5 ms·

As someone not in the know, Rich's post seems like an extremely aggressive and arrogant piece. When you put it in context, it does make more sense.

bsder 8y ago
It could easily have applied to dominic and the earlier npm fiasco, though. People are getting a bit entitled as to what an open source maintainer has to do for them.
- bananamerica 8y ago
  I can sympathize with that. But I think Rich made a very bad choice of rhetoric, and this is probably going to bite him in the ass.
  - the2bears 8y ago
    "Bite him in the ass" how?
    - michaelmrose 8y ago
      He clearly really cares about Clojure discouraging people from freeloading may be beneficial but a crummy tone may discourage people from adding value to Clojure which would be very unfortunate.
- Novashi 8y ago
  It's exactly how video game audiences are. But honestly the stakes are higher than video games. If you go around advertising your package, get people to depend on it, then compromise them later, that's malpractice on your part. That isn't how society runs so it's rather obvious when people get mad that there's a landscape full of anarchy when it should look more like modern civilization. Like it or not, npm and the node community has not prioritized its reputation. And the mechanisms that keeps bad operators out of npm open source rely on a relatively small company considering the actual business livelihood that relies on npm integrity. It means the community is okay with continuing to use npm, and that means that the community doesn't have a healthy way to maintain itself and build trust. It's going to rot, I think (and hope). It's just going to be a bunch of tribal nomads moving from project to project until someone social engineers a compromise and they're off to find another huge dependency graph again. At the very least, Clojure is telling people what it's about upfront. Other package managers are not immune to this, btw. npm is just often the whipping boy.
  - bartread 8y ago
    > If you go around advertising your package, get people to depend on it, then compromise them later, that's malpractice on your part. I tend to agree with this. I've always had a great deal of sympathy with OSS devs and maintainers, but if you've gone out of your way to evangelise people onto your platform (OSS or otherwise), then leave them high and dry, resulting in a load of complaints/bitterness, you have to bear at least some of the responsibility for that outcome.
  - bsder 8y ago
    > If you go around advertising your package, get people to depend on it, then compromise them later, that's malpractice on your part. I'm not sure how much he advertised it. This is part of the problem I have with things like npm, cargo, etc. They defaults are set to try to suck up your work and get you to make it public. Consequently, semi-useful things get loose probably long before people intended them to and probably long before people realize how much work they just signed up for.
- liveoneggs 8y ago
  you mean the guy who gave his project, including namespace, over to a hacker?
- nathan_long 8y ago
  That was a different issue IMO. I've stopped maintaining open source projects that others rely on, and I owe them nothing. They can fork my code if they like. And yes, it's users' responsibility to decide what code they trust. But "I trust developer/organization X" is a reasonable way to decide that, and auditing every single release is far, far more expensive. I'd be betraying their trust if I let a complete stranger release an update in my name.
TulliusCicero 8y ago
> As someone not in the know, Rich's post seems like an extremely aggressive and arrogant piece. It seems that way? To me, it seems like a reasonable response to how many people treat any kind of volunteer-led effort. For example, I help mod a fairly popular subreddit, r/cscareerquestions. Now, we don't have a problem with people suggesting changes to sub rules or have meta discussions and even complaints. No community is perfect, the mods certainly aren't, etc. However, the vast majority of complaints are of the completely useless variety. They're the vague one-liners -- "this sub used to be good, and is now bad for generic reasons I will not elaborate on" -- that usually have no clear basis in reality, nor any practical solutions even to the extent they're true. And when I try to earnestly engage with people who have the most upvoted complaints, 95%+ of the time, there's nothing there. Probably half the time they just don't respond, half the remaining time they just loose another snipe or parting shot before disappearing, and most of the rest is something in the set of {doesn't actually happen/no evidence; assumes everyone agrees with them; problem is actually well-diagnosed but the proposed solutions are laughably naive}. The number of complaints or suggestions that are meaningfully actionable is very, very low. What I've found looking at other subs and ours, is that generic complaints about sub quality and mod team actions are a quick and easy way to upvotes, but it's rare for someone to actually be well-informed on the topic and have actually thought through the problem and solutions they suggest. So when Rich says, "Did you know that most patches/issues have poor problem statements, no description of the plan (read my code!), no consideration of alternatives, no tests, no designs, and are ill-conceived and/or broken in some way?" that doesn't surprise me in the least. Even when people nominally want to contribute, they usually don't seem to try very hard. For me, it's gotten to the point where I'm writing a guide for subreddit criticism and suggestions to try and improve the quality of the complaining. tl;dr - even when something is reasonably well run by volunteers, people love their low-effort gripes and snipes
- bananamerica 8y ago
  I don't have any reason to doubt the truth and logic consistency of either Rich's post or your reply. The problem is not the logic, it's the rhetoric. For anyone out of the loop, he sounds like an interstellar douchebag. And, because the article is public, this can become a problem.

bsder 8y ago

It could easily have applied to dominic and the earlier npm fiasco, though. People are getting a bit entitled as to what an open source maintainer has to do for them.

bananamerica 8y ago
I can sympathize with that. But I think Rich made a very bad choice of rhetoric, and this is probably going to bite him in the ass.
- the2bears 8y ago
  "Bite him in the ass" how?
  - michaelmrose 8y ago
    He clearly really cares about Clojure discouraging people from freeloading may be beneficial but a crummy tone may discourage people from adding value to Clojure which would be very unfortunate.
Novashi 8y ago
It's exactly how video game audiences are. But honestly the stakes are higher than video games. If you go around advertising your package, get people to depend on it, then compromise them later, that's malpractice on your part. That isn't how society runs so it's rather obvious when people get mad that there's a landscape full of anarchy when it should look more like modern civilization. Like it or not, npm and the node community has not prioritized its reputation. And the mechanisms that keeps bad operators out of npm open source rely on a relatively small company considering the actual business livelihood that relies on npm integrity. It means the community is okay with continuing to use npm, and that means that the community doesn't have a healthy way to maintain itself and build trust. It's going to rot, I think (and hope). It's just going to be a bunch of tribal nomads moving from project to project until someone social engineers a compromise and they're off to find another huge dependency graph again. At the very least, Clojure is telling people what it's about upfront. Other package managers are not immune to this, btw. npm is just often the whipping boy.
- bartread 8y ago
  > If you go around advertising your package, get people to depend on it, then compromise them later, that's malpractice on your part. I tend to agree with this. I've always had a great deal of sympathy with OSS devs and maintainers, but if you've gone out of your way to evangelise people onto your platform (OSS or otherwise), then leave them high and dry, resulting in a load of complaints/bitterness, you have to bear at least some of the responsibility for that outcome.
- bsder 8y ago
  > If you go around advertising your package, get people to depend on it, then compromise them later, that's malpractice on your part. I'm not sure how much he advertised it. This is part of the problem I have with things like npm, cargo, etc. They defaults are set to try to suck up your work and get you to make it public. Consequently, semi-useful things get loose probably long before people intended them to and probably long before people realize how much work they just signed up for.
liveoneggs 8y ago
you mean the guy who gave his project, including namespace, over to a hacker?
nathan_long 8y ago
That was a different issue IMO. I've stopped maintaining open source projects that others rely on, and I owe them nothing. They can fork my code if they like. And yes, it's users' responsibility to decide what code they trust. But "I trust developer/organization X" is a reasonable way to decide that, and auditing every single release is far, far more expensive. I'd be betraying their trust if I let a complete stranger release an update in my name.

TulliusCicero 8y ago

> As someone not in the know, Rich's post seems like an extremely aggressive and arrogant piece. It seems that way? To me, it seems like a reasonable response to how many people treat any kind of volunteer-led effort. For example, I help mod a fairly popular subreddit, r/cscareerquestions. Now, we don't have a problem with people suggesting changes to sub rules or have meta discussions and even complaints. No community is perfect, the mods certainly aren't, etc. However, the vast majority of complaints are of the completely useless variety. They're the vague one-liners -- "this sub used to be good, and is now bad for generic reasons I will not elaborate on" -- that usually have no clear basis in reality, nor any practical solutions even to the extent they're true. And when I try to earnestly engage with people who have the most upvoted complaints, 95%+ of the time, there's nothing there. Probably half the time they just don't respond, half the remaining time they just loose another snipe or parting shot before disappearing, and most of the rest is something in the set of {doesn't actually happen/no evidence; assumes everyone agrees with them; problem is actually well-diagnosed but the proposed solutions are laughably naive}. The number of complaints or suggestions that are meaningfully actionable is very, very low. What I've found looking at other subs and ours, is that generic complaints about sub quality and mod team actions are a quick and easy way to upvotes, but it's rare for someone to actually be well-informed on the topic and have actually thought through the problem and solutions they suggest. So when Rich says, "Did you know that most patches/issues have poor problem statements, no description of the plan (read my code!), no consideration of alternatives, no tests, no designs, and are ill-conceived and/or broken in some way?" that doesn't surprise me in the least. Even when people nominally want to contribute, they usually don't seem to try very hard. For me, it's gotten to the point where I'm writing a guide for subreddit criticism and suggestions to try and improve the quality of the complaining. tl;dr - even when something is reasonably well run by volunteers, people love their low-effort gripes and snipes

bananamerica 8y ago
I don't have any reason to doubt the truth and logic consistency of either Rich's post or your reply. The problem is not the logic, it's the rhetoric. For anyone out of the loop, he sounds like an interstellar douchebag. And, because the article is public, this can become a problem.