Stop Building on Corporate-Controlled Languages • Hacker News Board

Re: Stop Building on Corporate-Controlled Languages

#71

Post by runjake » Wed, Jan 18, 2023, 5:23 PM UTC

rstat1 wrote: post #51

runjake wrote: post #24

Earlier quoted context omitted.

There's some risk. A language and it's tooling can be GPL or BSD-licensed, but if it's corporate-controlled, the following things can happen: - The corp still doesn't need to take direction, nor input, nor patches from the community. - The corp can steer the language and frameworks wherever they want. Sure, you may be able to then fork it, but is that fork going to gain any traction? Probably not. And it definitely w…

> The corp still doesn't need to take direction, nor input, nor patches from the community. >The corp can steer the language and frameworks wherever they want. Sure, you may be able to then fork it, but is that fork going to gain any traction? Probably not. These both apply to not-corporate projects as well.

Touche.

Re: Stop Building on Corporate-Controlled Languages

#72

Post by crtc » Wed, Jan 18, 2023, 5:23 PM UTC

mseepgood wrote: post #57

chomp wrote: post #42

Earlier quoted context omitted.

Golang out of the box aggregates and analyzes usage metrics of modules whenever they are downloaded.

Which package management system doesn't do this?

True, I quickly checked

https://rubygems.org/

https://www.nuget.org/packages

https://crates.io/

... they all show download statistics of their packages.

Re: Stop Building on Corporate-Controlled Languages

#73

Post by jansommer » Wed, Jan 18, 2023, 5:24 PM UTC

Install those languages in a VM if you're concerned about things they phone home about. Not sure if the metrics being sent is the biggest problem unless you're super paranoid about intellectual property theft.

Re: Stop Building on Corporate-Controlled Languages

#74

Post by cosmotic » Wed, Jan 18, 2023, 5:25 PM UTC

hutzlibu wrote: post #55

cosmotic wrote: post #40

Earlier quoted context omitted.

These Microsoft examples are 20 years old. The company has changed leadership to a team that embraces open source years ago and I think they've done a pretty good job demonstrating this embrace. They have adopted open source Java, they further open sourced .NET, they've embraced Linux containers in Azure and WSL on windows, etc. Might be about time to reconsider this perspective of 'hate Microsoft'. Full disclosure:…

"they've embraced Linux containers in Azure and WSL on windows" I am open to the possibility, that Microsoft changed, but this example is a classic "Embrace, extend, and extinguish" tactic by my understanding. Linux is strong with developers and certain tech, but by incorporating Linux, Microsoft makes devs have many good sides of linux, but with all the nice proprietary windows extensions. So they stay on windows. A…

Do you know any linux users that have switched from linux desktop to Windows because of WSL? I think it's just leading to Windows devs embracing Linux.

Re: Stop Building on Corporate-Controlled Languages

#75

Post by anononaut » Wed, Jan 18, 2023, 5:28 PM UTC

Invictus0 wrote: post #60

Take off the tinfoil hat.

Come off it. This isn't 2001 anymore. Corpos dominate tech in every facet. Data harvesting has never been more egregious and rampant. This data can and has been used (read weaponized) in ways nobody could have predicted. It's important we cover our asses and wash our hands when we make decisions about long term projects. To dismiss these concerns and opinions as crazy is disingenuous or at worst borderline malicious.

Re: Stop Building on Corporate-Controlled Languages

#76

Post by numbsafari » Wed, Jan 18, 2023, 5:29 PM UTC

giaour wrote: post #29

nwah1 wrote: post #5

Earlier quoted context omitted.

Also, you end up with very similar questions for non-corporate languages like Nim because you don't really know who created the software, what their motives might be, and whether the binaries you are receiving are really what the source code says it is. Reproducible builds help, but once you are going down this path of verifying instead of trusting, then it doesn't really matter who built the software.

I have seen this perspective a lot in government and adjacent entities. For them, commercial software and corporate open source has a clear financial motive. If they can't identify why a project exists and continues to receive support, they see a security risk, either via direct compromise or project abandonment and the associated supply chain rot.

and they aren’t wrong to do so.

Browser plug-in author gets bored and sells out customer base is a well tread story.

Takeovers of well known packages are another.

Most of these ecosystems do not offer proper sandboxing for the things we take from them, so it’s easy for things to grow an appendage that abuses our prior assumptions.

Apache’s Java ecosystem is full of consultant abandonware and tripwires.

Re: Stop Building on Corporate-Controlled Languages

#77

Post by sergiotapia » Wed, Jan 18, 2023, 5:30 PM UTC

>Unfortunately this is no longer true as compilers and editors now have integrated package managers. We expect them to communicate on the network and we don't really know everything they might be communicating.

I really agree!

Elixir is my main workhouse language, I love it and the Phoenix platform as well. I also really enjoy using Nim. It's _fast_ and looks great, easy to write too.

Nim is one killer web framework away from the main stage. It will capture a lot of attention once it has a batteries included web framework. Think Rails, not Sinatra.

Re: Stop Building on Corporate-Controlled Languages

#78

Post by jonathankoren » Wed, Jan 18, 2023, 5:30 PM UTC

AnEro wrote: post #9

nwah1 wrote: post #3

Terrible arguments. Golang and Android Studio are both open source, and you could compile them yourself. Telemetry can be turned off in Android Studio, and you can use stuff like flatpaks to isolate the software from your system, and completely turn off networking permissions if you don't trust the settings.

I agree, but I do think that you have to think of the ecosystem of the language if the major cooperation steps away or dials back, maybe thinking of them more like 'dependency'. Go lived through community alone, how well will twitters projects hold up without their involvement because I imagine it's not very lean for twitter to spend time on. I think this argument is better had for frameworks and JavaScript libs. Hav…

This is the real threat. So much “open source” technology is just free community editions of closed source software. If any of these companies decide to change course for any reason, you’re screwed. Who’s going to pick it up? You? No, you were coasting along on someone else work, you don’t have a good expertise or slack to support it. But someone who law will right? Nah. They’ll just shrug and pivot, as will you.

Maybe I’m just bitter, but I’m on my third “open source” text editor because of machinations inside megacorps suddenly deciding shutdown perfectly fine projects.

Re: Stop Building on Corporate-Controlled Languages

#79

Post by snowpid » Wed, Jan 18, 2023, 5:31 PM UTC

Also even if phoning home is a concern: Thanks to GDPR Google has to say what they save. Even if they save more, they need a way to ask for permission and to delete if I don't want that.

Of course Google could dismiss the law but then they have to pay massive fees.

Re: Stop Building on Corporate-Controlled Languages

#80

Post by bulatb » Wed, Jan 18, 2023, 5:32 PM UTC

pessimizer wrote: post #43

bulatb wrote: post #25

Alternatively: "Stop complaining no one eats their vegetables and make a vegetable that people want to eat."

People don't know what they want to eat until aggressive marketing convinces them to have a taste.

I guess moralizing could be seen as an extremely ineffective form of marketing, if it's done at people rather than problems. That's an interesting angle, thank you.