7 ms·

Why would charities and academic institutions be writing anything but free software?

by zeveb 7y ago

ben-schaaf 7y ago
I never understand this. I get not wanting to build a community around a project, handling contributions, etc. But why not just dump the source code somewhere?
- ghaff 7y ago
  Because it’s effort. People will want you to make enhancements and maybe expect changes. It may link to proprietary libraries. Open source is not really just about dumping code on GitHub.
  - msla 7y ago
    https://gist.github.com/richhickey/1563cddea1002958f96e7ba9519972d9 https://gist.github.com/richhickey/1563cddea1002958f96e7ba95... > Open Source is Not About You > The only people entitled to say how open source 'ought' to work are people who run projects, and the scope of their entitlement extends only to their own projects. https://news.ycombinator.com/item?id=18538123 https://news.ycombinator.com/item?id=18538123
    - ghaff 7y ago
      To be clear, if someone wants to just do a code dump under an open source license, ignore it, and send any communications about the code to /dev/null that’s their choice. Probably not a very useful one but a valid one.
- jandrewrogers 7y ago
  The mechanics of putting a tarball somewhere on the Internet are simple and cheap, but that action also directly and indirectly greatly increases the potential for liability. This effectively requires the organization to create additional management and processes to mitigate this increased potential for liability. It is a headache many organizations want to avoid or can't afford. Yes, "dumping source code" is simple and cheap. Managing the implications of doing so are not. I know of many cases where companies backed away from open sourcing software due to the overhead it would entail, even when they could afford it in principle.
  - the8472 7y ago
    Which liabilities? Most open source licenses come with a WITHOUT WARRANTY OF ANY KIND clause.
    - jandrewrogers 7y ago
      Open sourcing creates multiple classes of risk outside the scope of the license which any properly run company must manage. As a couple elementary examples, it greatly increases your exposure to claims of patent and copyright infringement based on the actions of your employees, both intentional and inadvertent. It significantly increases the risk that the company's trade secrets and other non-public IP accidentally end up in the public domain. You must ensure that open sourced code does not come in conflict with contractual agreements with other parties. And that is after you get every outside stakeholder in the business's strategic objectives to sign-off on it, which isn't always easy. When an organization decides to open source a bit of code, they have to run a formal diligence process to ensure there is minimal risk of any of the above and then put a process in place to help ensure that going forward. I've seen this process at multiple companies, it is not lightweight and involves lots of lawyers and documentation that would never happen otherwise. Many companies decide it isn't worth the money or distraction.
- ansgri 7y ago
  Because it's huge (perceived) risk for (often) little gain. These projects (I'm especially familiar with research) aren't known for code quality and following best practices regarding security etc. So you open yourself for shaming and casual hacking for some unquantifiable benefit of open-source contributions.
  - Nullabillity 7y ago
    > and following best practices regarding security Who cares, as long as you make it clear that it's a pure research project? The problem with Actix was that they marketed it as production-ready.
- 0xffff2 7y ago
  Dumping the code somewhere is next to useless. NASA open-sources a ton of code (https://www.github.com/nasa https://www.github.com/nasa), but the vast majority of it gets open-sourced at the end of a project and there's no money set aside for maintenance so it's mostly abandoned. I have one such project that I keep up the maintenance on my own time, but if I ever leave NASA I won't be able to even do that.
Dayshine 7y ago
A research project might be collecting sensitive personal information. A charity might have a public but internal management system for staff or related organisations to organise on. In either case, being open source increases security risk.
- MichaelApproved 7y ago
  > A research project might be collecting sensitive personal information. The data being processed (personal info) has nothing to do with the source code. You can release the code while keeping the data private.
  - Dayshine 7y ago
    The source code will indicate where/how the data is input, processed and stored. It might help an attacker compromise the application in any number of ways. There's non-trivial risk there, enough to make it an ethical concern. So, in order to use AGPL software, you have to open source your entire source code, which means you have to go through a long and arduous risk assessment which will likely decide you can't.
    - tokai 7y ago
      Security through obscurity is not security at all. https://en.wikipedia.org/wiki/Kerckhoffs's_principle https://en.wikipedia.org/wiki/Kerckhoffs's_principle
      - topkai22 7y ago
        I’ve always felt this argument breaks down with smaller scale targets. I’d argue security through obscurity is not security, but there can be safety in obscurity. There are a massive number of systems that are completely bespoke for small organizations or even individuals, and their user base isn’t going to grow. What’s more, these systems are extremely liable to rot- the contract developer writes the system and moves on. That means library versions in the repo aren’t going to get updated when new vulnerabilities are found. So now this random 1 GitHub Star system is siting unpatched out for anyone to see. Now what might have been a hard to find but exploitable issue risks getting a black hat spotlight shown in it.
pheug 7y ago
They could be using some third-party code/services with closed source or under proprietary/non-AGPL-compatible license, and thus they can't open-source those parts under AGPL, as AGPL demands, even if they wanted to.

Why would charities and academic institutions be writing anything but free software?

by zeveb 7y ago

Why would charities and academic institutions be writing anything but free software?

I never understand this. I get not wanting to build a community around a project, handling contributions, etc. But why not just dump the source code somewhere?

ghaff 7y ago
Because it’s effort. People will want you to make enhancements and maybe expect changes. It may link to proprietary libraries. Open source is not really just about dumping code on GitHub.
- msla 7y ago
  https://gist.github.com/richhickey/1563cddea1002958f96e7ba9519972d9 https://gist.github.com/richhickey/1563cddea1002958f96e7ba95... > Open Source is Not About You > The only people entitled to say how open source 'ought' to work are people who run projects, and the scope of their entitlement extends only to their own projects. https://news.ycombinator.com/item?id=18538123 https://news.ycombinator.com/item?id=18538123
  - ghaff 7y ago
    To be clear, if someone wants to just do a code dump under an open source license, ignore it, and send any communications about the code to /dev/null that’s their choice. Probably not a very useful one but a valid one.
jandrewrogers 7y ago
The mechanics of putting a tarball somewhere on the Internet are simple and cheap, but that action also directly and indirectly greatly increases the potential for liability. This effectively requires the organization to create additional management and processes to mitigate this increased potential for liability. It is a headache many organizations want to avoid or can't afford. Yes, "dumping source code" is simple and cheap. Managing the implications of doing so are not. I know of many cases where companies backed away from open sourcing software due to the overhead it would entail, even when they could afford it in principle.
- the8472 7y ago
  Which liabilities? Most open source licenses come with a WITHOUT WARRANTY OF ANY KIND clause.
  - jandrewrogers 7y ago
    Open sourcing creates multiple classes of risk outside the scope of the license which any properly run company must manage. As a couple elementary examples, it greatly increases your exposure to claims of patent and copyright infringement based on the actions of your employees, both intentional and inadvertent. It significantly increases the risk that the company's trade secrets and other non-public IP accidentally end up in the public domain. You must ensure that open sourced code does not come in conflict with contractual agreements with other parties. And that is after you get every outside stakeholder in the business's strategic objectives to sign-off on it, which isn't always easy. When an organization decides to open source a bit of code, they have to run a formal diligence process to ensure there is minimal risk of any of the above and then put a process in place to help ensure that going forward. I've seen this process at multiple companies, it is not lightweight and involves lots of lawyers and documentation that would never happen otherwise. Many companies decide it isn't worth the money or distraction.
ansgri 7y ago
Because it's huge (perceived) risk for (often) little gain. These projects (I'm especially familiar with research) aren't known for code quality and following best practices regarding security etc. So you open yourself for shaming and casual hacking for some unquantifiable benefit of open-source contributions.
- Nullabillity 7y ago
  > and following best practices regarding security Who cares, as long as you make it clear that it's a pure research project? The problem with Actix was that they marketed it as production-ready.
0xffff2 7y ago
Dumping the code somewhere is next to useless. NASA open-sources a ton of code (https://www.github.com/nasa https://www.github.com/nasa), but the vast majority of it gets open-sourced at the end of a project and there's no money set aside for maintenance so it's mostly abandoned. I have one such project that I keep up the maintenance on my own time, but if I ever leave NASA I won't be able to even do that.

Dayshine 7y ago

A research project might be collecting sensitive personal information. A charity might have a public but internal management system for staff or related organisations to organise on. In either case, being open source increases security risk.

MichaelApproved 7y ago
> A research project might be collecting sensitive personal information. The data being processed (personal info) has nothing to do with the source code. You can release the code while keeping the data private.
- Dayshine 7y ago
  The source code will indicate where/how the data is input, processed and stored. It might help an attacker compromise the application in any number of ways. There's non-trivial risk there, enough to make it an ethical concern. So, in order to use AGPL software, you have to open source your entire source code, which means you have to go through a long and arduous risk assessment which will likely decide you can't.
  - tokai 7y ago
    Security through obscurity is not security at all. https://en.wikipedia.org/wiki/Kerckhoffs's_principle https://en.wikipedia.org/wiki/Kerckhoffs's_principle
    - topkai22 7y ago
      I’ve always felt this argument breaks down with smaller scale targets. I’d argue security through obscurity is not security, but there can be safety in obscurity. There are a massive number of systems that are completely bespoke for small organizations or even individuals, and their user base isn’t going to grow. What’s more, these systems are extremely liable to rot- the contract developer writes the system and moves on. That means library versions in the repo aren’t going to get updated when new vulnerabilities are found. So now this random 1 GitHub Star system is siting unpatched out for anyone to see. Now what might have been a hard to find but exploitable issue risks getting a black hat spotlight shown in it.

pheug 7y ago

They could be using some third-party code/services with closed source or under proprietary/non-AGPL-compatible license, and thus they can't open-source those parts under AGPL, as AGPL demands, even if they wanted to.