Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Open source” is broken

christine.website

Post reply on HN
Print view View original

61–70 of 357 posts

Re: “Open source” is broken

#61

Post by sneak »

hooande wrote: post #6

Someone should write a package that goes through your existing codebase to see which open source projects you make the most use of (however that is measured). Then a company could run it once a year, say around tax write off time, and build a list to donate to I would have happily given to log4j, but I didn't know that they were in need. Someone has to make it easy to keep track of this because it's never going to be…

More money doesn't always make for better software.

Would millions of dollars of donations over the last decade have caused log4j to not have the vulnerability?

Re: “Open source” is broken

#62

Post by AndrewDucker »

blibble wrote: post #54

> If log4j2 is responsible for your company's success, you have a moral obligation to donate to the person who creates this library thanklessly. I doubt there are many companies that this is true for, if any yes, log4j is good, but there's a dozen other logging libraries for Java that do 99% of what people will use log4j for and the same is true for Alpine

And your company can invest in log4j or it can invest the time and money in switching to another one. Which is cheaper?

Re: “Open source” is broken

#63

Post by armchairhacker »

betwixthewires wrote: post #17

I don't think it's that big of a deal honestly. If some guy in Nebraska maintains some library that is very useful and your company relies on it and does not pay him, you're asking to wind up relying on an unmaintained project eventually. If I maintained something extremely valuable and found out a core google product relied on it, I'd stop maintaining it.

This is what I was thinking: it seems like any security and reliability vulnerabilities from OSS are at least as bad, if not worse, in paid software or closed-source.

You can pay someone a lot to make a product and they can do a shitty job. You can have a company install a backdoor in a closed-source software for whatever reason. You can have a well-trusted organization with competent developers mess up a single line of code, creating a huge bug or exploit.

OSS actually gives you a benefit that you can see the code and technically discover any bugs or exploits (even though of course nobody will). There are plenty of open-source libraries where contributions are seriously reviewed for any accidental or intentional errors.

Serious hard-to-patch exploits are discovered in closed-source software every day. They might be harder to discover and easier to reveal without revealing how to trigger, because you can't directly see the source code. But this isn't a fundamental problem of OSS, it's something OSS users and maintainers need to look out for.

Re: “Open source” is broken

#64

Post by unethical_ban »

derekjdanserl wrote: post #44
wyldfire wrote: post #26

> I simply do not want to be in a situation where my software that I develop as a passion project on the side is holding people's companies together. People love to hate on Richard Stallman but he was really clear about the motivation for Free Software (which is not the same as Open Source but shares some tenets). What companies do with the source is their thing. They get all of the benefits and all of the responsibi…

That doesn’t change the fact that open source users are the welfare queens of our times. As long as open source software exists, lazy degenerates with no skin in the game will feel entitled to keep demanding more and more. That’s why open source software needs to die.

I don't know if you're a troll, or if you really managed to stuff three different far-right rhetorical tropes into one sentence in order to declare the cooperative development of software as immoral, because megacorps can't force people to pay for something.

Re: “Open source” is broken

#65

Post by mcguire »

xena wrote: post #14
senko wrote: post #7

Earlier quoted context omitted.

You mentioned you don't want your passion project to be critical to someone without getting paid for your work. How do you ensure that's not the case? Careful license choice, "you're on your own" wording or something else? Like, if someone created a unicorn startup rivaling Slack using Elemental-IRCd, how would you react? (I have massive respect for anyone maintaining an ircd, btw, having attempted to contribute to o…

Careful license choice and intentionally crippling things such that they are objectively useless unless you meet the exact needs that I have. I've kind of given up on elemental-ircd and left it unmaintained and archived, but I would probably send a job application in to that place if said unicorn startup happened. A few people have tried to take over elemental in the past, but as a whole the IRC ecosystem is on a dow…

Are you familiar with Kant's categorical imperative? (https://open.library.okstate.edu/introphilosophy/chapter/the...)

Re: “Open source” is broken

#66

Post by blibble »

mcguire wrote: post #59
blibble wrote: post #54

> If log4j2 is responsible for your company's success, you have a moral obligation to donate to the person who creates this library thanklessly. I doubt there are many companies that this is true for, if any yes, log4j is good, but there's a dozen other logging libraries for Java that do 99% of what people will use log4j for and the same is true for Alpine

And rebuilding your entire company's ecosystem to switch logging libraries is practically free.

as anyone who's maintained a large old java codebase will know: there's adapters for all the popular logging frameworks so they interoperate

so yes, it can be

Re: “Open source” is broken

#67

Post by IiydAbITMvJkqKf »

zaarn wrote: post #43
wyldfire wrote: post #26

> I simply do not want to be in a situation where my software that I develop as a passion project on the side is holding people's companies together. People love to hate on Richard Stallman but he was really clear about the motivation for Free Software (which is not the same as Open Source but shares some tenets). What companies do with the source is their thing. They get all of the benefits and all of the responsibi…

Except you can't because hundreds of thousands of project have "log4j" in their dependency list not "wyldfire-fixed-log4j". If log4j broke and there was no maintainer, a fork would not fix things.

Sure you can fix it, change the "log4j" in your dependency list to "wyldfire-fixed-log4j". You can't do that with closed source (either because you care about legalities, or because you have no way of obtaining a compilable and readable source code).

Re: “Open source” is broken

#69

Post by blibble »

AndrewDucker wrote: post #62
blibble wrote: post #54

> If log4j2 is responsible for your company's success, you have a moral obligation to donate to the person who creates this library thanklessly. I doubt there are many companies that this is true for, if any yes, log4j is good, but there's a dozen other logging libraries for Java that do 99% of what people will use log4j for and the same is true for Alpine

And your company can invest in log4j or it can invest the time and money in switching to another one. Which is cheaper?

probably switching as there's drop-in adapters for all of the popular logging frameworks

Re: “Open source” is broken

#70

Post by nyanpasu64 »

hn_throwaway_99 wrote: post #32
betwixthewires wrote: post #17

I don't think it's that big of a deal honestly. If some guy in Nebraska maintains some library that is very useful and your company relies on it and does not pay him, you're asking to wind up relying on an unmaintained project eventually. If I maintained something extremely valuable and found out a core google product relied on it, I'd stop maintaining it.

I think the issue, which is so well depicted in that XKCD cartoon, is that transitive dependencies can make it nearly impossible to not depend on some low-level, unmaintained library. It's not like tens of thousands of projects decide to pull in left-pad. But tens of thousands of projects do decide to use React, which (I'm guessing through its own gaggle of many dependency layers) happened to pull in left-pad. Taking…

> Taking the option of "I'll just build everything myself" then is not really a viable process in today's world

I want it to be practical to build software which only depends on a small number of trusted individuals or organizations beyond the OS and compiler. C++ manages it better than newer languages with built in package managers, and dependencies rarely depend on transitive dependencies, though it comes at the cost of adding dependencies (especially transitive dependencies) being extremely difficult (I hear Meson subprojects help, and CMake has their own worse version I didn't try).

Post reply on HN