Live data from Hacker News

I feel open source has turned into two worlds

utcc.utoronto.ca

21–30 of 53 posts

Re: I feel open source has turned into two worlds

#21
post #12

It's also notable that these companies often dont respect the terms of foss software at all. Anyone worth their salt can tell you that training your LLM on gpl3 code would make it a derivative product, as it is able to reproduce large parts of that code. LLMs that are currently earning Google, Facebook, Openai, etc, billions, while they obviously dont make "their" products available under gpl3.

I don't mind them training on GPL code, but I wish they had to at least publish their model weights (and maybe also training and inference code, etc.) - same for the other issues re. using copyrighted media in training.

Re: I feel open source has turned into two worlds

#22

At this point, why shouldn't the licences change? Sharing the result of collaborative efforts liberally makes sense. Wanting to be able to modify software and redistribute modifications makes sense. Allowing software to evolve in a broader eco-system makes sense. What isn't seeming to make sense is how OSS software is used commercially and the way that skews the culture and priorities of open source projects. What pu…

There's always a tradeoff in use or contribution. If a project is under a more restrictive license the odds of individuals or companies contributing (or for certain licenses even using) drops radically.

If your intent is just "I wrote this thing, sharing the code" license as restrictively as you'd like. If your intent is "I want to build (and/or get others to help build) a bigger thing", restrictions scare folks off.

It's trivial for me to get approval from my employer to do almost anything in almost any MIT-licensed codebase; we use and contribute to a number of GPLv2 codebases. However GPLv3 is a very rigid line in the sand that I do not expect to ever change.

Re: I feel open source has turned into two worlds

#24
post #14

Earlier quoted context omitted.

Uncompensated use for unshared reward is, by definition, leeching. The BBS use of the term referred to leeching in the context your upload/download ratio, the torrent use in the context of your seeded/downloaded ratio. ratio = (contributions - demands) : earnings If you contribute nothing, demand nothing, and earn nothing, carry on. “Nothing” is loosely defined as “near enough to zero in the context of a specific pro…

> If you contribute nothing and demand security fixes, then you’re not a leecher — you’re a parasite, because your demands exceed your contributions; There's the "demand" word again. Who is that demanded something from the maintainer, and where? I saw no indication in the original bug of any demands from big tech companies. (Just the act reporting a security issue is not a demand. A verifiable bug is a bug whether it…

Just looking at a few previous issues:

https://gitlab.gnome.org/GNOME/libxml2/-/issues/905#note_243...

Re: I feel open source has turned into two worlds

#25
post #14

Earlier quoted context omitted.

> If you contribute nothing and demand security fixes, then you’re not a leecher — you’re a parasite, because your demands exceed your contributions; There's the "demand" word again. Who is that demanded something from the maintainer, and where? I saw no indication in the original bug of any demands from big tech companies. (Just the act reporting a security issue is not a demand. A verifiable bug is a bug whether it…

Just looking at a few previous issues: https://gitlab.gnome.org/GNOME/libxml2/-/issues/905#note_243...

That doesn't look like Google, Apple or Microsoft though? It's some random guy.

Re: I feel open source has turned into two worlds

#26
post #14

Earlier quoted context omitted.

Uncompensated use for unshared reward is, by definition, leeching. The BBS use of the term referred to leeching in the context your upload/download ratio, the torrent use in the context of your seeded/downloaded ratio. ratio = (contributions - demands) : earnings If you contribute nothing, demand nothing, and earn nothing, carry on. “Nothing” is loosely defined as “near enough to zero in the context of a specific pro…

> If you contribute nothing and demand security fixes, then you’re not a leecher — you’re a parasite, because your demands exceed your contributions; There's the "demand" word again. Who is that demanded something from the maintainer, and where? I saw no indication in the original bug of any demands from big tech companies. (Just the act reporting a security issue is not a demand. A verifiable bug is a bug whether it…

On the spectrum of grey areas from “request” to “demand”, we not only have to evaluate the literal words typed but also the context and expectations of open source. As the libxml2 maintainer indicates, they are no longer willing to participate in security bug secrecy and priority. In hindsight, those expectations that most take for granted as necessary must have demanded considerable time and energy from them. They could have said no at any time, but not as easily as turning down a feature request. For asocial-leaning maintainers (hi!) saying no to security processes is no more difficult than refusing any other request — but for the vast majority of maintainers, it will take an effort of courage and will to refuse the ‘demands’ — the social pressures, the contexts and expectations — of security’s best practices, reporting processes, and priority overrides. (Elsethread, the individual making demands in an issue is also a case of ‘demand’ rather than ‘request’, that isn’t much in the in-between grey area at all.)

Psychologically, it hits different when a leecher — someone whose uploads are not greater than some minimum threshold — begins demanding something; what they receive then is not just a free copy of the maintainer’s work to profit from, but also the specialized work of the maintainer to satisfy or reject their request. The cumulative impact of dealing with parasites is distinct from the demotivating effect of profitable leechers who silently download their work and never say anything at all?(and also from the motivating effect of seeing millions of people benefiting from leeching — adoption is often a significant reward). Torrenting has no language for this difference, as in torrenting there is no such problem; so I did some research and chose ‘parasite’ here. I recognize that, scientifically, the animal ‘leech’ tends to be viewed as ‘parasitic’; but there’s a clear difference in connotations, as a torrent leecher is not viewed with – does not view themselves with — the same disgust and loathing as parasites are.

Re: I feel open source has turned into two worlds

#27
post #8

The current attitudes and licenses of FOSS, while good in many ways, have also enabled a ton of exploitation and free-riding, and people need to acknowledge that. Nobody should be giving Bezos free work.

The crowning achievement of FOSS is in convincing maintainers to accept exploitation as beneficial.

The FOSS era can be distinguished from the BSD/MIT era preceding it by its dedicated promotion of libertarianism in all shared source code conversations, which celebrates (quite defensively!) the resulting exploitation and free-riding as beneficial. While this is often presented as a natural outcome of BSD/MIT licensing, that FOSS viewpoint hinges on assumption-by-framing of exploitation without compensation as being morally neutral or positive. That framed assumption is false: the “scientists publish their work to each other” social climate that preceded it was openly hostile to entities who profited from work without ‘uploading’ via publication back to the community in return. Thus, the innovative social bargain of the GPL: you receive legal certainty that improvements to your source code will be shared back to you; then, FOSS advocacy uses adoption of the GPL as proof that exploitation without compensation is beneficial.

Re: I feel open source has turned into two worlds

#28
post #6
post #5

Earlier quoted context omitted.

I'd note that the only thing Apple, Google and MS are said to have done is to use the software. The bug has no actual example of them making demands, "leeching" or acting entitled. The security issues would be security issues just the same even if the library was only used by Linux desktops. (And if the library is unfit for use in other operating systems like the author suggests, feels like it probably is equally unf…

It's high-time for a "reasonable compensation" clause in hobbyists' open-source software licenses I think. Something to the effect of: "if you're using my labour of love to make millions, gimme one of these millions..."

I’d also like to see a license which prohibits any for-profit use. A don’t charge others for something you got for free license.

Re: I feel open source has turned into two worlds

#29
post #18

I feel bad for the libxml2 maintainer. The project was originally intended for parsing GNOME configuration files, but then a bunch of corporations started using it to parse untrusted data with much higher stakes. I hope that both the decision not to prioritize security issues and the new notice in the README saying it's foolish to use the project to parse untrusted data will encourage corporate users to either switch…

> Of course anyone's allowed to license their project any way they see fit, but they'll have to call it something other than open source and accept the limited distribution and userbase they'll see as a result.

This doesn't require abandoning open source. The GPL and AGPL serve precisely the purpose of preventing open-source software from being exploited for closed-source purposes.

Obviously hindsight is 20/20, so this doesn't help maintainers who have already chosen a permissive license and don't want to rugpull their users. But to say solving this problem requires adopting a non-open-source license is not correct.

Another option is dual-licensing - GPL/AGPL for all, or a permissive license that can be purchased for a fee.

Re: I feel open source has turned into two worlds

#30

At this point, why shouldn't the licences change? Sharing the result of collaborative efforts liberally makes sense. Wanting to be able to modify software and redistribute modifications makes sense. Allowing software to evolve in a broader eco-system makes sense. What isn't seeming to make sense is how OSS software is used commercially and the way that skews the culture and priorities of open source projects. What pu…

The Peer Production License and its relatives are pretty good generally. The problem is always license compatibility. One of the benefits of Open Source licensing being kind of standardized has been composability. There's been a pretty clear gradient of "restrictiveness" of licenses, so when you mix software together, you just have to use the most restrictive license of your dependencies (or one that is more restrictive). Copyfarleft licenses are a good thing, but they make the restrictiveness dimension diverge in different ways, so you can't necessarily mix them with each other, or with the GPL (say).
Post reply on HN