the worst case, a user can repair a problem herself. As you note, that’s strictly preferable to closed source, where a problem with a dependency is not guaranteed to be fixable by the user. Isn’t that enough?

That is not sufficient no. As a user, I want to be able to support developers so they have the time to fix things that go wrong. That the log4j Maintainers are entirely unpaid for maintaining what amounts to the bedrock of the java ecosystem is a tragedy and that people continue to argue that this is how it should be are simply exploiting what amounts to slave labor.

Re: “Open source” is broken

#264

Post by zaarn »

debug-desperado wrote: post #228
kube-system wrote: post #182

Earlier quoted context omitted.

The problem is, my dependencies also have dependencies. If the problematic dependency is any more than one degree of separation removed, you're back to square one.

A nightmare in Node world perhaps (our latest simple web server has over 2,000 dependencies). In the Java world it’s much simpler with a few excludes in your POM. Especially for libraries that keep stable interfaces, such as a logging library.

How many excludes is Java going to ship is forking the problem of unmaintained libraries away becomes too much? When it reaches 5kb? 10kb? 100kb of excludes?

Re: “Open source” is broken

#265

Post by zaarn »

dopkew wrote: post #205
zaarn wrote: post #43

Earlier quoted context omitted.

Except you can't because hundreds of thousands of project have "log4j" in their dependency list not "wyldfire-fixed-log4j". If log4j broke and there was no maintainer, a fork would not fix things.

Off-topic but very important: The widespread misuse of the word 'dependency' is very very icky, linguistically speaking. This word originally meant: 'in a state of being dependent'. Usage: "Ronny hated his dependency on the kindness of strangers.". But it's being used to refer to the 'dependent', as well as the 'dependee', which is very poor form: https://english.stackexchange.com/questions/25575/what-is-th... https:…

I don't think that is any issue whatsoever, the software engineering world has largely agreed on the usage of the word dependency, doesn't really matter what linguists think. Language is consensus, not thesis papers.

Re: “Open source” is broken

#266

Post by mbrodersen »

jchw wrote: post #258
mbrodersen wrote: post #250

Earlier quoted context omitted.

Not at all. I don't think you understand OSS. OSS is about Open Software. Not about free (as in $0) software. The only way to make OSS sustainable is to make companies pay for it .

With all due respect, I don’t think you do. Open source is about rights , and creating a secondary unwritten set of rules about obligations that are extralegal is just a more advanced way of circumventing them. Please read the DFSG, or OSI definition of open source, or the FSF definition of free software for what I mean. All of them are explicit that you can not discriminate on endeavor (explicitly including commerci…

> and creating a secondary unwritten set of rules about obligations that are extralegal is just a more advanced way of circumventing them

I am not sure I follow your argument here. Who is it that is creating a secondary unwritten set of rules?

Re: “Open source” is broken

#267

Post by pritambaral »

dopkew wrote: post #205
zaarn wrote: post #43

Earlier quoted context omitted.

Except you can't because hundreds of thousands of project have "log4j" in their dependency list not "wyldfire-fixed-log4j". If log4j broke and there was no maintainer, a fork would not fix things.

Off-topic but very important: The widespread misuse of the word 'dependency' is very very icky, linguistically speaking. This word originally meant: 'in a state of being dependent'. Usage: "Ronny hated his dependency on the kindness of strangers.". But it's being used to refer to the 'dependent', as well as the 'dependee', which is very poor form: https://english.stackexchange.com/questions/25575/what-is-th... https:…

The original meaning still works. In the software world, where abstractions abound, each dependee of yours can be said to add one 'state of being dependent' to your set of requirements. That's what it meant originally in this young field; when an author chooses to use a library instead of writing their own code, they're adding a requirement for the user ("Hey, you gotta have this thing already installed"). The software is in a state of being dependent on each of its dependees, individually. Each such state could be removed by replacing the library, and thus there'd exist one less 'dependency'.

----

Yes, this is mental gymnastics, another fine staple of this glorious field.

Re: “Open source” is broken

#268

Post by em-bee »

mbrodersen wrote: post #251
city41 wrote: post #225

Earlier quoted context omitted.

Doesn't the reverse hold true too? If you rely on software you paid $0 for and it fails you, you got what you paid for.

Absolutely. However in reality if you give away your work for $0 then people value your work at $0 which means that they expect you to fix problems for $0. The problem is the maintainers giving away their work for $0. OSS is not about free (as in $0) it is about Open Source.

if this were true then FOSS would never have reached the popularity that it does now. FOSS users give a lot of valuable feedback that makes software better, and they don't generally expect their problems fixed for free.

that mainly comes from greedy corporations that exploit free resources for their own gain.

i give away my software for free to give back to the community that gives me tons of other free software and to get feedback and patches. if i were to sell it, that would just not happen because we would all compete on price.

and because i can't tell the difference between individual FOSS users and large corporations when the software gets downloaded i can't force corporations to pay. nor can i make a license that forces payment from a select group because that would not longer be FOSS.

Re: “Open source” is broken

#269

Post by KronisLV »

montroser wrote: post #73

No, it's not broken -- it's thriving. Everyone involved has their own incentives, and gets to make their own decisions about when and where to invest their time and money. Some devs are in it for the passion, some for the experience, some for the challenge, some for the learning, some so their work will live on when they change employers. Startups get to use well-tested community supported libraries and don't have to…

> Some devs are in it for the passion, some for the experience, some for the challenge, some for the learning, some so their work will live on when they change employers.

Sure, but what about people who could write code, help with docs, testing etc., but can't because of the current financial disincentives to do that?

With my current salary in my country, i make around $21k a year, about which i wrote here (including information about my savings): https://blog.kronis.dev/articles/on-finances-and-savings

With these current circumstances, i cannot be in my right mind and decide to meaningfully commit to open source, apart from small bug fixes or something, unless i want to miss out on spending time with family or anything else over the evenings and weekends, because my day job takes up the rest of my time.

Sure, you can talk about that particular salary number (though it's similar for many people in Eastern Europe, India and many other places), or talk about how i should try to convince my management to allow me to contribute to open source (which is a non starter in many circumstances), but at the end of the day it'd be like quitting my job because i want to develop a video game or something without having a clear plan on how to make money and just vague hopes and dreams instead (which i've seen often as well). For example, i'd have to give up freelancing to do that, which would just further hurt my finances.

I commented on another thread here, but just look at this: https://staltz.com/software-below-the-poverty-line.html

Open source isn't a financially responsible choice for many non-privileged folks out there (e.g. company doesn't invest in it, don't have savings to avoid having to live paycheck to paycheck). Just look at this comment in the other thread: https://news.ycombinator.com/item?id=29525272

> The default is that no one will use your thing, no one will contribute, no one will fund you, etc.

In my eyes, doing meaningful work is logically supposed to be followed by not being punished for it, such as not having to starve or be homeless (maybe the "just world" fallacy on my part). No one should be able to praise the open source devs for their work and then just turn around in that same sentence and shun them for wanting to be supported financially for doing that, or claim that these incentives are not valid in some way.

Re: “Open source” is broken

#270

Post by jchw »

mbrodersen wrote: post #266
jchw wrote: post #258

Earlier quoted context omitted.

With all due respect, I don’t think you do. Open source is about rights , and creating a secondary unwritten set of rules about obligations that are extralegal is just a more advanced way of circumventing them. Please read the DFSG, or OSI definition of open source, or the FSF definition of free software for what I mean. All of them are explicit that you can not discriminate on endeavor (explicitly including commerci…

> and creating a secondary unwritten set of rules about obligations that are extralegal is just a more advanced way of circumventing them I am not sure I follow your argument here. Who is it that is creating a secondary unwritten set of rules?

OK. So let’s say I want to participate in open source. I release an open source project on the internet. The way I see it, here are my options:

1. I can release it freely, on a project forge like GitHub, and thus nobody has any obligation to pay for it. I can use dual licensing schemes and/or offer commercial support, or solicit donations, but by and large everyone from your average Joe to the fortune 100 are treated the same, because that’s part of the definition of open source and free software, and indeed, part of the draw.

2. I can release it at a cost, but still provide it under an open source license, but because it’s open source, someone can simply release the source code when they pay for it. In practice this actually has worked out this way; take a look at how this has been attempted with the Patron model for emulation software, for example.

3. Do #1 but ask politely (or impolitely) for big companies (how big?) to pay back when they take advantage of open source software. Create a culture wherein using open source projects implies obligations that may not be written out explicitly. This is a commonly expressed viewpoint when people talk about the problem of compensating open source maintainers, and it’s where the “extralegal” part comes in, wherein there are social expectations that contradict the license.

Selling software under a license that doesn’t allow redistribution would obviously fail almost any open source or free software definition, so I’m struggling to think of another potential interpretation here.

Post reply on HN