Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Please don't add any of my stuff to this project”

github.com

Post reply on HN
Print view View original

251–260 of 363 posts

Re: “Please don't add any of my stuff to this project”

#251

Post by ris »

danpalmer wrote: post #233
pierrebai wrote: post #100

Earlier quoted context omitted.

IMO, it's worse than that: frenk does seem to understand the history of FOSS distribution. Most Linux distributions included packaged sources for the software. This is no different. They did not point back to the original repo, not to the source control repo. They had rmps or the equivalent. The existence of pypi does not mean everyone is forced to link back to it and use it has their own source repo. Frenk insistanc…

He strikes me as someone who has been burnt by the packaging issues that have been around in the ecosystem for years. You're right that the existence of PyPI doesn't mean everyone is forced to link back to it, but damn it would make a lot of stuff a hell of a lot easier if it did. I've been bitten by Debian packages being years out of date, I've seen packages modified by maintainers in ways that are poorly documented…

> I've been bitten by Debian packages being years out of date

I've been bitten far harder by pypi packages trying to download random opaque binaries, miscompiling their own binaries, vendoring and failing to update large packages, having impossible-to-satisfy dependency requirements (relying on pip only ever making a half-assed attempt at satisfying them) and generally making strange assumptions about the target system.

Re: “Please don't add any of my stuff to this project”

#252

Post by lucideer »

meepmorp wrote: post #226
lucideer wrote: post #196

Earlier quoted context omitted.

Wow, that thread is wild. If the views in that discussion are generally representative of the perspective of a majority of homeassistant maintainers & stewards, I'd be extremely wary of relying on the software long term. > Just do as he asks This is the absolute antithesis of the intent of open source. What an awful community response.

> What an awful community response. You're expecting an entirely unrelated community of users to be invested in the goals and interests of NixOS. They're not, and perhaps they see Frenk's point in a way that people that aren't part of their community do not.

> You're expecting an entirely unrelated community of users to be invested in the goals and interests of NixOS.

Nope.

I'm expecting an open-source community to adhere to the intent of open-source, which is to provide software in a freely redistributable way to that puts users first in contrast to traditional Berne-convention-based IP approaches focused on author protection & remuneration above user utility.

Any community placing authors as dictators of the distribution of their work at the expense of users are not aligned with open-source in intent.

That's a perfectly reasonable stance if you have no interest in open-source: everyone is entitled to release closed-source software if they prefer.

Re: “Please don't add any of my stuff to this project”

#253

Post by lesto »

andrewmcwatters wrote: post #246

Both the comments on GitHub, and this thread are an absolutely awful look for open source, and it's feedback like this that drives excellent creators to stop creating open source projects, leaving the entire FOSS ecosystem left with half-assed solutions or hand-off maintainers who can do nothing more than nominal bugfixes once an original author leaves because of harassment. You're entitled to nothing when authors wr…

> You're entitled to nothing when authors write FOSS. They provide it as-is. Take it or leave it. No one is obligated to take support harassment.

the author of the lib literally pushed it to Home Assistant, so he gave it to a relatively famous project that is present in a lot of distro and Snapstore. Pushing to such project is a guarantee that your code will be repackaged. He could say it was a misunderstanding and require to be remove from HA, but to go to a project that uses the project that you PR your code into? eh. We have licensing for this reason and I am quite sure if frenck had choose the correct license/limitation from the beginning, it would have never been accepted into HA and this whole problem would have been avoided

> Tons of FOSS projects do not support alternative distributions. In fact, implicitly, virtually no one does. Most authors publish software with the expectation you'll use their distribution channels.

I don't think this is true, and the fact that already author's libs had been already packaged in Gentoo, Fedora and possibly more distro (and he said he will request to remove them) show how quickly alternative and well used channel can and will pick them up if not specified in your license. Especially if the project you are contributing is ALREADY packaged in different disto.

source: https://github.com/home-assistant/core/pull/51645

Re: “Please don't add any of my stuff to this project”

#254

Post by jonringer117 »

whateveracct wrote: post #184
cmm wrote: post #119

regardless of the specifics here, stuff like this is liable to pop up a lot in the coming several years while NixOS is gaining more popularity but casual (as in "not willing to put in the effort of supporting off-beat distributions") OSS authors can still reasonably ignore it. the amount of patching that Nixpkgs packagers have to do sometimes is pretty extreme

Nothing wrong with patching Part of the beauty of Nix is it's easy to maintain patches - this can be nice cost-wise compared to upstreaming in many cases. Not saying upstreaming isn't a generally good thing, but it's nice to have this other option.

Generally if the patch is not-specific to nixpkgs, we ask the contributor to upstream the patch, and then we have a `fetchpatch` utility which makes it easy to pull from an upstream source.

Re: “Please don't add any of my stuff to this project”

#255

Post by jsmith45 »

pas wrote: post #195
NathanKP wrote: post #123

Earlier quoted context omitted.

Yeah I really wouldn't want to use anything that dynamically pulls a package from PyPI at runtime, because I don't trust this guy not to add a vulnerability to the code at a later point in time.

Okay, so ... I know someone might, but really who will audit any of his existing code? (Sure, that's slightly different than identifying such an auto-update point and then trying to do a supply-chain attack. But do maintainers look at what they package? In how much detail?)

Home Assistant's core developers really do look at the intergration plugins rather closely before they accept any pull request that updates the dependencies. This is needed as badly coded integration libraries really can negatively impact the stability and performance of the whole system.

It is not uncommon to see them request changes to the bumped library to fix any issues they have noticed.

Re: “Please don't add any of my stuff to this project”

#256

Post by cfinnberg »

As I see it, the author want his software to be "de facto" not open source while retaining the Open source label. And he tries to achieve that by appealing to the kindness of the people: "I'm the author, please do like I say...".

IMHO the author needs to put the license he really wants (restricting the use of his project) and deal with the consequences. If you put an open source license to your project people make certain assumptions... like they can use your project.

If you want your software to be used in one and only one project and in a certain way, then it is not open source.

Re: “Please don't add any of my stuff to this project”

#257

Post by ris »

TheChaplain wrote: post #44
elmerfud wrote: post #8

Seems like an author that doesn't understand the spirit of FOSS. The nixos team was clearly allowed to use it and include it when asking for some technical merits as to why, and even offering many alternative options to appease the author the author seemed to just childishly stamp their feet and say, "because I said so". Eventually the author took the position of "taking my ball and going home". Why is a person like…

Legally yes they are allowed and can ignore the author as they like. They can also act as a bigger person and say "Sure, we understand, respect your wish and will find an alternative."

What you're describing would be to comply with what are effectively shadow terms in an apparent open source license, which is not something that should be tolerated as it makes a farce of the whole purpose of licenses.

Re: “Please don't add any of my stuff to this project”

#258

Post by sangnoir »

Latty wrote: post #134
munk-a wrote: post #110

Earlier quoted context omitted.

From what I can see in the thread (and I'm not very familiar with the tech so I'm working off of inference here) it looks like the library fetching tool is well equipped to fetch the freshest branch from his repository directly. His responses are very minimal but it sounds like he's objecting to older versions of his library being bundled in and causing breakages on the client side - forking would potentially just ma…

It seems to me he states pretty clearly that his issue is the support burden, not some paternalism over users: > If users experiencing issues with the ambee library in this package, they will knock on my door. And I'm not willing to support that or accept that burden. Especially as I don't see a good repacking reason in this case. I absolutely agree that there is a legitimate reason to say "look, I can't handle the s…

The solution is to fork the project and give it a new name & URL so users don't knock on his door - he refused that option too! Kudos to the maintainers for their curtesy - they didn't have to ask him for additional permissions over and above the current licensing agreement - they have the rights to redistribute or fork the project, Frenck is against them exercising either right.

Re: “Please don't add any of my stuff to this project”

#259

Post by shadowgovt »

eganist wrote: post #68
gameswithgo wrote: post #64

Earlier quoted context omitted.

Sometimes when a package gets very popular other people step up to help, or take over. Other times the maintainer has a mental breakdown or just disappears.

> Sometimes when a package gets very popular other people step up to help, or take over. Other times the maintainer has a mental breakdown or just disappears. It sounds like this author is looking for a third option, one that doesn't involve people management (1) or ghosting (2), and as far as I can tell, no mechanism for this exists that doesn't violate the current tenets of open source.

Correct. There's basically nothing in either the mechanics of open source nor the dominant open-source philosophies that says "We need to be able to throttle use of the software to provide good user experience."

A direct consequence of open source is that the good user experience burden falls to the consumer, not the producer. If someone wants control over the user experience, they want a closed-source model.

Re: “Please don't add any of my stuff to this project”

#260

Post by lesto »

esens wrote: post #57
blueblob wrote: post #31

Earlier quoted context omitted.

I am not the author so I can only speculate. He's anticipating that they will be distributing an out-of-date package and it's simply another place that has to be synchronized. He's saying that there isn't actually a need to host it elsewhere as it can be installed via pip through pypy (his preferred host) which will have up-to-date code. He doesn't want to get bug reports for outdated code.

This is incredibly legitimate reason. Could these repacking be replaced with some type of just proxy/clone that is still the original source?

the author of the lib pushed the code by a PR to Home Assistant, a project that is packaged by multiple distribution, including ubuntu, fedora, arch and more, all of which will repackage the library. The author should ask for removal from HA, not going to all packager for all distro requiring to be removed
Post reply on HN