Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

So what’s next (personal news from developer of popular CoreJS polyfill)

github.com

Post reply on HN
Print view View original

61–70 of 348 posts

Re: So what’s next (personal news from developer of popular CoreJS polyfill)

#61

Post by lelandfe »

robflynn wrote: post #43
karaterobot wrote: post #7

In my unasked-for opinion, he should absolutely give up on this project, and take a salaried job that'll let him support his family and not have to deal with the entitlement issues and lack of perspective the community evidently has. If half of what's in this post is true, he's shown admirable restraint: I'd have burned it all down the first time someone got pissy about a free thing I gave them.

The open source community can be wild sometimes. Back when I was still maintainer and lead dev for Gaim (not Pidgin), I would occasionally get downright hateful people e-mailing me for not implementing whatever feature they thought needed to be implemented, or not getting it implemented quickly enough. One guy managed to get ahold of my cell phone number somehow and called me at 4am to discuss "his ideas" with me for…

Old coworker of mine was/is(?) secretly the primary contributor to a a major console emulator. He revealed it to me only after working together for about 4 years.

He keeps it incognito because the vitriol his alias receives from impassioned members of the community makes him afraid of getting doxxed. He showed me some of them. I don't blame him.

Re: So what’s next (personal news from developer of popular CoreJS polyfill)

#62

Post by robomartin »

This sort of thing highlights that FOSS isn't even close to free, ever.

If we were to compute the developer hours invested in a project like Linux we would easily determine it likely is the most expensive software project in history. The cost of the time is borne by individual developers, companies and universities, all of whom require some form of financial support in order to do so. Or, at the individual level, starve and not have a life (unless wealthy and the work is a hobby).

Denis Pushkarev, CoreJS's developer, abandon this project and move on. The list of large companies benefiting from his work who have not moved a finger to make sure he is able to continue working on this while supporting a family with dignity is massive.

Short list of notable companies from the screen grab:

https://user-images.githubusercontent.com/2213682/218452738-...

    baidu.com
    amazon.com
    yahoo.com
    microsoft.com
    taobao.com
    openai.com
    instagram.com
    twitter.com    Elon: Give this man a job!
    weibo.com
    reddit.com
    twitch.tv
    zoom.us
    aliexpress.com
    adobe.com
    patreon.com
    pinterest.com
    etc.
Yeah, this is silly. Move on. Immediately. The people who care do not care enough to help or support you.

Denis, if you are reading this:

DO NOT FEEL BAD ABOUT DISCONNECTING FROM THIS PROJECT! THESE PEOPLE DO NOT VALUE YOUR WORK. MOVE ON. IMMEDIATELY.

Re: So what’s next (personal news from developer of popular CoreJS polyfill)

#63

Post by jay-barronville »

ericls wrote: post #4

We should pay this guy to have a vacation before we pay him to write more code.

It really angers me that he, of all folks, struggled to raise even a percentage of $80K while I personally know FAANG engineers who got $50K+ in signing bonuses alone.

Re: So what’s next (personal news from developer of popular CoreJS polyfill)

#64

Post by hn_throwaway_99 »

I understand and expect most of the comments here would be about the state of open source, and I know we of course, by definition, are only getting one side of the story, and I also know that no country is perfect.

But holy shit, I had immense sadness and sympathy for his legal woes and the fact that he was imprisoned. Again, obviously the US is no panacea when it comes to incarceration, but holy shit, first thing I was screaming was "GTFO of Russia!" The entire legal system there is now basically one man's corrupt enterprise.

Re: So what’s next (personal news from developer of popular CoreJS polyfill)

#65

Post by ricardobeat »

I can sympathize with the author's troubles, and wish he finds a well-paid position that still allows him to work on OSS.

That said, the idea that companies would pay for a JS library that is patching browser support is wild. Practically nobody pays for JS modules except for very specific niches (e.g. a charting library) or product/technical support. Especially when it's an indirect dependency of tools you use. Maybe Babel could pull off having a paid tier, but that's already a stretch, as there is still a lot more software up the chain. There are many commercial ideas in the JS ecosystem worth pursuing, but this doesn't look like one of them.

Projects like Babel, ESLint, Rollup etc get significant funding from corporations, but these are the very top of the food chain, and even then the amounts are still barely enough to pay for full-time dev salaries at market rate. It's just not a model that works.

There is also no particular reason these hundreds of polyfills have to be maintained by a single person, and kept in one central package. The maintenance overhead is massive. Any project using this as part of their core offering, like Babel, would certainly be able to keep up with a bunch of smaller modules, and deal with churn.

Finally, the reach and numbers are very impressive, but I'm afraid they are an artifact of building a monolithic package, more than a reflection of the value companies might attach to it. If core-js stopped being maintained today, it would hurt momentarily, but there are hundreds if not thousands of people who will step in to fill the void. There is no reason to sacrifice your personal well-being for a project that is not bringing you happiness.

Re: So what’s next (personal news from developer of popular CoreJS polyfill)

#66

Post by Dalewyn »

linkdd wrote: post #24
Dalewyn wrote: post #13

I wrote this sentiment earlier[1], but I'll repeat it here. If a dev wants money for his work, he should license his work as appropriate and demand payments. If a dev releases his work free-as-in-libre and/or free-as-in-beer, they don't get to complain if the donations are "insufficient". Or to put it another: Of course a company won't pay up if they don't have to. This guy seems to be considering making his work int…

> If a dev releases his work free-as-in-libre and/or free-as-in-beer, they don't get to complain if the donations are "insufficient". Of course they get to complain. Complaining and doing nothing to change the situation is what's problematic. Doing work without reward, even if you did not expect any in the first place, can be soul-sucking, and it is totally normal to complain about it. You don't do FOSS for the recog…

>Of course they get to complain.

No, they don't. They specifically waived any compensation by licensing their work for free-as-in-libre and/or free-as-in-beer. If they want to have social and legal standing to complain, they should have demanded compensation upfront.

>You don't do FOSS for the recognition/glory, but complaining about the hatred, hypocrisy, and complete lack of respect of the industry towards FOSS is normal.

FOSS doesn't ask for money. -> Users proceed to pay no money, because why would they? -> FOSS is pissed they don't get money.

This whole saga is hypocritical on FOSS's part. If devs want money they should demand money with appropriate licensing. It really isn't hard, it's dead simple.

Users and companies are happy to pay up if you can get them to sign the contract.

>I'd even say this, it's the user who does not get to complain, ... You get a message during `npm install` from the dev asking for funding and a job? Tough shit, you don't get to complain because you're not paying him.

Absolutely. Users don't get to complain about something they got for free.

Re: So what’s next (personal news from developer of popular CoreJS polyfill)

#67

Post by btown »

From this article, Denis Pushkarev seems to be a remarkably principled developer in a horrible situation, and I admire his commitment to this project. Setting that aside, though, is anyone else alarmed that such a widely used project has exactly one maintainer who is able to push arbitrary changes without review? Especially one already in legal trouble and significant debt, unable to travel, for a project embedded in Fortune 500 e-commerce and (likely) intranet/administrative sites, with an extremely large surface area of used APIs where malicious minified code might easily go unnoticed and is highly difficult to audit?

I absolutely feel for his situation. Right now, the degree to which he could be threatened into allowing a malicious group to push changes in his name should not be taken lightly. Hopefully this article reaches the attention of some of the CISOs at companies who rely on the project, and a path towards a situation where multiple parties have visibility into release management can be explored. And honestly, such a solution might be the best thing to make Denis and his family less of a target.

(In the meantime, pin your core-js dependency, and track https://security.snyk.io/vuln/npm?search=core-js as well as npm audit. Arguably there should be an advisory category for known vulnerable maintenance situation - I'm not sure if such a registry exists. One might say that every open source project is vulnerable in some way, but there's nuance and splash radius to consider here, and core-js does not have much defense-in-depth at the moment.)

Re: So what’s next (personal news from developer of popular CoreJS polyfill)

#68

Post by aloisdg »

ricardobeat wrote: post #65

I can sympathize with the author's troubles, and wish he finds a well-paid position that still allows him to work on OSS. That said, the idea that companies would pay for a JS library that is patching browser support is wild. Practically nobody pays for JS modules except for very specific niches (e.g. a charting library) or product/technical support. Especially when it's an indirect dependency of tools you use. Maybe…

https://user-images.githubusercontent.com/2213682/154870832-...

Re: So what’s next (personal news from developer of popular CoreJS polyfill)

#69

Post by SergeAx »

I do understand that not a lot of people here really understand the sheer direness of his situation. He stuck in Russia because of unsettled problems regarding his conviction. He almost certainly cannot immigrate into most of the countries because of said conviction - to have a work permit one have to provide a certificate of good conduct. He is cut off most options to receive money from abroad and several means to receive support at all. He has a family to provide. The economy of Russia is increasingly deteriorating, the quality of life is following suit. His son will soon feel a taste of state fascist indoctrination, it starts in kindergarten now in Russia. While most commenters here feel sad, I feel an utter horror.

Re: So what’s next (personal news from developer of popular CoreJS polyfill)

#70

Post by cyral »

ricardobeat wrote: post #65

I can sympathize with the author's troubles, and wish he finds a well-paid position that still allows him to work on OSS. That said, the idea that companies would pay for a JS library that is patching browser support is wild. Practically nobody pays for JS modules except for very specific niches (e.g. a charting library) or product/technical support. Especially when it's an indirect dependency of tools you use. Maybe…

> - The idea that companies would pay for a JS library that is patching browser support is wild.

Companies make more money by having their websites work in older browsers. If it wasn't for core-js, they would be paying developer time to write polyfills or compile and maintain them from various other single polyfill packages. Surely if they are willing to pay developers to do this in return for increased profits they would also be willing to pay someone else to do it, just as businesses outsource all kinds of tasks.

Post reply on HN