4 ms·

Good article, but I thought webpack is founded by The OpenJS Foundation these days, who are making an astonishing job of identifying and sustaining core web pac

Good article, but I thought webpack is founded by The OpenJS Foundation these days, who are making an astonishing job of identifying and sustaining core web packages. Unfortunately, they also picked controversial software like AMP (in exchange for contributions by Google I guess) to make it appear a grassroots or "legitimate" effort. Also, I think the ongoing trend to slap a thin wrapper on top of F/OSS and sell it as a service (aka "the Cloud") points to a weakness in F/OSS licensing schemes that needs to be addressed as I'm sure that almost all devs working on F/OSS don't intend their work to become part of a lock-in scheme, mass surveillance, or both, all the while not even getting contributions back. Apart from the licensing situation, F/OSS developers serious about generating an income might also need to work on integration and polish; at least it's what the success of stuff like Docker suggests, which, as super-practical as it is, in a way is benefitting from "too much" F/OSS, too many Linux distros, either too much or not enough NIH in F/OSS, F/OSS failing to directly engage with their user base, and/or developers not personally promoting their software such that the whole thing is falling prey to large corporations giving the illusion of order and maintenance, when the reality is that the initial development of any package of significant depth and its maintenance can only be provided by individual developers or small teams in the end.

jcelerier 6y ago
> Also, I think the ongoing trend to slap a thin wrapper on top of F/OSS and sell it as a service (aka "the Cloud") points to a weakness in F/OSS licensing schemes that needs to be addressed as I'm sure that almost all devs working on F/OSS don't intend their work to become part of a lock-in scheme, mass surveillance, or both, all the while not even getting contributions back. the solution to "not even getting contributions back." exists since 2007 but apparently just writing the letters "A" "G" "P" "L" is enough to make a lot of people screech.
- richardwhiuk 6y ago
  The AGPL doesn't guarantee that you'll get contributions back. For the very few companies who are willing to touch AGPL code, they only need to make the changes available (e.g. a CD in the post is sufficient). Very few companies are willing to use it, because it creates an almost unassailable hurdle in lots of industries. It's also highly at risk at making a bunch of other projects AGPL as well.
  - black_puppydog 6y ago
    <edit> Using "you" in the general "one" sense, not to attack you personally of course </edit> > it creates an almost unassailable hurdle in lots of industries. It's intended to be a hurdle, if you want to build a business on other people's work and not contribute back. Be a player that benefits the ecosystem or go away and build the product from scratch if you think you can. > a CD in the post is sufficient Yeah, it would be. If they make valuable contributions to the source code, they'll soon realize that just dumping those on github will have the same effect and save them a full time employee for burning CDs. If the contributions are not valuable, the problem will likely solve itself when the company goes bust.
  - ddevault 6y ago
    It does nothing of the sort. This is propeganda that mega-corps want you to believe because they are unable to rip off AGPL software effectively. Organizations like Google can afford to not use AGPL software (they can just write their own software), but it costs them money, so they refuse to use AGPL software and spread propeganda that it's impossible to do so, to weaken its market penetration and ensure that they have greater access to software without the responsibility to contribute back. In actual fact, being compliant with AGPL software is extremely easy. Nothing at all is expected of you if you just ship it into production as-is. And if you modify it, the only obligation is to send the modifications upstream as patches. That's it. Surely any company is capable of completing such a trivial feat.
    - xyzzy_plugh 6y ago
      You're glossing over the fact that being compliant with AGPL requires more competence than the vast majority of software jobs. I know you could competently integrate or use AGPL software, and I might be able to do it (while repeatedly referencing armchair lawyers on stackoverflow), but there is still a risk I fuck it up and my (or my employer's) competitive advantage is in jeopardy. You are right that AGPL is easy if you can just run it as-is. The real problems start with libraries. If I link an AGPL PDF-generating library with my monolith service which runs financial reports over my business, what happens? Do I need to now publish my SQL queries that access sensitively named tables? Maybe that reveals new secret projects we're working on, or perhaps security incident mitigations underway. Sure, there are countless ways to architect my way out of those problems, but what if I don't have the resources to do that right now? The small obligation becomes a large burden pretty quickly. (The real solution to the above problems is to pay for the corporate license that removes the AGPL obligation, but that assumes you can afford to do so) AGPL is fundamentally scary to lawyers and management because they're afraid someone will sink the ship. Sure it's mostly FUD, but there are some serious valid concerns.
- lima 6y ago
  > almost all devs working on F/OSS ... a large fraction of OSS work these days is sponsored by corporations.
  - cecja 6y ago
    ...was always...
the_imp 6y ago
To clarify/correct this a bit, Webpack is not funded by the OpenJS Foundation. Yes, it is an OpenJS project, but the foundation does not provide financial support for open-source development. It does provide legal, marketing, and other support, as well as being able to assist with infrastructure costs, but it's still up to each project to separately run (or not) their own fundraisers and other funding activities. Also, it would be incorrect to say that the foundations "picks software" such as AMP; instead, projects apply to join. The decision to accept AMP was made entirely without consideration for Google's status as a sponsor of the foundation. And finally, while it may count as splitting hairs, Google retains ownership and control of the AMP cache; it's the core technologies that have been transferred to the foundation, not the instance run by Google that relies on those technologies.

jcelerier 6y ago

> Also, I think the ongoing trend to slap a thin wrapper on top of F/OSS and sell it as a service (aka "the Cloud") points to a weakness in F/OSS licensing schemes that needs to be addressed as I'm sure that almost all devs working on F/OSS don't intend their work to become part of a lock-in scheme, mass surveillance, or both, all the while not even getting contributions back. the solution to "not even getting contributions back." exists since 2007 but apparently just writing the letters "A" "G" "P" "L" is enough to make a lot of people screech.

richardwhiuk 6y ago
The AGPL doesn't guarantee that you'll get contributions back. For the very few companies who are willing to touch AGPL code, they only need to make the changes available (e.g. a CD in the post is sufficient). Very few companies are willing to use it, because it creates an almost unassailable hurdle in lots of industries. It's also highly at risk at making a bunch of other projects AGPL as well.
- black_puppydog 6y ago
  <edit> Using "you" in the general "one" sense, not to attack you personally of course </edit> > it creates an almost unassailable hurdle in lots of industries. It's intended to be a hurdle, if you want to build a business on other people's work and not contribute back. Be a player that benefits the ecosystem or go away and build the product from scratch if you think you can. > a CD in the post is sufficient Yeah, it would be. If they make valuable contributions to the source code, they'll soon realize that just dumping those on github will have the same effect and save them a full time employee for burning CDs. If the contributions are not valuable, the problem will likely solve itself when the company goes bust.
- ddevault 6y ago
  It does nothing of the sort. This is propeganda that mega-corps want you to believe because they are unable to rip off AGPL software effectively. Organizations like Google can afford to not use AGPL software (they can just write their own software), but it costs them money, so they refuse to use AGPL software and spread propeganda that it's impossible to do so, to weaken its market penetration and ensure that they have greater access to software without the responsibility to contribute back. In actual fact, being compliant with AGPL software is extremely easy. Nothing at all is expected of you if you just ship it into production as-is. And if you modify it, the only obligation is to send the modifications upstream as patches. That's it. Surely any company is capable of completing such a trivial feat.
  - xyzzy_plugh 6y ago
    You're glossing over the fact that being compliant with AGPL requires more competence than the vast majority of software jobs. I know you could competently integrate or use AGPL software, and I might be able to do it (while repeatedly referencing armchair lawyers on stackoverflow), but there is still a risk I fuck it up and my (or my employer's) competitive advantage is in jeopardy. You are right that AGPL is easy if you can just run it as-is. The real problems start with libraries. If I link an AGPL PDF-generating library with my monolith service which runs financial reports over my business, what happens? Do I need to now publish my SQL queries that access sensitively named tables? Maybe that reveals new secret projects we're working on, or perhaps security incident mitigations underway. Sure, there are countless ways to architect my way out of those problems, but what if I don't have the resources to do that right now? The small obligation becomes a large burden pretty quickly. (The real solution to the above problems is to pay for the corporate license that removes the AGPL obligation, but that assumes you can afford to do so) AGPL is fundamentally scary to lawyers and management because they're afraid someone will sink the ship. Sure it's mostly FUD, but there are some serious valid concerns.
lima 6y ago
> almost all devs working on F/OSS ... a large fraction of OSS work these days is sponsored by corporations.
- cecja 6y ago
  ...was always...

the_imp 6y ago

To clarify/correct this a bit, Webpack is not funded by the OpenJS Foundation. Yes, it is an OpenJS project, but the foundation does not provide financial support for open-source development. It does provide legal, marketing, and other support, as well as being able to assist with infrastructure costs, but it's still up to each project to separately run (or not) their own fundraisers and other funding activities. Also, it would be incorrect to say that the foundations "picks software" such as AMP; instead, projects apply to join. The decision to accept AMP was made entirely without consideration for Google's status as a sponsor of the foundation. And finally, while it may count as splitting hairs, Google retains ownership and control of the AMP cache; it's the core technologies that have been transferred to the foundation, not the instance run by Google that relies on those technologies.