Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My boundaries as an open source developer

joeldenning.com

Post reply on HN
Print view View original

241–250 of 251 posts

Re: My boundaries as an open source developer

#241

Post by ricardobeat »

wildmanx wrote: post #189
ricardobeat wrote: post #118

Earlier quoted context omitted.

By “unsupported software” I don’t think he means any kind of support for his particular use of the software, but simply the pace of development - keeping up with system API evolution, dependencies, fixing bugs in the original code. Software rots, and you generally don’t want to adopt a project that is not having basic maintenance being done.

It's your right to as a user choose projects based on that criterion. It sounds reasonable to me. But it's not your right to demand anything from a project, including demanding that they do basic maintenance or disclose whether they are going to do it. Maybe they don't even know, or maybe they change their mind lots of times ever year or every day. If you don't get a promise of this happening, neither assume anything…

I’ve been publishing and contributing to open source software for 15+ years and have never experienced that attitude. Granted, none of my stuff reached huge success, but they are out there; I’ve also been close to a few mainstream projects, and from my POV this seems exaggerated. If anything, scaremongering comments like yours are what might stop people from publishing more.

It’s also pretty straightforward to disable issues in GitHub and ignore all the noise.

Re: My boundaries as an open source developer

#243

Post by wildmanx »

ricardobeat wrote: post #241
wildmanx wrote: post #189

Earlier quoted context omitted.

It's your right to as a user choose projects based on that criterion. It sounds reasonable to me. But it's not your right to demand anything from a project, including demanding that they do basic maintenance or disclose whether they are going to do it. Maybe they don't even know, or maybe they change their mind lots of times ever year or every day. If you don't get a promise of this happening, neither assume anything…

I’ve been publishing and contributing to open source software for 15+ years and have never experienced that attitude. Granted, none of my stuff reached huge success, but they are out there; I’ve also been close to a few mainstream projects, and from my POV this seems exaggerated. If anything, scaremongering comments like yours are what might stop people from publishing more. It’s also pretty straightforward to disabl…

Then how do you explain the original article that we are discussing here? He's just imagining the problems that he is addressing in there?

Just look around this thread, you can find the described attitude even here.

Re: My boundaries as an open source developer

#244

Post by jcbrand »

otikik wrote: post #208
stdbrouw wrote: post #197

Most of the comments here remind me of the famous Neil Gaiman quote, "George R.R. Martin is not your bitch." [1] But I don't think that's the right framing. People buy the first book because they hope there will be a second, even though they haven't paid for that second book and hence are not entitled to it. People use your open-source project because you said, hey, here's this exciting new thing, try it out, so they…

It's funny, because I think I have pretty much the opposite expectation. When I encounter a new open source project it means that I can make it better by providing pull requests with new features, or fixing bugs. And then everyone benefits. If they choose to listen to me that's fine, but that's the icing on the cake, not the main course.

There are people like that, and they're usually great to have on an OSS project, but they're a minority.

Re: My boundaries as an open source developer

#245

Post by damethos »

enraged_camel wrote: post #143
wildmanx wrote: post #108

So much this. I'm glad he put this out there. I'll start linking to it too. There seems to be a common misconception about open source. When I release software as open source, it does not mean I work for you for free, need to provide you with anything, even need to be nice to you. I may. Or I may not. When I release software under an open source license, then we have a very specific deal. You are entitled to do certa…

I will preface this by saying I have immense respect for anyone who open-sources their work. I think the web as we know it today would not exist without such kind and hard-working individuals. In my opinion, I think most of these issues outlined in the article are caused by lack of communication combined with unclear expectations, to be honest. The only thing I ask of open-source library authors/maintainers is this:…

I was about to reply something similar but your comment totally covered me.

NPM had some thoughts about providing package.json metadata in order for the customers to know the author intentions but I am not sure what happened to it.

I remember reading about it in this article: https://www.theregister.com/2020/10/28/nodejs_15_michael_daw...

> The [module] maintainers are struggling," he said. "They may have written a module, it was a hobby they did on a weekend, now they've got 20,000,000 downloads and the people who are using it > have expectations which are more than what > is appropriate for something that they're getting for free. We've worked on something that we call package support which is adding extra metadata to > the package JSON, which allows the maintainer to provide information about their intention in terms of support. So what kind of support is there? Is it best effort? Is there no support at all? Is there > a company? Is it part of a foundation?

- Michael Dawson

Re: My boundaries as an open source developer

#246

Post by Nadya »

pabs3 wrote: post #240
Nadya wrote: post #236

Earlier quoted context omitted.

I made my point incredibly poorly as I was a bit pressed for time. My bringing up other initiatives misled you as to the point I was poorly trying to make. My point was that laypersons know what the words mean - there is no "aha, it actually means !" in the words "childhood cancer data". If one knows the words "childhood", "cancer", and "data" they can accurately guess what "childhood cancer data" means and that is n…

Even worse is that "free software" has a vastly different meaning to a layperson, who probably think mostly gratis before they think libre when they hear "free". It might be time to start using more descriptive sentences like "source code available under a proprietary license" or "libre software that can be made proprietary" or "software that is perpetually libre" instead of the "Free Software" and "Open Source" term…

The problem with "free software" definitely exists as well but the intended meaning is still a plain English meaning of the word "free" but not the first one that comes to mind. Making it easier to correct "Free as in freedom, not as in beer." than "Please read the OSI definition of what 'open source' means." or still a bit confusingly "It's actually about the licensing of the source code and not the source code itself."

I agree it is still a problem - which is why "gratis" and "libre" see use to prevent the confusion and why I prefer the term "FLOSS".

Re: My boundaries as an open source developer

#247

Post by pabs3 »

Nadya wrote: post #246
pabs3 wrote: post #240

Earlier quoted context omitted.

Even worse is that "free software" has a vastly different meaning to a layperson, who probably think mostly gratis before they think libre when they hear "free". It might be time to start using more descriptive sentences like "source code available under a proprietary license" or "libre software that can be made proprietary" or "software that is perpetually libre" instead of the "Free Software" and "Open Source" term…

The problem with "free software" definitely exists as well but the intended meaning is still a plain English meaning of the word "free" but not the first one that comes to mind. Making it easier to correct "Free as in freedom, not as in beer." than "Please read the OSI definition of what 'open source' means." or still a bit confusingly "It's actually about the licensing of the source code and not the source code itse…

> It's actually about the licensing of the source code and not the source code itself.

This is a big misconception. The Open Source Definition requires source code, you can't have an "open source" project that just releases binaries under the BSD license for example. The OSD (and the Debian Free Software Guidelines that the OSD is based on) is about the software and its attributes, including both the source code and the license.

Re: My boundaries as an open source developer

#248

Post by Nadya »

pabs3 wrote: post #247
Nadya wrote: post #246

Earlier quoted context omitted.

The problem with "free software" definitely exists as well but the intended meaning is still a plain English meaning of the word "free" but not the first one that comes to mind. Making it easier to correct "Free as in freedom, not as in beer." than "Please read the OSI definition of what 'open source' means." or still a bit confusingly "It's actually about the licensing of the source code and not the source code itse…

> It's actually about the licensing of the source code and not the source code itself. This is a big misconception. The Open Source Definition requires source code, you can't have an "open source" project that just releases binaries under the BSD license for example. The OSD (and the Debian Free Software Guidelines that the OSD is based on) is about the software and its attributes, including both the source code and…

The big misconception you speak of is being that the requirement is met if a is released under a FOSS license but that isn't at all what I said. I said the licensing of the - not of any compiled binaries - is what matters. Swapping for of course entirely changes the claim being made. The freedoms afforded by FLOSS licenses necessitate the availability of the source code as a pre-requisite to being met. So one does not meet the terms of the license of the source code if users cannot study/modify it and cannot distribute modified versions of it on account of not being able to modify it due to not being able to access it. Access to the source code in FLOSS licenses is intentional but also a side effect of the freedoms already afforded. There is no 5th freedom requiring the source code to be available because it already must be available in order to meet the requirements of freedoms 2 and 4.

But I'm still entirely wrong.

I'm completely and unequivocally wrong due to two other requirements - both of which actually pertain to the source code and not its licensing. There are in fact two requirements placed upon the source code itself to be considered open source under the OSD or even as free software as the FSF defines it. (1) It may not be deliberately obfuscated. Which makes me wonder if programs written to be deliberately obfuscated are technically not allowed to be considered free-libre or open source software? Such as programs written to compete in IOCCC or if the intent here matters and it's more about releasing obfuscated versions of source code that was not already written to be obfuscated and was made obfuscated with the intent being to prevent others from studying/modifying it. That one I think is a bit of a technicality. (2) The other being that the source code, if not released with the program, must be available in a well-publicized manner at no more than a reasonable cost of distribution/reproduction (ie no charging $1,000 for access to the source code to claim it's "technically available").

Re: My boundaries as an open source developer

#249

Post by pabs3 »

Nadya wrote: post #248
pabs3 wrote: post #247

Earlier quoted context omitted.

> It's actually about the licensing of the source code and not the source code itself. This is a big misconception. The Open Source Definition requires source code, you can't have an "open source" project that just releases binaries under the BSD license for example. The OSD (and the Debian Free Software Guidelines that the OSD is based on) is about the software and its attributes, including both the source code and…

The big misconception you speak of is being that the requirement is met if a is released under a FOSS license but that isn't at all what I said. I said the licensing of the - not of any compiled binaries - is what matters. Swapping for of course entirely changes the claim being made. The freedoms afforded by FLOSS licenses necessitate the availability of the source code as a pre-requisite to being met. So one does no…

You are getting close to the complexity of FLOSS, but there is slightly more to it, some further thoughts below.

> freedoms afforded by FLOSS licenses necessitate the availability of the source code

This isn't really true, security researchers, reverse engineers and piracy experts often do the equivalent of the FSF four freedoms without having the source code. Of course not having the source code makes it harder for people without those skills and without the often costly proprietary tools that enable this work.

It is possible as a technically skilled person to write a binary in machine code, without any assembly or "source code" or other primary format. When an FLOSS license is applied to that binary, it should be considered Free Software. An example of this is the hex0 binary of the stage0 project, which is the first piece of code run by the Bootstrappable Builds project, which aims to build an entire Linux distro starting with only the ~512bytes of machine code in hex0 plus all the necessary source code.

https://savannah.nongnu.org/projects/stage0/ https://github.com/oriansj/stage0 https://ekaitz.elenq.tech/hex0.html https://bootstrappable.org/ https://github.com/fosslinux/live-bootstrap/blob/master/part...

> Which makes me wonder if programs written to be deliberately obfuscated are technically not allowed to be considered free-libre or open source software?

Debian definitely rejects such software, I assume the FSF/OSI would too, although they mostly concern themselves with licenses rather than actual software projects. In the past at least 3 times in different FSF/GNU projects, the FSF/GNU project has caused downstream GPL violations due to releases that were missing source code. Even minified JS without the original JS is not considered DFSG-free by Debian, even though it is extremely common these days. Debian applies this rule to all digital files, no matter whether they are programs or fonts or images or videos or other things. Some articles related to this topic:

http://www.inventati.org/frx/essays/softfrdm/whatissource.ht... https://b.mtjm.eu/source-code-data-fonts-free-distros.html https://wiki.freedesktop.org/www/Games/Upstream/#source http://compliance.guide/pristine

> programs written to compete in IOCCC

The main thing about source code is that downstream users be afforded equality of access to a work as the original author of a work. So if you can write an obfuscated program and realistically modify it yourself without hiding the real source code from users, then that is considered fine from the source code point of view. Of course it is a terrible way to write a program and should get modified to de-obfuscate everything, so more people can understand the code.

Re: My boundaries as an open source developer

#250

Post by wildmanx »

damethos wrote: post #245
enraged_camel wrote: post #143

Earlier quoted context omitted.

I will preface this by saying I have immense respect for anyone who open-sources their work. I think the web as we know it today would not exist without such kind and hard-working individuals. In my opinion, I think most of these issues outlined in the article are caused by lack of communication combined with unclear expectations, to be honest. The only thing I ask of open-source library authors/maintainers is this:…

I was about to reply something similar but your comment totally covered me. NPM had some thoughts about providing package.json metadata in order for the customers to know the author intentions but I am not sure what happened to it. I remember reading about it in this article: https://www.theregister.com/2020/10/28/nodejs_15_michael_daw... > The [module] maintainers are struggling," he said. "They may have written a m…

> We've worked on something that we call package support which is adding extra metadata to > the package JSON, which allows the maintainer to provide information about their intention in terms of support. So what kind of support is there? Is it best effort? Is there no support at all? Is there a company? Is it part of a foundation?

The default answer is: No. There is no support. And that's written in the license already.

Announcing anything beyond that is called an ad. It may be a useful ad, but it's still an ad.

(Assuming it's paid support. If it's support "for free" then that's part of the problem if it's social-pressures somebody to do this in their free time. You are externalizing your business support costs. And you really want to build your business empire on a teenager's hobby project? So, whoever is interested in this "intention" metadata should only really care about paid support, and then that's an ad.)

Post reply on HN