Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Open source” is broken

christine.website

Post reply on HN
Print view View original

31–40 of 357 posts

Re: “Open source” is broken

#31

Post by IiydAbITMvJkqKf »

> If log4j2 is responsible for your company's success, you have a moral obligation to donate to the person who creates this library thanklessly.

That's a big if, log4j is a logging library after all. This is an understandable position to hold for other types of dependencies (think react, database, UI components etc.) but the logging library is very far down in the ordered set of projects I'd donate to.

I will however leave a mark and donate to the top 3 dependencies I consider most important in my (non-java) side project.

Edited to add: If you offer your software at no charge, you shouldn't be surprised if people accept that offer. So I even disagree with the "moral obligation" bit. Doesn't mean that donating is a bad thing, however.

Re: “Open source” is broken

#32

Post by hn_throwaway_99 »

betwixthewires wrote: post #17

I don't think it's that big of a deal honestly. If some guy in Nebraska maintains some library that is very useful and your company relies on it and does not pay him, you're asking to wind up relying on an unmaintained project eventually. If I maintained something extremely valuable and found out a core google product relied on it, I'd stop maintaining it.

I think the issue, which is so well depicted in that XKCD cartoon, is that transitive dependencies can make it nearly impossible to not depend on some low-level, unmaintained library.

It's not like tens of thousands of projects decide to pull in left-pad. But tens of thousands of projects do decide to use React, which (I'm guessing through its own gaggle of many dependency layers) happened to pull in left-pad.

Taking the option of "I'll just build everything myself" then is not really a viable process in today's world, where all of your competitors will be using tons of prebuilt stuff (unless, perhaps, you have the productivity of someone like Fabrice Bellard, but the reason he's so well known is because his abilities are so rare).

I think the real fix is that dependency management tools like NPM and Maven need to make it much easier to "override" dependency package names so that, if a critical issue is discovered, you are not at the mercy of the current maintainers of that package to quickly get a fix into production.

Re: “Open source” is broken

#33

Post by randmeerkat »

politelemon wrote: post #13

Yes it's in a bad state and unsustainable, especially with the recent (and welcome) focus on security these days. I wouldn't consider it broken however, that's implying an unrecoverable state. There do exist sponsored projects in the open source world which have been running successfully, though those are few and far between relative to the number of 'Nebraska' projects. Those outliers aside, consider the alternative…

Maybe UBI would be a good use case here. People could focus on their passion projects and wouldn’t need to worry about begging for money from the corporations that profit off of their labors and give nothing back.

Re: “Open source” is broken

#34

Post by ravenstine »

Open-source is only broken in the sense that we frequently conflate it with free as-in beer.

IMO, fewer things should be free in general, regardless of whether the source is open. Charging money limits the amount of low-value users and the problems that come with them, it rewards the those contributing their expertise, and it can be a replacement for junkvertising.

So I agree with the author, but perhaps not in the sense that open-source software needs to charge money. It depends on whether the software really necessitates pay and exactly whom should be paying. Charging all users a fee can be counterproductive, but only charging for commercial use by companies can be a way to go.

Re: “Open source” is broken

#35

Post by mcguire »

If I had a nickel for every time I've seen an article claiming "open source is broken", I'd have enough nickels to live on for some time.

The other side is that everything else is broken, too. How much should you really trust a package that you cannot audit and that is maintained by an unknown group of people with unknown skills who are also subject to the whims of quarterly earnings reports? Oh, and you'll never hear what their screw-ups were.

Re: “Open source” is broken

#36

Post by wyldfire »

I see lots of sentiment in this thread that amounts to "I didn't know you were going to get rich off of my work."

That's anathema to Open Source. How do I know? Check "The Open Source Way" [1].

If you feel uncompensated, use a license that prevents commercial use.

[1] https://opensource.com/open-source-way

Re: “Open source” is broken

#37

Post by bpfrh »

xena wrote: post #3

I'm the author of the post in case you have any questions for me.

I always think about paying for the open source software that I use and I try to be more dilligent in paying for it.

The problem for me is, that while calculating how much I theoretically should spend on the OS I use for example (gnome+fedora+linux kernel,etc), it would be actually cheaper to pay for a windows version+microsoft cloud/office suite or switch to the apple ecosystem.

Same applies for programming frameworks I use.

Doesn't that mean opensource is inherently impossible to use ethically as a private person?

So how do you decide on how to deep and how much one should pay?

Re: “Open source” is broken

#39

Post by TheRealPomax »

betwixthewires wrote: post #17

I don't think it's that big of a deal honestly. If some guy in Nebraska maintains some library that is very useful and your company relies on it and does not pay him, you're asking to wind up relying on an unmaintained project eventually. If I maintained something extremely valuable and found out a core google product relied on it, I'd stop maintaining it.

You say that as if you even know your full dependency chain. Reality doesn't quite work that way. No one knew their codebase even relied on leftpad until it broke millions of applications the world over when it got pulled.

Some projects have the benefit of notoriety (log4j falls in that category) but plenty of projects are just "plumbing" and the only thing you know is the name of the dependencies you have in your dependency list. I can guarantee you that except for security audits, no one knows their full dependency tree, and that they have a deeper dependency with itself a dependency on a utility that depends on a thing that no one's even heard of, and no one's looked at for years, and you would never have looked for. While also being one of the critical pieces that your software runs on top of, capable of bringing down your entire product even if _what it does_ is literally trivial.

Best case, it fails. Your product/server is now broken (hopefully, for only a short while). But worst case, it has a 0-day exploit. And now your entire company is at risk to the tune of "depending on how bad, you may have just gone out of business because you can't afford what is necessary to both legally and professionally deal with the fallout".

(Did your product/service have a database that comes with rather massive fines for leaking that data? Good luck, that might bankrupt you. Does your company have contracts that are void on significant service interruption? Good luck, you may have just lost all your big clients. Etc.)

Re: “Open source” is broken

#40

Post by dnautics »

Juliate wrote: post #2

It's not "Open Source" (making code public and free to use and modify) that's broken. It's how people rely on it without any consideration about the sourcing of it. It's not that it's free to pick and to use. It's that some/most people too often associate "it's free" to be equivalent to "I don't need to care about it, like, at all". It's that some/most people don't understand that, whatever they take, they become dep…

> It's how people rely on it without any consideration about the sourcing of it.

Exactly this. I think the problem is that OSS consumers often have a complex that they are entitled to "good software". But I doubt that the solution is to make it so that the producers are "entitled" to financial compensation. I can see situations where that backfires -- satisfying the producer's "entitlement" can exacerbate the consumer's sense of entitlement and just create an entitlement arms race, and stress out open source producers.

Post reply on HN