871–880 of 1001 posts
Earlier quoted context omitted.
The solution to fix FLOSS is for it not to be FLOSS?
How does a maintenance contract make the software not-FLOSS? It's a working option if you need more promises than the license gives you.
Many people interpret it as "Free as in beer", not "Free as in speech", so expecting people to pay for it disqualifies it as FLOSS.
Earlier quoted context omitted.
How does a maintenance contract make the software not-FLOSS? It's a working option if you need more promises than the license gives you.
The F in FLOSS is supposed to stand for Free. Many people interpret it as "Free as in beer", not "Free as in speech", so expecting people to pay for it disqualifies it as FLOSS.
Should I get paid for my multiple contributions to faker (I don't think I should)? I've submitted several PR's for generating data all of which were accepted. Even back then the maintainer was barking about money... Honestly the project would be better off forked. He did not write this library entirely by himself, at this point I just see him as holding other committers contributions as hostage. It's a bad look, why…
> Should I get paid for my multiple contributions to faker (I don't think I should)? The biggest thing that excites me about the possibilities for the future of smart contracts is that creators of all kinds could automatically benefit from any work they do. This scenario, for example: Any company that used faker.js to make a profit would have X% of that revenue feed back to the smart contracts. The creator would prob…
Quick notes:
- I'm talking about a hypothetical ideal future as I see it, and why that's exciting to me
- I don't think we're anywhere close to where we need to be for this to be realistic. More like 50+ years when we figure out patents, copyright, delivery, and fine-detail privacy-friendly monetization (person X purchased Y because of seeing a billboard and having conversations with sales rep Z.)
- I like moonshots. I think that setting big ideals as goals is a great way to get to where we can be as a society and as a planet. No one else is obligated to share that mindset or those goals (or even agree that those ideals will get those goals)
Earlier quoted context omitted.
> Should I get paid for my multiple contributions to faker (I don't think I should)? The biggest thing that excites me about the possibilities for the future of smart contracts is that creators of all kinds could automatically benefit from any work they do. This scenario, for example: Any company that used faker.js to make a profit would have X% of that revenue feed back to the smart contracts. The creator would prob…
>The biggest thing that excites me about the possibilities for the future of smart contracts is that creators of all kinds could automatically benefit from any work they do. >Any company that used faker.js to make a profit would have X% of that revenue feed back to the smart contracts. Doesn't work in the real world. If you rely on them to tell you what their profit are for a project, they'll just give you a value of…
If we were in a different version of the world (which we might end up in), it will be a no-brainer for someone to create a company that openly builds on the work of others and shares profit with those others. It democratizes the "I only need a small piece of a big pie" business model.
Earlier quoted context omitted.
That sounds like a personal problem. .deb and .rpm packages are nothing more than tar archives with a specific file structure. dpkg and rpm both have options to extract the package locally. dpkg -L NAME will show you all the files the installed package has placed on your file system (not generated ones by the code obviously but ones that came with the archive). pip has similar options. More broadly, and I am sorry if…
The point is, if you want people to review the code before they deploy it, it's better to just give them a source file. Package managers just make it so convenient to use code without ever looking at it.
Earlier quoted context omitted.
If that is true it's an outrageous overreaction by GH. Are they now gatekeeping the kinds of code changes you can make to your own repo?
The maintainer was already temp-banned from GH around 2013 for "creating a script that forced people to watch a library that [he] created", whatever that means: https://youtu.be/varf6oWaFtU?t=202
Earlier quoted context omitted.
> Should I get paid for my multiple contributions to faker (I don't think I should)? The biggest thing that excites me about the possibilities for the future of smart contracts is that creators of all kinds could automatically benefit from any work they do. This scenario, for example: Any company that used faker.js to make a profit would have X% of that revenue feed back to the smart contracts. The creator would prob…
The biggest challenge here is measuring the quality of someone's contributions and adjusting compensation accordingly. Not every commit is worth the same level of compensation. Companies like Google/Amazon have to go through and adjust compensation based on talent and contribution levels, but how would that be done in Open Source?
In [my] ideal scenario it's not the people that are vetted and compensated, but the work itself. A student who comes up with a particularly genius contribution could be compensated as equally as someone who worked in the field for decades and proposed the same contribution.
Note: it also requires an environment where work is recorded publicly so that plagiarism is essentially impossible, though that brings it's own challenges.
Earlier quoted context omitted.
> Should I get paid for my multiple contributions to faker (I don't think I should)? The biggest thing that excites me about the possibilities for the future of smart contracts is that creators of all kinds could automatically benefit from any work they do. This scenario, for example: Any company that used faker.js to make a profit would have X% of that revenue feed back to the smart contracts. The creator would prob…
The second someone puts out a 'faker.js' that does this companies will drop it, just as they ban AGPL software.
> I totally agree that it does not work in the current version of the real world.
Earlier quoted context omitted.
> There is nothing inherent in using packages that means you have to blindly trust the code I use about a dozen different package managers and I have no idea how to check the code they download before they install/deploy it. I often check the source on Github if I need to look something up, but I have no idea how I'd go about verifying that the code on Github is the same as whatever the package managers install.
In the context of PHP, the package source is put under vendor/ and in my IDE is automatically indexed. It's very easy to view the source code. You can even experiment with the packages directly, by editing the files in vendor/.
Earlier quoted context omitted.
It’s one side of the coin. The other is, to do anything at all of practical use in 98% of jobs, day 1 is installing a tonne of OS stuff. It’s not practical to expect pretty much every dev to inspect 100% of that, even if that’s what they implicitly agree to do in the license.
We're not talking about "a ton of OS stuff," we're talking about NPM packages. If you have your package manager set up in a way that allows it to automatically upgrade/break your code, that's 100% on you.
Seriously, you expect anyone to audit all this? It's basically impossible for any solo dev / small org, and as I say, it's not even a big project. A vulnerability is like half a line, or sometimes a typo.
Clearly, very different proposal for a large org, but even then, no small task.