31–40 of 53 posts
> They're not in open source as a cooperative venture, they are using it to make money > Existing open source licenses, practices, and culture don't draw this distinction I disagree for the most part. Corporations avoid copyleft licenses like the plague. It's the term open-source that includes 'free beer' licensed software that created this confusion.
Earlier quoted context omitted.
> If you contribute nothing and demand security fixes, then you’re not a leecher — you’re a parasite, because your demands exceed your contributions; There's the "demand" word again. Who is that demanded something from the maintainer, and where? I saw no indication in the original bug of any demands from big tech companies. (Just the act reporting a security issue is not a demand. A verifiable bug is a bug whether it…
On the spectrum of grey areas from “request” to “demand”, we not only have to evaluate the literal words typed but also the context and expectations of open source. As the libxml2 maintainer indicates, they are no longer willing to participate in security bug secrecy and priority. In hindsight, those expectations that most take for granted as necessary must have demanded considerable time and energy from them. They c…
Yes, those alleged demands by "leechers" are exactly what I've been asking about. From the lack of specifics, it is starting to be pretty obvious that they do not actually exist.
I'm not saying that the maintainer did anything wrong. They don't have to give anyone the time of day, and everyone should be happier now that expectations have been set appropriately.
But why can't we just accept that it is a choice he has the right to make? Why do we need to fabricate villains by making up stories about demands, entitlement, and billions in profit?
Earlier quoted context omitted.
On the spectrum of grey areas from “request” to “demand”, we not only have to evaluate the literal words typed but also the context and expectations of open source. As the libxml2 maintainer indicates, they are no longer willing to participate in security bug secrecy and priority. In hindsight, those expectations that most take for granted as necessary must have demanded considerable time and energy from them. They c…
> begins demanding something Yes, those alleged demands by "leechers" are exactly what I've been asking about. From the lack of specifics, it is starting to be pretty obvious that they do not actually exist. I'm not saying that the maintainer did anything wrong. They don't have to give anyone the time of day, and everyone should be happier now that expectations have been set appropriately. But why can't we just accep…
Is the behavior of these corporations towards maintainers something that we should evaluate against moral standards — i.e. by considering “are they villains in this story?” — or are they exempt from such moral judgments so long as they complied lawfully with the licensing terms?
I think the former. If I interpret your question correctly, you think the latter? I’m not open to persuasion on this specific viewpoint, so we’re probably at an impasse here.
Earlier quoted context omitted.
> begins demanding something Yes, those alleged demands by "leechers" are exactly what I've been asking about. From the lack of specifics, it is starting to be pretty obvious that they do not actually exist. I'm not saying that the maintainer did anything wrong. They don't have to give anyone the time of day, and everyone should be happier now that expectations have been set appropriately. But why can't we just accep…
> Why do we need to fabricate villains Is the behavior of these corporations towards maintainers something that we should evaluate against moral standards — i.e. by considering “ are they villains in this story?” — or are they exempt from such moral judgments so long as they complied lawfully with the licensing terms? I think the former. If I interpret your question correctly, you think the latter? I’m not open to pe…
I certainly can't agree with the maximalist interpretation of what you're ascribing to me. There's all kinds of things that are lawful and within the licensing terms but that would still be unacceptable.
But I do not think that mere use of open source software is abuse of the maintainer, even if the use is for profit. Nor is security research or reporting bugs. (But inversely the maintainer has no obligation to those users, no obligation to fix or acknowledge the bugs. The new security disclaimer seems like a great way to change the userbase without having to change the license.)
I feel bad for the libxml2 maintainer. The project was originally intended for parsing GNOME configuration files, but then a bunch of corporations started using it to parse untrusted data with much higher stakes. I hope that both the decision not to prioritize security issues and the new notice in the README saying it's foolish to use the project to parse untrusted data will encourage corporate users to either switch…
> Of course anyone's allowed to license their project any way they see fit, but they'll have to call it something other than open source and accept the limited distribution and userbase they'll see as a result. This doesn't require abandoning open source. The GPL and AGPL serve precisely the purpose of preventing open-source software from being exploited for closed-source purposes. Obviously hindsight is 20/20, so th…
> They're not in open source as a cooperative venture, they are using it to make money > Existing open source licenses, practices, and culture don't draw this distinction I disagree for the most part. Corporations avoid copyleft licenses like the plague. It's the term open-source that includes 'free beer' licensed software that created this confusion.
Lots of companies will draw the line in different places. Some will accept GPLv2 but not GPLv3. Some will accept GPLv3 but not AGPLv3.
It's also notable that these companies often dont respect the terms of foss software at all. Anyone worth their salt can tell you that training your LLM on gpl3 code would make it a derivative product, as it is able to reproduce large parts of that code. LLMs that are currently earning Google, Facebook, Openai, etc, billions, while they obviously dont make "their" products available under gpl3.
I don't mind them training on GPL code, but I wish they had to at least publish their model weights (and maybe also training and inference code, etc.) - same for the other issues re. using copyrighted media in training.
Earlier quoted context omitted.
I'd note that the only thing Apple, Google and MS are said to have done is to use the software. The bug has no actual example of them making demands, "leeching" or acting entitled. The security issues would be security issues just the same even if the library was only used by Linux desktops. (And if the library is unfit for use in other operating systems like the author suggests, feels like it probably is equally unf…
It's high-time for a "reasonable compensation" clause in hobbyists' open-source software licenses I think. Something to the effect of: "if you're using my labour of love to make millions, gimme one of these millions..."
I think that many people have done this, and all of them were deposed and replaced with someone who would "play ball" (I.E., work for free). Go ahead, keep an eye on Libxml2, we'll either see this reversed, or we'll see libxml3 promoted from all angles and libxml2 decried as "deprecated".
Note that if that happens, it doesn't mean libxml2 is actually bad, it just means that it no longer fits the needs of the corporate overlords, and they need YOU to believe that it's no longer good so you won't waste their time with support requests.
The current attitudes and licenses of FOSS, while good in many ways, have also enabled a ton of exploitation and free-riding, and people need to acknowledge that. Nobody should be giving Bezos free work.
> Nobody should be giving Bezos free work. Just use the GPLv3 or AGPL, problem solved.