Professional maintainers: a wake-up call • Hacker News Board

Re: Professional maintainers: a wake-up call

#231

Post by coryrc » Sat, Dec 11, 2021, 11:24 PM UTC

nerdponx wrote: post #218

bscphil wrote: post #179

Earlier quoted context omitted.

> That's the point, they don't pay, and they don't get support. But they still complain You've put your finger on the core of the issue with FiloSottile's suggestion. The problem is that to sell something to a big corporation, you need to have something tangible you can sell. What you have are enormous pieces of widely used software, being given away for free. Many companies are going to take that and run with it, an…

Would it be unethical to refuse to fix bugs reported by employees of large corporations, unless those corporations pay a support contract or contribute a patch themselves?

No

Re: Professional maintainers: a wake-up call

#232

Post by alecthomas » Sat, Dec 11, 2021, 11:24 PM UTC

I maintain a lot of open source projects, but IMO this is not the right approach. I think the [anecdote from @jbk](https://news.ycombinator.com/item?id=29524103) about ffmpeg illustrates that.

I also don't think the problem it solves gives the greatest benefit for the amount of work required. I think making it easier for companies to pay open source contributors is the right approach. For any company that builds software, finding and paying the open source projects they use is a massive amount of work and there's nothing that helps with that. If there was much less friction to paying maintainers, more companies would do it.

I would love to see a tool that, given a pool of money, will collect dependencies from projects in any language (extensible), find the authors (git commit history, etc.), find where they accept contributions (extensible), and pay them, based on both computed and hand crafted weights.

Re: Professional maintainers: a wake-up call

#233

Post by etimberg » Sat, Dec 11, 2021, 11:26 PM UTC

wakeupcall wrote: post #55

As a maintainer of several OSS projects, I could work full time on them and have time for nothing else. Yet, I'm pretty sure that even if these projects would be 100x more popular, the donations I would receive wouldn't even pay my daily expenses. I refuse all donations/tips for three reasons: - as per above, your donation is generally insignificant. it's just overhead in tax accounting - people donate "with strings…

I've maintained a popular opensource project for the last 7 years. I finally relented and started a GitHub sponsors profile earlier this year. For a long time I had the same mentality about donations so when I set up my sponsors profile I made it super clear that I wasn't offering any perks for sponsorship. If someone chooses to donate, it's purely as a thanks for my work. Currently I make $6 a month so that covers a couple of coffees.

In terms of fairness to past contributors, I put the sponsorship on my personal GitHub account and not on the repo for the project I maintain.

Re: Professional maintainers: a wake-up call

#234

Post by wpietri » Sat, Dec 11, 2021, 11:31 PM UTC

mfer wrote: post #154

wpietri wrote: post #107

Earlier quoted context omitted.

It seems like you haven't quite got the concept of open source. If everybody consumes and nobody contributes, how long will that last? A while back I bought a cheap robot vacuum. Their scheduling feature didn't meet my needs, so I reverse-engineered the protocol and open-sourced a cron-friendly CLI tool and a library so people could do other things with it: https://github.com/wpietri/sucks Honestly, this was a mistak…

A few thoughts... I've long known people who modified cars. Sometimes they did it as a business. Sometimes they helped friends out. Sometimes the work was on nights and weekends. The car manufacturer never had a responsibility to support them. They never had to support people in forums. Anything they did was their choice. Sometimes as a business and sometimes volunteering. You didn't have to open source that work. On…

Sorry, what makes you think you're telling me something I didn't know? Do you honestly think I was somehow compelled to release the code? Do you think I was expecting the open source police would kick down my door if I didn't provide support?

Re: Professional maintainers: a wake-up call

#235

Post by ThrowawayR2 » Sat, Dec 11, 2021, 11:32 PM UTC

qnsi wrote: post #51

Can someone help me find whos idea was it? Basically kill free open source. Make every "new open source" (NOS) program dual licensed, free for non commercial use and paid for conmercial use. He proposed companies paying 1% of revenue to license this software. But it would all go through a proxy company that would gather payment and send it to participating companies, I dont remember how it would be split. I think thi…

That is Bruce Peren's Post-Open Source License: https://perens.com/2020/10/06/post-open-source-license-early... But POSL is at best a forlorn hope since it's playing the game that proprietary software companies are literally designed around winning: "They're charging 1% of revenue you say? Let me show you how our software is cheaper; just think of the savings!".

Re: Professional maintainers: a wake-up call

#236

Post by ferdowsi » Sat, Dec 11, 2021, 11:32 PM UTC

brabel wrote: post #131

tomxor wrote: post #2

Unpopular opinion: Maybe there is nothing wrong with the "status quo", maybe we don't need yet another attempt to finance small FOSS projects where it's hard to explain how money will actually solve any of these issues. Maybe people just need to be more considerate of what they depend upon. And in the case that a popular yet well maintained project has a CVE on day, maybe we need to accept that popularity does not ma…

Quite honestly, I think that if companies paid open source maintainers to get the features they wanted, the log4j problem would NOT have been averted at all, it would likely have happened earlier... notice that the source of the issue (support for JNDI lookups right into any log messages) was introduced because of someone asking for that feature (and getting it for free!)... if a company had paid for it, it would've…

Most every company I've worked for, large and small, has paid for professional third party security audits that scrutinize the dependency chain. log4j still wasn't flagged as problematic.

Re: Professional maintainers: a wake-up call

#237

Post by travisgriggs » Sat, Dec 11, 2021, 11:36 PM UTC

What always strikes me about the XKCD picture is that there are so many problems before we get to the punchline.

The picture paints a picture of complexity through layering and centralized liability through the one lone leg. Even if that one leg were well staffed and funded, it is still a centralized liability. There are any number of problems that occur when you have a single spot liability, beyond just “we’re depending on a few people’s goodwill.”

I wish we lived in a world where when we see that picture we stress less about the paucity of volunteer developers and instead observe, there should be more legs right there, redundancy would be good. Interoperability would be good. I wish we lived in a world where when we saw that complexity we said “it’s nice to reuse, but simplicity of algorithm and design should still trump quick select complexity.”

The file formats, protocols, design patterns, languages, that should get people excited on HN are the ones where you can learn/implement/understand it in a day. Not the ones where we build artificial mountains of complexity and then celebrate those that put in the time to become gurus sitting atop of the arbitrary mountains we’ve built.

Re: Professional maintainers: a wake-up call

#238

Post by wpietri » Sat, Dec 11, 2021, 11:37 PM UTC

usefulcat wrote: post #175

wpietri wrote: post #107

Earlier quoted context omitted.

It seems like you haven't quite got the concept of open source. If everybody consumes and nobody contributes, how long will that last? A while back I bought a cheap robot vacuum. Their scheduling feature didn't meet my needs, so I reverse-engineered the protocol and open-sourced a cron-friendly CLI tool and a library so people could do other things with it: https://github.com/wpietri/sucks Honestly, this was a mistak…

>> Given this situation, why will they pay for what they can get for free? > If everybody consumes and nobody contributes, how long will that last? That doesn't answer the GP question, which is all about incentives. The answer is, at least some parties won't pay for what they can get for free. So the options are: a) deal with it b) require payment c) come up with some way to incentivize more donations

Those aren't the only answers. The notion that people only respond to direct incentives is incorrect and ahistorical. It's a convenient dogma for the selfish to promote, but I don't have to take it seriously at all.

Another perfectly good option is for tech people to build strong cultural expectations that people and companies who benefit from a commons should help keep it healthy. Which is what's happening right here in this discussion, so you could be part of that solution if you wanted.

Re: Professional maintainers: a wake-up call

#239

Post by another_story » Sat, Dec 11, 2021, 11:38 PM UTC

lumost wrote: post #42

Once upon a time, the best way to get a software job was to demonstrate your ability to build useful open source projects. 10 years ago the Principal Engineers I would work with had super sized open source portfolio's which leant them both credibility and experience building products people liked. Junior devs would search (sometimes in vain) for issues where they could contribute a few PRs Now the best way to get a j…

I'd wager companies hire based on leetcode because it's efficient from an administerial perspective. It can be easily automated and helps weed out a greater number of poor candidates than good ones. It's easier for an interviewer to pull out a set of pre-written questions than look through a github repo and ask pointed questions.

Too much of what we do, from education (standardized tests) to banning of users in places like YouTube, is centered on efficiency or administration. Aim for the center of the bell curve, ignore the collateral damage and reach those target metrics, as the mantra goes.

It'll get much worse before it gets better, if it ever does.

Re: Professional maintainers: a wake-up call

#240

Post by sennight » Sat, Dec 11, 2021, 11:42 PM UTC

wpietri wrote: post #107

mfer wrote: post #84

Earlier quoted context omitted.

> So, large SV companies and startup should also start agreeing to pay for open source, when it's the core of the tech. Companies usually have a reason to keep their expenses low. Sometimes they are a public company with fiscal responsibilities. A startup will only have so much runway and is likely trying to reduce expenses. Given this situation, why will they pay for what they can get for free?

It seems like you haven't quite got the concept of open source. If everybody consumes and nobody contributes, how long will that last? A while back I bought a cheap robot vacuum. Their scheduling feature didn't meet my needs, so I reverse-engineered the protocol and open-sourced a cron-friendly CLI tool and a library so people could do other things with it: https://github.com/wpietri/sucks Honestly, this was a mistak…

> reverse-engineered the protocol and open-sourced ... free work

oof, I know that feeling - that sadness that comes with the realization that the manufacturer could have saved you so much trouble but chose not to... which you then rewarded with free labor and promotion. I got it every time I disassembled binary blobs in order to get hardware to work with anything beyond Windows. For a long time there wasn't much of an alternative, but that isn't really the case anymore. Setting up a new openpower system was a very strange experience, reverse-engineering wasn't even an option - the manufacturer provided schematics for the board and a wiki directing you to the source code for every bit of firmware (including the ring -3 processor).