Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Open source” is broken

christine.website

Post reply on HN
Print view View original

101–110 of 357 posts

Re: “Open source” is broken

#101

Post by jobigoud »

wyldfire wrote: post #26

> I simply do not want to be in a situation where my software that I develop as a passion project on the side is holding people's companies together. People love to hate on Richard Stallman but he was really clear about the motivation for Free Software (which is not the same as Open Source but shares some tenets). What companies do with the source is their thing. They get all of the benefits and all of the responsibi…

> What companies do with the source is their thing. They get all of the benefits and all of the responsibilities.

I know this very well and for some irrational reason it still makes me anxious to think about the many people relying on one of my free-time project that is used in classroom and medical settings. When there is a nasty bug found it's hard to shake the feeling of responsibility.

I have disabled the counting of downloads for this reason, I would rather not know just how many people rely on it and instead focus on improving it without pressure.

Re: “Open source” is broken

#102

Post by whateveracct »

TheRealPomax wrote: post #39
betwixthewires wrote: post #17

I don't think it's that big of a deal honestly. If some guy in Nebraska maintains some library that is very useful and your company relies on it and does not pay him, you're asking to wind up relying on an unmaintained project eventually. If I maintained something extremely valuable and found out a core google product relied on it, I'd stop maintaining it.

You say that as if you even know your full dependency chain. Reality doesn't quite work that way. No one knew their codebase even relied on leftpad until it broke millions of applications the world over when it got pulled. Some projects have the benefit of notoriety (log4j falls in that category) but plenty of projects are just "plumbing" and the only thing you know is the name of the dependencies you have in your de…

> You say that as if you even know your full dependency chain. Reality doesn't quite work that way. No one knew their codebase even relied on leftpad until it broke millions of applications the world over when it got pulled.

We're professionals - we in fact simply can do that with some elbow grease. Doesn't take a genius to understand how software is built.

Re: “Open source” is broken

#103

Post by blindmute »

zaarn wrote: post #43
wyldfire wrote: post #26

> I simply do not want to be in a situation where my software that I develop as a passion project on the side is holding people's companies together. People love to hate on Richard Stallman but he was really clear about the motivation for Free Software (which is not the same as Open Source but shares some tenets). What companies do with the source is their thing. They get all of the benefits and all of the responsibi…

Except you can't because hundreds of thousands of project have "log4j" in their dependency list not "wyldfire-fixed-log4j". If log4j broke and there was no maintainer, a fork would not fix things.

Code doesn't just "break". It still works the same. If a vulnerability is discovered you either update the package or switch to a fork. Switching is not really that much extra work compared to updating. This issue has really nothing to do with open source except that you have the extra option of forking.

Re: “Open source” is broken

#104

Post by quickthrower2 »

zaarn wrote: post #43
wyldfire wrote: post #26

> I simply do not want to be in a situation where my software that I develop as a passion project on the side is holding people's companies together. People love to hate on Richard Stallman but he was really clear about the motivation for Free Software (which is not the same as Open Source but shares some tenets). What companies do with the source is their thing. They get all of the benefits and all of the responsibi…

Except you can't because hundreds of thousands of project have "log4j" in their dependency list not "wyldfire-fixed-log4j". If log4j broke and there was no maintainer, a fork would not fix things.

Thats the problem. If you use say React then you are using it as is without any warranty implied. React is the equivalent of an aircraft in complexity when looking at its dependencies and then the browser stack itself on top!

React gives you a free copy of an aircraft and will probably maintain it for years. But maybe they rely on an altimeter developed by a poor person who decides they dont have time to work on it because they need to help their mum.

Well thats everyone elses problem now.

but the ease of download and use of React and other code libraries creates a sense of entitlement.

Yes if its broke and you need it fixed you have to pay someone now!

Its still libre its just not gratis anymore

Re: “Open source” is broken

#105

Post by webmaven »

senko wrote: post #53
rakoo wrote: post #50

This is a point I've been pondering about recently, especially since the attacks against Free Software and RMS. I've been convinced of the inherent good that openly available software is, both for users and developers, and for society at large. I want to continue contributing to the common goods. But I am also fully aware that Google, Facebook, Twitter, Instagram, Snapchat, Tiktok, and all other platforms exploiting…

Copyleft wouldn't help here. You don't need to do anything if you just use the code as-is.

While not a complete solution, the AGPL helps close this loophole.

Re: “Open source” is broken

#106

Post by zaarn »

blibble wrote: post #97
zaarn wrote: post #43

Earlier quoted context omitted.

Except you can't because hundreds of thousands of project have "log4j" in their dependency list not "wyldfire-fixed-log4j". If log4j broke and there was no maintainer, a fork would not fix things.

the documentation also needs to include the 5 line dependency exclusion that you place in your pom to exclude the bad version

And if you do that everytime an unmaintained project gets a 10 severity CVE, we'll have that at 200 lines in no time. Proabably petition whatever generates your Pom.xml to auto-include those lines.

Re: “Open source” is broken

#107

Post by quickthrower2 »

Part of the solution is instilling a fuck it, let it break, “left-pad” attitude in the core util maintainers across all languages and platforms.

This will be the chaos monkey you’d need to build resilience in open source.

I can see in such a scenario the big companies taking more interest in paying maintainers or forking and maintaining it themselves.

Maybe a open source strike is needed? A year without security patches on anything maintained by an unpaid individual or team.

Re: “Open source” is broken

#109

Post by IiydAbITMvJkqKf »

zaarn wrote: post #92
the_duke wrote: post #90

Earlier quoted context omitted.

Some package managers (eg yarn , cargo) have a solution for that and allow you to specify a local resolution override that will apply to all dependencies.

But again, that means EVERY single product, open source or not, will have to patch their deployment to use the fork instead of simply using the updated version of upstream. Permanently no less if it's unmaintained. Meaning every single Java product would have to include that "if you want to use log4j, you have to include this patch line to use a fork, because of unmaintained dependencies". That just ossifies log4j an…

You can fix it for your own applications and libraries. The tooling exists.

You can't force other people to use your fork.

Re: “Open source” is broken

#110

Post by fargle »

xena wrote: post #3

I'm the author of the post in case you have any questions for me.

A thoughtful piece, and most supporting points are real and I think I agree with them. However, I don't think the conclusion "Open Source is broken" follows from the arguments.

The most concise counter-example I can come up with is: What would change if that XKCD picture had the critical log4j2 component replaced with closed-source "McA$$hat logj2+ ENTERPRISE" trialware+commercial $$$$ licensed product that was thanklessly maintained by severely underpaid hire-and-fire contractors in a 3rd world country? Nothing. Well, it'd be a lot worse because you couldn't fix it.

What's broken is larger umbrella projects and products, open-source and commercial, not understanding that they own and are responsible all the dependencies. All of them. Down to the very bottom of the stack. Whether they bought them or got them for free. Each and every dependency must be evaluated, and if it's appropriate, you could delegate the risks to a trustworthy sub(contractor) or project.

What if that project gets abandoned? What if "McA$$hat Inc." goes out of business? Or either just changes direction or quality suddenly? Will the security bugs be reported or covered up or remain undiscovered because nobody uses the thing?

I currently trust Linux. I trust the "big" distros. I trust a lot of larger, well maintained opensource projects. I'm very hesitant about things like node.js and others that have very fine grained and super-easy automatic dependency management and build systems the just pull whatever the latest thing is for hundreds or thousands of dependencies. I really don't trust most commercial software because it's always just as broken, but you can never see it nor fix it.

A lot of the article focuses on getting paid. I totally agree and the market will definitely correct when it becomes visibly critical. You can get paid to maintain opensource commercially and that's probably the best of both worlds. There's going to be a lot of people working for a lot of companies getting paid to fix or replace log4j2. There's going to be a lot of people paid to figure out how to get better control over that XKCD picture situation.

But Open Source isn't broken, it's the cure just working it's way along by making that picture visible.

Post reply on HN