Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Open source” is broken

christine.website

Post reply on HN
Print view View original

341–350 of 357 posts

Re: “Open source” is broken

#341

Post by CRConrad »

xena wrote: post #163
kortilla wrote: post #156

> If log4j2 is responsible for your company's success, you have a moral obligation to donate to the person who creates this library thanklessly. This is absolutely not what open source is about. The author just sounds completely against open source, which is fine, but don’t lecture people for not paying for that which was intended to be free.

I'm the author in question. I'm not against open source, I'm against the culture of taking without giving back.

So, given the response here, do you think you expressed that particularly well?

Re: “Open source” is broken

#342

Post by cxr »

zozbot234 wrote: post #171
montroser wrote: post #73

No, it's not broken -- it's thriving. Everyone involved has their own incentives, and gets to make their own decisions about when and where to invest their time and money. Some devs are in it for the passion, some for the experience, some for the challenge, some for the learning, some so their work will live on when they change employers. Startups get to use well-tested community supported libraries and don't have to…

ESR - the person who coined "open source" in the first place! - agrees that this is a problem worth addressing. See his Loadsharers initiatve http://www.catb.org/esr/loadsharers/ (more info at https://esr.gitlab.io/loadsharers/ ) discussed http://esr.ibiblio.org/?p=8383 http://esr.ibiblio.org/?p=8387 http://esr.ibiblio.org/?p=8403

> ESR - the person who coined "open source" in the first place!

He popularized the term. He didn't coin it (and AFAIK he doesn't claim to, although even if he were, it would be a separate matter).

Re: “Open source” is broken

#343

Post by thwarted »

CaptArmchair wrote: post #281
thwarted wrote: post #207

Earlier quoted context omitted.

> Yes, open source licensing allows forking, but that's not something you'd do, for instance, because a maintainer fails to respond to your issues on GitHub. Huh? Not getting satisfaction, however you want to define that, from upstream is the main reason forking occurs.

Yes, forking occurs. But before you, you would reach out, ask permission, offer a solution and try to come to a compromise with the original authors. Downright forking while ignoring the original authors and then putting it out there as an independent alternative to theirs? Well, that's just entitled behavior. The "fork" button on GitHub exist primarily to make it easier for contributors to create pull requests and c…

> you would reach out, ask permission

The specific case was "maintainer fails to respond", which implies that one was reaching out. It doesn't really matter why they don't respond, perhaps the maintainer died, or they are burned out, or maybe they just don't like you.

> Downright forking while ignoring the original authors and then putting it out there as an independent alternative to theirs? Well, that's just entitled behavior.

Entitled by the very license the maintainer attached to the software. But if you meant "entitled behavior" as some kind of indicator of privilege, well, everyone has that entitlement per the license, so I'm not sure if that really counts as being entitled.

Re: “Open source” is broken

#344

Post by historynops »

jchw wrote: post #173
suriyaG wrote: post #128

Earlier quoted context omitted.

I mostly agree with your argument. But, if we just de facto accept everything for how it has been in the past. Then we stop making things better, for everybody involved. Is Open-Source thriving? yes. Can we make fix the places where it's broken? Also, Yes.

> Can we make fix the places where it's broken? Also, Yes. Two problems: 1. How is it broken? As I and others in this thread attest to, the thing that makes open source so powerful is, in fact, the lack of legal and moral obligation to do anything in exchange for the right to use the software. Not having obligations is a two-way street. Same for donations; donations do not give you any additional assurances. 2. If it…

"everyone rushes to support a project the moment it hits the news, that's not sustainable."

This is exactly how a lot of things function, especially in government and disasters. So apparently it is sustainable. It's just not ideal, but this element is always going to be a part of human nature as our collective consciousness can only focus on fixing a few things at a time.

Re: “Open source” is broken

#345

Post by esarbe »

mbrodersen wrote: post #317
esarbe wrote: post #276

Earlier quoted context omitted.

Human society has for thousands of years relied on unpaid voluntary labor. Be it taking care of the elderly, taking care of the sick and the poor, managing public spaces, organizing festivals, on and on and on. Human society is built on voluntary participation much more than on monetary incentives. It's part of the capitalistic delusion that only what a price label has attached has worth; you are conflating "worthles…

Not at all. A lot of things have intrinsic value. Like the things you mention (taking care of the sick etc.) That is different from its market value (what people want to pay for it). The problem is that some OSS maintainers think they are the same, expecting the intrinsic value of their work to automatically convert into market value (them getting paid). That is not how it works.

> Not at all.

Sorry, I don't know what you are referring to. Are you refuting any of my arguments? If so, please let me partake in your reasoning.

> The problem is that some OSS maintainers think they are the same, expecting the intrinsic value of their work to automatically convert into market value (them getting paid).

I don't think that this is what is currently happening, isn't it?

You don't hear the log4j maintainers complain that all these big companies leech of their work and they are owed. Many of these companies do make quite some nice profits and very seldom is the dollar that gets paid back voluntarily. And that's fine for pretty much every FOSS developer. Very seldom I hear about FOSS developers angry that companies use their product to make money. Usually these developers switch to different, commercial licenses.

Quite the contrary; it's these big tech companies that are in trouble. They are in trouble because they are liable. The log4j developers are not responsible for fixing these bugs. Why should they? FOSS licenses come with explicit denials of liability.

The big tech companies are in trouble because they saw something for free and saw that they would save the market value in expenses for a similar commercial product. But they forgot that they are also relying on voluntary labor that comes without responsibility by the authors. And now they are on the hook.

They should have recognized that by skimping on the dough and using FOSS software the same way they use commercial products they also took on unmitigated risk. And because they are so cheap, they didn't consider mitigating that risk by supporting the development of the software they so depend on.

If just one or two dozen companies had paid a measly few dollars every month to the developers of log4j, this could have all been avoided. But they were shortsighted and greedy, as capitalist companies have to be shortsighted and greedy. And now they have to own the mess they made.

Suites them right, I say. Though I doubt they will learn their lesson, don't you?

Re: “Open source” is broken

#346

Post by alexvoda »

zaarn wrote: post #262
alexvoda wrote: post #208

Earlier quoted context omitted.

You can not force your dependencies to do what you want. You can only patch the problem for yourself and maintain that patch in the build system, or you can fork each dependency in the chain, maintain those and then your build system is cleaner. There is nothing wrong with these options.

Forking yourself is not scalable for fixing a 10/10CVE and I don't get how people think that somehow "fork it" is a viable solution across the entire industry. This is not about forcing my dependencies to do anything, this is about caring about maintainers and maybe ensuring that the bedrock of our ecosystems aren't maintained by unpaid volunteers in their free time, exploiting the sweat on their backs for our amusem…

Entirely agree, we should find ways to reliably support upstream. But that is a different issue, and unfortunately it is one that the main beneficiaries are not willing to solve.

Forking solves the issue of an upstream dependency not willing to fix a bug.

Re: “Open source” is broken

#347

Post by zaarn »

alexvoda wrote: post #346
zaarn wrote: post #262

Earlier quoted context omitted.

Forking yourself is not scalable for fixing a 10/10CVE and I don't get how people think that somehow "fork it" is a viable solution across the entire industry. This is not about forcing my dependencies to do anything, this is about caring about maintainers and maybe ensuring that the bedrock of our ecosystems aren't maintained by unpaid volunteers in their free time, exploiting the sweat on their backs for our amusem…

Entirely agree, we should find ways to reliably support upstream. But that is a different issue, and unfortunately it is one that the main beneficiaries are not willing to solve. Forking solves the issue of an upstream dependency not willing to fix a bug.

As I've pointed out a few times now, forking upstream is not a long term or sustainable solution.

Re: “Open source” is broken

#348

Post by seqizz »

mbrodersen wrote: post #206
seqizz wrote: post #9

Well, I agree but no solution in the horizon yet. Yes, the companies which profit from open source "should" fund the open source. But nothing forces (or even reminds) them to do so.

Why should they? The developers giving away their work for $0 are telling the world that their work is worth $0. So why should the companies pay more than $0 for it? That doesn’t make sense at all.

Sorry just saw this. But "worth" is not calculated by money every time, no? E.g. we're not paying for oxygen while breathing but I wouldn't consider "weather costs $0 so it is worthless". But (continuing from the same example) if the weather is being hard to breathe due to pollution, I seek some action to fix this situation. That was what I am trying to find out, how could one enforce some payment out from this system, but can't see any workaround yet.

Re: “Open source” is broken

#349

Post by localhost1729 »

CRConrad wrote: post #333
localhost1729 wrote: post #301

Earlier quoted context omitted.

The law that mandates that companies can't donate to someone on Patreon or help triage bugs or dedicate QA/security time to identifying issues is the requirement for CEO's to demonstrate good judgment in managing the company by maximizing profit for shareholders. The law that mandates that companies have to ignore maintainer burdens is similar, but much more obtuse, mainly concerning commercial and workplace agenda i…

> The law that mandates that companies can't donate to someone on Patreon or help triage bugs or dedicate QA/security time to identifying issues is the requirement for CEO's to demonstrate good judgment in managing the company by maximizing profit for shareholders Dows this law forbid them from paying support contracts to Oracle or IBM/Red Hat or anyone else? Hey, if nothing happens that needs support, that money cou…

You don't seem to understand the dialectical shape of this argument. You would have to try to understand better how two things that seem opposite could both be true.

For example, Microsoft could pay Red Hat for whatever they like, but this does not contradict the general law of profit maximization. It is possible for a large tech company to achieve both these goals together (support for open source and undermining open source) without undermining the general law, which is to reduce costs wherever possible and maximize profits for shareholders however possible.

You need to think a bit more about the motivations and rules operating here, and if you do, you can't fail to come down on the conclusion that it is open source that is broken, because it reproduces the free rider problem as a well documented and persistent market failure.

Re: “Open source” is broken

#350

Post by localhost1729 »

davidgerard wrote: post #326
localhost1729 wrote: post #301

Earlier quoted context omitted.

The law that mandates that companies can't donate to someone on Patreon or help triage bugs or dedicate QA/security time to identifying issues is the requirement for CEO's to demonstrate good judgment in managing the company by maximizing profit for shareholders. The law that mandates that companies have to ignore maintainer burdens is similar, but much more obtuse, mainly concerning commercial and workplace agenda i…

> the requirement for CEO's to demonstrate good judgment in managing the company by maximizing profit for shareholders. this is an inanely incorrect urban legend of a claim. The business judgement rule overrides it except in amazingly egregious circumstances, and paying the maintainers of business-critical upstreams would be profoundly unlikely to be such a circumstance.

Not really. Payments made to maintainers of business-critical upstreams are only sanctioned at board level if the failure to pay could result in identifiable additional risk to the business. As a general rule, this plays out as a kind of high level socialist monopolizing for big tech, and low level capitalist competition for everyone else.
Post reply on HN