Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Building on Corporate-Controlled Languages

blog.deckc.hair

Post reply on HN
Print view View original

121–130 of 324 posts

Re: Stop Building on Corporate-Controlled Languages

#121

Post by jeltz »

mseepgood wrote: post #57
chomp wrote: post #42

Earlier quoted context omitted.

Golang out of the box aggregates and analyzes usage metrics of modules whenever they are downloaded.

Which package management system doesn't do this?

On top of my head: CPAN and Debian's since both are distributed with mirrors not controlled by the the main project. It is possible that some mirrors save statistics but there is no aggregation of it. But, yes, most package manager servers track download statistics and as long as they throw away the IP addresses I do not see any harm.

Re: Stop Building on Corporate-Controlled Languages

#122

Post by vluft »

nandalism wrote: post #102
jchw wrote: post #23

My response to the plea in this article is simply "No thanks." If Go gets that bad, I'd be happy to use an ungoogled fork of it, or migrate to another toolchain or language, or whatever needs to happen. But until then, I'm not going to preemptively switch ecosystems and banish technically good options from my tool belt because I have fears about what could happen. I want production quality toolchain and runtimes. Tha…

As I said I love golang. I invested a lot of my own time into learning it and its ecosystem. The time developers spend learning a language and its libraries should not be discounted. Maybe we overestimate how much corporate backing is required to make a language a success. After all we had successful languages and ecosystems long before any corporations became interested in funding such things. You mention golang's c…

go's crypto is all original to go (other than possibly some assembly implementations ported from other projects), and nearly uniformly excellent.

I would take the go TLS implementation over, say, openssl (which is what many/most other languages end up using) any day of the week.

Re: Stop Building on Corporate-Controlled Languages

#123

Post by stcroixx »

bob1029 wrote: post #91
jchw wrote: post #23

My response to the plea in this article is simply "No thanks." If Go gets that bad, I'd be happy to use an ungoogled fork of it, or migrate to another toolchain or language, or whatever needs to happen. But until then, I'm not going to preemptively switch ecosystems and banish technically good options from my tool belt because I have fears about what could happen. I want production quality toolchain and runtimes. Tha…

> I'm not going to preemptively switch ecosystems and banish technically good options from my tool belt because I have fears about what could happen. This is exactly where I am at. I use Windows/C#/.NET without any shame for absolutely everything. The more developers who give me grief on some principled basis that " bad, so everything related is bad", the more I double-down on my position. These non-technical argumen…

In the late 90's I used to sit next to a team of about 20 VB developers. When MS decided to make VB obsolete, those folks had to re-learn software development and were getting intern like opportunities because suddenly all that VB knowledge and experience was worth exactly zero. Hopefully y'all fare better when they decide to nuke C# and .NET.

Re: Stop Building on Corporate-Controlled Languages

#124

Post by vluft »

nandalism wrote: post #104
shadowgovt wrote: post #66

I don't think I understand the ask here. Author's claim is they're concerned about corporate ownership of the languages but the examples they cite of concrete issues is the system "phones home." Well, so does Python every time I pull a pip package in. So does every package manager. Is there an implied "I don't trust the phone-home features of package management systems supported by corporations" that doesn't apply to…

Pip is separate from python itself. With a given language can I download packages with curl and install them myself? I think I can trust curl. The problem is not only that the tool connects to the networks, but who is behind the tool. Google is a company whose business is collecting all the information on people it can. I don't think those in control of python/pip have the same incentives.

there's nothing preventing you from downloading go code manually without the package manager and using it that way

Re: Stop Building on Corporate-Controlled Languages

#125

Post by rightbyte »

horsawlarway wrote: post #82

I think this is a fairly misguided rant, and ignores the real priorities (and risks) that I have as a developer - both personally and professionally. I'm happy to use languages funded by corporations - the incentives for them are clear, they fund development and work on the tooling and spec for their own use-case - they garner additional support, momentum, and goodwill by releasing the language under an open definiti…

He admits C was corp sponsored though.

"Admittedly C also came from a corporation but it came free with every unix install and soon after I started using it, Richard Stallman et al. gave us GCC, a free C compiler."

But at the time AT&T couldn't spy on its CC users though so the risk was lower I guess.

Re: Stop Building on Corporate-Controlled Languages

#126

Post by davidw »

alphazard wrote: post #18
anonyme-honteux wrote: post #8

Open source projects are under financed and their maintainers are overwhelmed. I would rather read proposed solutions about that because that seems like the more important problem.

The economics of independently lead open source is still a problem with no solutions in sight. The economics for corporate controlled open source are quite clear. It's a cost saver for corporations to open source solutions to common problems. This gets others to buy in, which spreads maintenance costs and ensures that no one is seriously winning in the domain of the project. Essentially de-risking cost/benefits in th…

The economics of all this is where it's at, and so important to understand.

Look at through a lens of scarcity. What Google sells that is 'scarce' is not the Go runtime - it's ads and other things.

But an independent open source project doesn't really have a source of 'scarcity' that it can sell.

https://journal.dedasys.com/2007/02/03/in-thrall-to-scarcity...

Re: Stop Building on Corporate-Controlled Languages

#127

Post by theteapot »

cbushko wrote: post #93
jchw wrote: post #23

My response to the plea in this article is simply "No thanks." If Go gets that bad, I'd be happy to use an ungoogled fork of it, or migrate to another toolchain or language, or whatever needs to happen. But until then, I'm not going to preemptively switch ecosystems and banish technically good options from my tool belt because I have fears about what could happen. I want production quality toolchain and runtimes. Tha…

The same goes for huge open source projects like Kubernetes. The amount of money to run the infrastructure for CI/CD and CDN is in the millions per year. Someone has to pay for that and the big companies are the ones that fit the bill. Google mostly pays for it but others have started contributing also. For example, Amazon recently announced that they are funding part of the infrastructure also.

How much does AWS make from just EKS? Tossing some change to support k8s ecosystem seem like a pretty good investment.

Re: Stop Building on Corporate-Controlled Languages

#128

Post by AnimalMuppet »

giaour wrote: post #29
nwah1 wrote: post #5

Earlier quoted context omitted.

Also, you end up with very similar questions for non-corporate languages like Nim because you don't really know who created the software, what their motives might be, and whether the binaries you are receiving are really what the source code says it is. Reproducible builds help, but once you are going down this path of verifying instead of trusting, then it doesn't really matter who built the software.

I have seen this perspective a lot in government and adjacent entities. For them, commercial software and corporate open source has a clear financial motive. If they can't identify why a project exists and continues to receive support, they see a security risk, either via direct compromise or project abandonment and the associated supply chain rot.

But that concern exists on the other side just as much! Companies get compromised, companies abandon projects. And companies, even though they make money from a project, decide that they could make more money by having it ship them data on the side.

Re: Stop Building on Corporate-Controlled Languages

#129

Post by HideousKojima »

crtc wrote: post #72
mseepgood wrote: post #57

Earlier quoted context omitted.

Which package management system doesn't do this?

True, I quickly checked https://rubygems.org/ https://www.nuget.org/packages https://crates.io/ ... they all show download statistics of their packages.

Which also serves a useful purpose for devs, it's an easy way to avoid typosquatting by making sure you're not looking at a package with a similar name to the one you want but with only 2,000 views instead of 2,000,000

Re: Stop Building on Corporate-Controlled Languages

#130

Post by [deleted] »

spankalee wrote: post #88
[deleted] wrote: post #37

[deleted]

I work for Google now on an open source project, and have worked on open source language projects for them before. This is just not how things happen. At all. There's a lot of fear in our post about things that _could_ happen, but haven't actually happened in Google's history, or aren't unique to corporate sponsorship. > 1. I wouldn't be able to refuse if they told me to add tracking, analytics, AI "learning", or loc…

[deleted]
Post reply on HN