4 ms·
> Package maintainer should indeed have found someone to pass it onto (see Cathedral & the Bazaar). And that doesn’t include the first person he’s never heard o
by lugg 8y ago
> Package maintainer should indeed have found someone to pass it onto (see Cathedral & the Bazaar). And that doesn’t include the first person he’s never heard of stepping up.
WITH NO WARRANTY.
Do you not understand what this part of the licensed mean?
Mainter doesn't have to do shit. That is the point.
You want to start putting arbitrary ethics and morals on these developers? The "Fuck you. Pay me." talk comes to mind.
FOSS works fine like this and has been for a long time.
We're seeing issues now because of nodes lack of a standard library. Not trust and certainly not instead issues with free and open source software.
- andrewflnr 8y agoLack of standard library only makes the trust issue manifest with more hilariously basic libraries, instead of more slowly with the libraries. We've still seen this in Python, the poster child for batteries-included.
- lugg 8y agoI think it's been said elsewhere, this is true but the frequency and severity is orders of magnitude less with the languages with good standard libraries. When the entire ecosystem depends on left pad I think you have a problem. When the entire ecosystem depends on express it is less of an issue because more eyes are invested in auditing it and changes are more widely reviewed. You think a nefarious leftpad function would make it's way into express? It could, but it is way less likely. Updating the dependency to a newer version of left pad isn't going to raise an eyebrow. And that is the issue.
- randomsearch 8y agoIt sounds like you haven’t read the Cathedral and the Bazaar, which really is one of the founding documents of OSS, and it does indeed encode ethics in its motivation. Recommended reading.