291–300 of 357 posts
It is clear that the private sector is always going to take more from open source than it will ever give back. Instead of trying to convince individuals or companies to donate to open source, or trying to get open source developers to come up business plans, can we just step back and admit that open source is a huge benefit for society? It allows us to reuse and build upon strong foundations. In my opinion, it is tim…
This is a good article, and 99% of this article I agree with. I'm going to quibble at something very small, not because I think the author is guilty or anything or because they're doing something wrong, but because this is a general pattern I've been seeing over and over again in multiple takes from multiple people: it feels weird to me to have a criticism of corporate behavior where corporations don't know how to en…
Earlier quoted context omitted.
How many companies paid $0 for log4j2, and then got upset and bashed the authors of it when this bug happened for the cost it caused to their business? People pay nothing for the software, but will expect paid quality support.
They get upset and expect things to be fixed for $0 because that is the value that the OSS maintainer put on his own work . So why is that surprising? It's how a market place works .
It's some (corporate) users and markets that understand this (wrongly) as a $0 value. It's their own evaluation that's failing in the long term.
Mentioned that in an other comment, but this is akin to mining companies that extract value from natural resources at $0 price (because the resource is just there to pick up). When the resource is depleted (even excluding other externalities like pollution deriving from the extraction itself), no one can reasonably expect that it would cost $0 to regenerate/reproduce the resource or repair the scarcity.
This is a good article, and 99% of this article I agree with. I'm going to quibble at something very small, not because I think the author is guilty or anything or because they're doing something wrong, but because this is a general pattern I've been seeing over and over again in multiple takes from multiple people: it feels weird to me to have a criticism of corporate behavior where corporations don't know how to en…
Earlier quoted context omitted.
as anyone who's maintained a large old java codebase will know: there's adapters for all the popular logging frameworks so they interoperate so yes, it can be
Where do these adapters come from?
eg. slf4j has adapters for logback/log4j/java.util.logging/commons-logging/...
you can also implement it yourself, I've done it several times in both directions, both:
- BigCoLogger -> OpenSourceLogger
- OpenSourceLogger -> BigCoLogger
This is a good article, and 99% of this article I agree with. I'm going to quibble at something very small, not because I think the author is guilty or anything or because they're doing something wrong, but because this is a general pattern I've been seeing over and over again in multiple takes from multiple people: it feels weird to me to have a criticism of corporate behavior where corporations don't know how to en…
The correct analogy is:
If the law mandates the indiscriminate killing of animals, you don’t title an article that some animals have become extinct, you say that the indiscriminate killing of animals has caused the extinction event.
The given analogy misattributes the source of the harm based on proximate factors… in effect it’s saying ‘i didn’t kill the animal… the bullet from the gun I fired caused the animals heart to stop’ - it’s a VERY shoddy argument.
Earlier quoted context omitted.
Where do these adapters come from?
typically other logging projects eg. slf4j has adapters for logback/log4j/java.util.logging/commons-logging/... you can also implement it yourself, I've done it several times in both directions, both: - BigCoLogger -> OpenSourceLogger - OpenSourceLogger -> BigCoLogger they take at most a day to write, as the Logger and its factory are two well-specified small interfaces
Shuffling the deck chairs around is one solution, I suppose. If all the deck chair makers get fed up, what then?
Reading through the article the author doesn't seem be able to separate pay from success and uses anecdotes to support their point that open source is broken. They don't separate how any core library from a commercial company would have been any different in their security failures. This is like a poorly written first draft of a freshman research paper.
This is a good article, and 99% of this article I agree with. I'm going to quibble at something very small, not because I think the author is guilty or anything or because they're doing something wrong, but because this is a general pattern I've been seeing over and over again in multiple takes from multiple people: it feels weird to me to have a criticism of corporate behavior where corporations don't know how to en…
That analogy is a false one. Duck hunting is a self-selecting, non-mandated recreational activity for privileged people, not an activity that forms a critical role in a global pro-business economy. The correct analogy is: If the law mandates the indiscriminate killing of animals, you don’t title an article that some animals have become extinct, you say that the indiscriminate killing of animals has caused the extinct…
The mistake I'm trying to point out is in looking at a corporate problem, where corporations are not doing due diligence to ensure the success of the commons that their own products critically rely on, and then implying that it's the responsibility of Open Source maintainers to make it easier to fund them or to alter their culture/projects to better fit company priorities. Well if everyone relies on this stuff, then the people who rely on it can figure out how to support it.
That I'm seeing articles suggesting that the problem is that Github sponsorships are hard to explain to accountants -- well, it sounds like the giant accountant firms that are being paid a lot of money aren't doing their jobs well, and aren't actually able to navigate financial situations that are outside of their comfort zone. But that's not the Open Source community's problem to solve, and the law doesn't mandate that companies be unable to navigate those spaces.
Companies ended up in the situation where an undersupported library that they needed to be stable instead broke because of their individual choices as companies about what parts of their infrastructure they would and wouldn't fund/support.
There is a systemic problem here, but it's not systemic in the exact same way as many other systemic problems that we face -- it's not systemic primarily due to outside pressure or laws, it's only systemic in the sense that companies are systemically and culturally unable to think about infrastructure or the commons in a responsible, long-term way. Sometimes systemic problems are really hard and complicated, but sometimes there are systemic problems that basically boil down to, "a bunch of people are irresponsible, and if they stopped being irresponsible the situation would get somewhat better." I don't think that Minecraft is the victim of circumstances outside of its control, I think it's really reasonable to expect a game bringing in that much money for Microsoft to be able to look at its dependencies and proactively identify/reinforce fragile parts of their infrastructure. Minecraft wouldn't have needed to solve the entire Open Source funding problem to avoid this bug, they would have needed to figure out how to support the extremely finite number of libraries that they rely on and that are directly linked to the success of their product.
And we can talk about wide-scale problems that hold Open Source back, we can get into the weeds on concepts like UBI, or better payment platforms, of IP laws, or whatever. It's not that those conversations are bad to have or that they're not important in their own ways. But they're not prerequisites for Microsoft giving money to people. And even in a world with full UBI or in a fully post-Capitalist society, you still might have Open Source developers making really useful stuff, where those developers don't want to spend all of their time or energy on that project or want to take it in a narrow direction, and that's fine. That shouldn't be a situation that we're trying to eliminate. Open Source is accessible and it allows people to dip their toes in, to solve narrow problems, to pick up and port/extend other libraries without a complicated legal process, to collaborate across national borders, to evolve their priorities and to jump between or even abandon projects -- and it turns out despite everything that is a really great ecosystem to live in. I don't think it's right to try and tear that ecosystem down and rebuild it into something that's purely professional, which is what I think a lot of corporations want. I think it's a lot more reasonable to ask businesses to learn how to interact with and support developers who may or may not be professionally working full-time on each project; I think it's more reasonable to ask why when the Open Source community is building stuff that other people find useful, that it is also our job to figure out how to make funding us attractive. And more directly relevant to your argument, I don't believe that there's a legislative reason why companies like Microsoft/Google/Apple can't get better at this stuff right now.
Earlier quoted context omitted.
typically other logging projects eg. slf4j has adapters for logback/log4j/java.util.logging/commons-logging/... you can also implement it yourself, I've done it several times in both directions, both: - BigCoLogger -> OpenSourceLogger - OpenSourceLogger -> BigCoLogger they take at most a day to write, as the Logger and its factory are two well-specified small interfaces
Right, so your solution to avoid relying on an open source library for your company's success is to use an open source adapter to rely on another open source library. It seems to the unenlightened like you're still depending on an open source library for your success, you've just changed which one? Shuffling the deck chairs around is one solution, I suppose. If all the deck chair makers get fed up, what then?
we have our own logging libraries, but other pieces of software we integrate with depend on the log4j interface
so we have an adapter (that we wrote) that swaps out the log4j implementation for ours
if all the open source logging disappeared tomorrow we'd be absolutely fine
and everyone else would write a trivial adapter for Oracle's java.util.logging and they'd be absolutely fine too