3 ms·

Instead of paying $350 to a security analyst, I'd better pay them to an independent closed-source developer who makes a living from his software. Why would I tr

Instead of paying $350 to a security analyst, I'd better pay them to an independent closed-source developer who makes a living from his software. Why would I trust some analyst more than the guy who works on his project with great care and dedication for over 10 years now?

yellowapple 7y ago
> the guy who works on his project with great care and dedication for over 10 years now? You're assuming he'll always work on his project with great care and dedication. Humans are, last I checked, mortal; even assuming he doesn't eventually tire of maintaining it and/or decide to sell it to someone else to maintain it (that someone else being by no means guaranteed to be neither negligent nor outright malicious), he'll almost certainly fall victim to the Great Garbage Collection Algorithm In The Sky at some point, and now all of a sudden you're tied to a library that now literally nobody can legally maintain (because the one person who had the rights to publish new versions is dead). Even if he had the foresight to create an LLC or other business entity to abstract ownership away from his own person, that's still dependent on that LLC continuing to meaningfully exist. Ain't like companies are really immortal, either. Why deal with that hassle when there are plenty of libraries that don't have that problem (because they're released under licenses that permit the users of those libraries to fork and continue their development should it be necessary to do so)? If you're willing to pay an independent developer for a closed-source library, why not instead pay an independent developer for a not-closed-source library and get the best of both worlds? > Instead of paying $350 to a security analyst, I'd better pay them to an independent closed-source developer who makes a living from his software. If I'm paranoid enough to feel the need to pay someone else to audit my dependencies, FOSS would save me money; I'd only have to pay the $350 v. having to pay $350 + the source code price. And no, just paying the original programmer is insufficient; the point of an audit is to establish trust in a system, and the original programmer has a pretty obvious conflict-of-interest if he's trying to, you know, sell me the software. He could, of course, seek out a well-known third-party auditor to independently audit each build, thus being able to say "no need to take my word for it; this totally trustworthy other person checked it out and confirmed it's totally safe". While that's not quite as reassuring as a customer-initiated audit, it's certainly better than "just trust me, mmmkay?".
- guido_vongraum 7y ago
  > he'll almost certainly fall victim to the Great Garbage Collection Algorithm In The Sky at some point, and now all of a sudden you're tied to a library that now literally nobody can legally maintain Don't worry, you too are literally not going to be tied to such a library forever, you know :) And I'm sorry to burst your bubble, but no software project, however open sourced and redundantly-maintained it is, is immortal either.
  - yellowapple 7y ago
    Indeed, no software project is immortal, but a software project with a license that lets literally any user pick up where the upstream developer left off and maintain a fork to continue development is significantly less mortal than one without.

yellowapple 7y ago

> the guy who works on his project with great care and dedication for over 10 years now? You're assuming he'll always work on his project with great care and dedication. Humans are, last I checked, mortal; even assuming he doesn't eventually tire of maintaining it and/or decide to sell it to someone else to maintain it (that someone else being by no means guaranteed to be neither negligent nor outright malicious), he'll almost certainly fall victim to the Great Garbage Collection Algorithm In The Sky at some point, and now all of a sudden you're tied to a library that now literally nobody can legally maintain (because the one person who had the rights to publish new versions is dead). Even if he had the foresight to create an LLC or other business entity to abstract ownership away from his own person, that's still dependent on that LLC continuing to meaningfully exist. Ain't like companies are really immortal, either. Why deal with that hassle when there are plenty of libraries that don't have that problem (because they're released under licenses that permit the users of those libraries to fork and continue their development should it be necessary to do so)? If you're willing to pay an independent developer for a closed-source library, why not instead pay an independent developer for a not-closed-source library and get the best of both worlds? > Instead of paying $350 to a security analyst, I'd better pay them to an independent closed-source developer who makes a living from his software. If I'm paranoid enough to feel the need to pay someone else to audit my dependencies, FOSS would save me money; I'd only have to pay the $350 v. having to pay $350 + the source code price. And no, just paying the original programmer is insufficient; the point of an audit is to establish trust in a system, and the original programmer has a pretty obvious conflict-of-interest if he's trying to, you know, sell me the software. He could, of course, seek out a well-known third-party auditor to independently audit each build, thus being able to say "no need to take my word for it; this totally trustworthy other person checked it out and confirmed it's totally safe". While that's not quite as reassuring as a customer-initiated audit, it's certainly better than "just trust me, mmmkay?".

guido_vongraum 7y ago
> he'll almost certainly fall victim to the Great Garbage Collection Algorithm In The Sky at some point, and now all of a sudden you're tied to a library that now literally nobody can legally maintain Don't worry, you too are literally not going to be tied to such a library forever, you know :) And I'm sorry to burst your bubble, but no software project, however open sourced and redundantly-maintained it is, is immortal either.
- yellowapple 7y ago
  Indeed, no software project is immortal, but a software project with a license that lets literally any user pick up where the upstream developer left off and maintain a fork to continue development is significantly less mortal than one without.