Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FindBugs project in its current form is dead

mailman.cs.umd.edu

Post reply on HN
Print view View original

31–40 of 121 posts

Re: FindBugs project in its current form is dead

#31

Post by pmontra »

pjmlp wrote: post #17
nickpsecurity wrote: post #4

A million downloads, commercial deployments by 3rd parties, and basically no contributions coming in. The status quo of the open-source model. They should start selling it to companies to finance their own work on it. Or encourage others interested in static analysis to do the same.

This is what kind of changed my view on FOSS as a way to make a living. In all the companies I have worked through my career thus far, not a single one has contributed back in any form to the pile of FOSS libraries that they were using.

Did they make any changes to those libraries? I'm also using tons of open source from github but I almost never make any changes. I do report bugs and sometimes I add workarounds to the bug report, mostly for code I'm comfortable to inspect and modify. That's almost only Ruby, JS, Python, nothing that needs more than an editor and a browser reload: I have no time for that and I'll just look for another library.

Re: FindBugs project in its current form is dead

#32

Post by tom9729 »

michaelt wrote: post #29
masklinn wrote: post #19

Earlier quoted context omitted.

I guess it depends on the language, or possibly the setup, the python projects I've been part of using SonarQube its reports were worthless busywork (e.g. requirements of docstrings to every method, resolved by adding """ fuck off sonar """ everywhere).

At least with Java, SonarQube checkers can be individually turned on and off at the project level. Isn't that possible with Python?

It's possible with all of the languages. Perhaps static analysis is just difficult with Python?

Re: FindBugs project in its current form is dead

#34

Post by wtbob »

pjmlp wrote: post #17
nickpsecurity wrote: post #4

A million downloads, commercial deployments by 3rd parties, and basically no contributions coming in. The status quo of the open-source model. They should start selling it to companies to finance their own work on it. Or encourage others interested in static analysis to do the same.

This is what kind of changed my view on FOSS as a way to make a living. In all the companies I have worked through my career thus far, not a single one has contributed back in any form to the pile of FOSS libraries that they were using.

Many don't, but some do. Mine, for example, does. It's actually really cool to be able to contribute back.

Re: FindBugs project in its current form is dead

#35

Post by mkobit »

Further on in the email chain, it looks like there is momentum for hard forking under another project named 'SpotBugs' [1, 2]. I hope to see the project live on as it has been useful. Other tools like Google's Error Prone and IntelliJ's inspection toolset are awesome, and FindBugs is complimentary to them.

[1] https://mailman.cs.umd.edu/pipermail/findbugs-discuss/2016-N...

[2] https://github.com/spotbugs/spotbugs

Re: FindBugs project in its current form is dead

#36

Post by pjmlp »

jknoepfler wrote: post #30
pjmlp wrote: post #17

Earlier quoted context omitted.

This is what kind of changed my view on FOSS as a way to make a living. In all the companies I have worked through my career thus far, not a single one has contributed back in any form to the pile of FOSS libraries that they were using.

As with insistence on code quality, useful and careful testing, infrastructure automation, and good design and review practices, I think the culture of giving back has to come from developers who care about their professional ethos. My team at EvilCorp contributes fixes to several open-source libraries. The reason this happens, though, is that two of our stronger devs said "the correct thing to do is to take the time…

> I think the culture of giving back has to come from developers who care about their professional ethos.

On my case that would be the path to be fired.

In none of the companies I worked for, doing that would work without going though legal and all the necessary layers to green light it.

Re: FindBugs project in its current form is dead

#37

Post by pjmlp »

pmontra wrote: post #31
pjmlp wrote: post #17

Earlier quoted context omitted.

This is what kind of changed my view on FOSS as a way to make a living. In all the companies I have worked through my career thus far, not a single one has contributed back in any form to the pile of FOSS libraries that they were using.

Did they make any changes to those libraries? I'm also using tons of open source from github but I almost never make any changes. I do report bugs and sometimes I add workarounds to the bug report, mostly for code I'm comfortable to inspect and modify. That's almost only Ruby, JS, Python, nothing that needs more than an editor and a browser reload: I have no time for that and I'll just look for another library.

Yes, some of them kept vendoring specific versions with private patches.

Re: FindBugs project in its current form is dead

#38

Post by batbomb »

wtracy wrote: post #26
stefs wrote: post #14

Earlier quoted context omitted.

> Are there examples of large open source projects that have had ground up rewrites? well, netscape navigator turned into firefox. it cost them dearly (in terms of market share), but there wasn't much of an alternative (joel spolsky might not agree on that).

Arguably two major rewrites: one early in the life of the Mozilla project, when the FOSS community deemed the original Netscape code dump to be nearly unmaintainable, and the second during the creation of Firefox itself (although that was mostly a re-do of the browser chrome, while the core was left untouched).

It was Phoenix -> Firebird -> Firefox.

Re: FindBugs project in its current form is dead

#39

Post by nickpsecurity »

onli wrote: post #28
nickpsecurity wrote: post #4

A million downloads, commercial deployments by 3rd parties, and basically no contributions coming in. The status quo of the open-source model. They should start selling it to companies to finance their own work on it. Or encourage others interested in static analysis to do the same.

The status quo if you are a defunct project without any means to properly accept contributions or even just mention a new release on the homepage maybe. There are many example where open source as a model works, but you can't expect that it will magically solve all problems. Especially if you as a project are not even able to get the basics right. How is that supposed to foster contributions to the project?

"The status quo if you are a defunct project "

Most successful projects in FOSS with many downloads get virtually no contributions or financial support back. Even the largest ones have an enormous user to contributor ratio with almost all benefits going to the users. Therefore, it's the status quo for open-source in general. Those getting tons of contributions and development without a company behind them are extremely rare.

I had a great article on this before my crashed HD deleted newer bookmarks. It was a woman that surveyed many popular projects to ask about their status. Most complained they were barely getting by, the developer(s) stretched thin, tons of requests without accompanying payment/support, and mostly no contributors. I'd like a link to that article if any readers know which one I'm talking about.

Re: FindBugs project in its current form is dead

#40

Post by mabbo »

timruffles wrote: post #33
mabbo wrote: post #7

What a shame. I work for a fortune 100 company that enables findbugs on all projects by default. I cannot fathom how many serious issues it's prevented.

Could you ask the company to help out?

Yeah, they aren't really big on the 'contributing to open source' thing.
Post reply on HN