“Open source” is broken

> Taking the option of "I'll just build everything myself" then is not really a viable process in today's world, where all of your competitors will be using tons of prebuilt stuff (unless, perhaps, you have the productivity of someone like Fabrice Bellard, but the reason he's so well known is because his abilities are so rare).

Along with a sibling comment [1] that disagrees with you, I want to add that I am starting to do this myself.

I am close to 30, and I would not say I'm particularly productive. In fact, I would say that I am far below average on what most programmers call "productivity," by which they usually mean "amount of code written." I write code slowly. But I write good code.

My library of stuff is basically made to work on POSIX C and Win32 C, with no other dependencies, including the build system. It has resizable arrays, hashmaps, structured concurrency, trees, UTF-8 strings, string builders, filesystem handling, linked lists, a stack allocator (per-thread), stacks, a self-designed config language, and a pool allocator. Oh, and as mentioned, I'm well on the way to having a build system in there too, with a bootstrap process that depends on nothing more than either MSBuild, a Windows batch file, or a POSIX sh script, meaning that bootstrap itself has no other dependencies other than a minimal OS configuration.

A few months ago, I was writing a compiler in Python (with lark), thinking that I would write the compiler faster that way. Only recently did I try again with C, using my libraries. It turns out that I'm just as fast in C as in Python because I understand my entire stack.

Because of that, I think that my sibling comment is correct that the option of "I'll just build everything myself" is going to be viable for people with less productivity of Fabrice Bellard. In fact, maybe understanding his whole stack is what makes Fabrice Bellard as productive as he is.

[1]: https://news.ycombinator.com/item?id=29524030

Because those maintainers' time is free?

> The law that mandates that companies can't donate to someone on Patreon or help triage bugs or dedicate QA/security time to identifying issues is the requirement for CEO's to demonstrate good judgment in managing the company by maximizing profit for shareholders.

People place an over-emphasis on this. Minecraft broke, the situation they ran into is no different than if their engineering team had introduced an XSS error in their own codebase. If this isn't something that's affecting company profits, then why are they complaining? And if it is affecting company profits, then it's in the shareholder interest to figure out how to support the work so their stuff doesn't break. Nobody says that the law mandates that companies can't have a QA team, companies are allowed to care about reliability. So if donating to someone's Patreon or kicking resources their way improves the stability of a product, then that's in a company's interest, it's not violating shareholder rights to take tangible steps to make your product more secure/reliable.

In general, companies are not quite as constrained as you are suggesting by requirements to pursue profit in the first place, but even from that perspective if we assume they are completely bound in that way, this is still either:

A) not a problem they should be complaining about since apparently it doesn't affect their profits, or

B) their problem to solve, since it affects their profits.

----

> If you design your house with no doors or windows and then proudly announce the fact it has no doors and windows and everyone is welcome to take a look around you don't get to blame people who wander in from time to time and take a look around.

I don't think anyone here is blaming people for using Open Source projects for free, that's by design. I'm blaming them for then turning around and saying, "hey, this thing we're using for free without contributing at all broke, something is clearly wrong with your process, why didn't you stop us from using your thing for free?"

It is directly by design that people can use Open Source projects without contributing back. That's not really the issue here.

----

> If you are making FOSS you are perpetuating a broken system and are accountable for that.

See, this kind of gets at the core of my criticism. The log4j devs didn't wake up in the morning with their house on fire. Minecraft did. Log4j devs didn't have a contract with Minecraft, they weren't losing money because Minecraft's house was on fire, none of this had to be an emergency for them. But somehow, not only is this suddenly log4j's problem to solve, but also it's their fault that Minecraft used their code and they're somehow responsible for perpetuating a 'broken' system?

It just doesn't make any sense; if you don't think that Open Source is maintainable or safe, then don't use it in your company. If you think it's valuable, then think more than 3 months down the road and commit to helping it thrive so you can continue to rely on it (and explain to your shareholders that sometimes share price is affected by zero-day vulnerabilities in products). Or don't, but then don't expect us to do a bunch of soul searching over how we can serve you better or change our culture to suite you.

Feels very weird to be relying on a commons as critical infrastructure by your own choice, and then complaining that the people building the commons are the problem because they're somehow enabling the system.

> AGPL/Copyleft/Ethical Source/Noncommercial licening and Social Domain licenses all seem to be pointing to a new economic future that

I don't understand why it's the job of people working for free to not only give people their code for free, but also to figure out the entire social/economic structure for how to get companies to contribute to the ecosystem.

I regret my use of the word "freeload" because of all the baggage it drags with it. I think companies are perfectly legally and ethically fine paying $0 for something that explicitly comes at no cost. But it's also rare that I see a company think about how critical a piece of open source is to their business, and realize that paying in some way (if possible) can be a good way to mitigate business risk. I think most companies don't really consider that risk in the first place.

Great, another HN comment from someone who read the first sentence or two, was enraged by a duck analogy and decided to hit reply.