12 ms·

Seeing a lot of posts like this. Open source is wonderful in its way, but it's really not sustainable to work on projects that make money for other people - inc

Seeing a lot of posts like this. Open source is wonderful in its way, but it's really not sustainable to work on projects that make money for other people - including big commercial interests - when they don't help out in any fashion. I'm not just talking money or contributions. I'm talking about simple acknowledgement: "we use project X" - even privately. A open source library that I worked on at Intel (the Hyperscan high performance regular expression library) had to shed most of its staff (including all the original folks who worked on it, including me). One of the big contributing factors was a sense that "well, who really uses this". The answer was "tons of people, including some major Intel target customers" but a number of Hyperscan users picked up the library and never told anyone (not asking for public plaudits, but even a private communication would have been something to show our management). When you can't even say "thank you, we're using your library now, it's great" in a goddamn email, don't be surprised when 75% of the people maintaining and advancing it don't have jobs anymore. Never mind paying money or contributing - even acknowledgement. Open source is a recipe for burn-out. If something is important to people - especially corporate interests - there needs to be a way of getting paid. Much as I dislike those wacky "free for non-commercial use, otherwise, give me a call" licenses, I'm starting to see the point.

jiofih 5y ago
> there needs to be a way of getting paid You said you worked on the library at Intel. Doesn’t that qualify as getting paid for your work? That’s not the usual setup when developers talk about getting paid for their OSS contributions, usually off the clock, so its not clear what the lesson is here besides politics/resourcing at big co (which is a real but distinct problem). This situation was supposed to be where OSS shines - instead of a dedicated team subject to the will of a single private corporation, a project should have multiple contributors, working on their employers’ time - then there is no central team to be disbanded.
- op00to 5y ago
  Not always. Might be a personal project.
- unreal37 5y ago
  It was an Intel project. https://github.com/intel/hyperscan/ https://github.com/intel/hyperscan/
- glangdale 5y ago
  Fair enough - my complaint is a bit too compressed. The point here is that my experience at Intel led me to realize that corporate OSS users will take your library in secret and not even tell you - much less publicly acknowledge it, much less contribute or help support it. Obviously I'm not expecting to be paid extra while at Intel because folks are using a library. It's just rather discouraging from the perspective of working on anything else OSS as an independent developer - unless it's a pure passion project. Given that the stuff I'm interested in often tends to wind up being hauled into high-performance infrastructure that's kind of important to bigcos, it's a bit depressing. The whole multiple contributors thing is a great theory and works for some high-gloss, high-profile projects. There's a huge tail of OSS where the expertise just isn't there and most companies just want to free ride.
  - deleted 5y ago
    [deleted]
- mellavora 5y ago
  Need to justify the time spent on it to management.
- watwut 5y ago
  Based on FOSS surveys I have seen, majority of OSS contributions are paid for that way. The off the clock for free contributions are smaller part of it all. I think the off-the-clock long term OSS maintenance is rare, because it is actual work. And contrary to stereotype, no matter how passionate you are, you will burn out if you work two full time jobs at the same time.
- barrkel 5y ago
  > You said you worked on the library at Intel. Doesn’t that qualify as getting paid for your work? It just shifts the problem along; instead of getting paid, you need to justify to Intel why they should pay you. Showing that you're keeping customers happy, building Intel brand value etc. can be part of that, but only if they give you feedback.
unreal37 5y ago
You didn't have any way of knowing who was using your library? Any way of communicating with them? A survey even? Download numbers?
- glangdale 5y ago
  Once it's up on Github and out there, you don't really have any control. It's not like we were keen to put big barriers on the 'try it out' side. I didn't have some mad keen quest to be able to communicate to management "hey, someone from A----- or H----- downloaded our library". That's not that interesting. A lot of people kick the tires. What I did kinda want to know is if a major Intel customer put our library into production. Sometimes we figured this out by detective work - e.g. one of our staff had a bunch of custom standing google searches hooked up to an RSS feed that would often find big vendors handing out paraphrased versions of our documentation to explain which regex patterns were supported.
  - im3w1l 5y ago
    That's an interesting nuance I never considered.
altf4 5y ago
I agree. I've been working on a Go library for 8 years now that I'm sure is used by quite some people and companies, and I've been close to burnout and letting it go at least twice. I'm super happy when people just "Buy me a coffee"--not for the coffee but for the feedback you get that someone is using your project, so it's valuable for someone. I'm very grateful for that, even without financial support. I think GitHub should really have a way for users of your repository to somehow illustrate that they're using your project. Maybe that'd even help to get into contact with your users and the companies building solutions on top of your product. Maybe it's just me, but I often feel blind to how and where your project is being used. EDIT: Typo.
- throwaway894345 5y ago
  What’s the library, out of curiosity?
- usrusr 5y ago
  In the Java world we have the Maven repository dependency aggregators like mvnrepository.com that accidentally serve as some kind of citeseer equivalent. I assume similar things exist for the package managers of other languages as well? But obviously most commercial usage remains invisible. I could imagine a hybrid cultural/technological approach were dev teams publish/are allowed to publish at least usage metadata were they can't publish source (or actually contribute). There's a huge tie-in with security, I remember heated discussions were one side tries to establish this as an audit mechanism ("how vulnerable is product x really, in terms of outdated dependencies?") and incentive for updating, while the other side is crazy scared of punishing a list of potential attack surfaces. Perhaps the implied attribution benefit should become part this discussion as well?
  - josephg 5y ago
    For javascript packages, npm lists which other packages which depend on any given package, and how many times a package was downloaded in the last week. That gives you a rough sense of usage, but it can also be super mysterious. As an example, here's a package I wrote which I haven't touched in 3 years: https://www.npmjs.com/package/jumprope https://www.npmjs.com/package/jumprope There are no projects on npm which depend on this, and yet it gets downloaded about 3000 times per week. Who's using it? I have no idea. Are they running into any problems? I suppose not, I mean, there aren't any issues on github. Its kinda spooky.
usrusr 5y ago
Oh, that scenario, retreating corporate sponsor would probably not have retreated if only usage was more visible, that must have been very frustrating. Almost seems as if the odd occasional visibility boost from some heavy bug or exploit could have saved it. Were Oscar Wilde and PT Barnum secretly open source visionaries?
- glangdale 5y ago
  One thing I found immensely frustrating was that occasionally other projects at Intel (not mentioning names) would wind up completely fucking up by, say, building the wrong thing, then they would do some heroic 8-week "save" of the mess that they made, and wind up getting Major Corporate Recognitions. A bodgy, high-touch system that required endless customization and lots of meetings would become a high profile project that could ultimately get the corporate equivalent of high fives all around. Meanwhile, if you ship a library that Just Works, people quietly link it into their product and move on with their lives.
  - usrusr 5y ago
    Sorry to hear that, I was hoping that my "no such thing as bad publicity" musings were merely crazy what-ifs, not a reflection of your reality.
  - pkaye 5y ago
    That has been my own experience too. The heroics to fix messes are given more recognition than a properly run projects. One company would actually give quarterly awards be those who did heroics.
tester34 5y ago
that's why telemetry is imporant If I were doing serious OSS I'd really hard consider adding just something like a once-a-week ping just to be aware of users count ofc with an ability to disable it
- glangdale 5y ago
  SaaS or something explicitly that people know will 'phone home' is one thing, but putting unexpected telemetry into a library would be staggeringly unprofessional.
  - wrycoder 5y ago
    There is the Debian popularity contest: popcon.debian.org , which tracks how many Debian users have a given package installed.
    - account42 5y ago
      popcon is intirely opt-in though, quite different from automatic telemetry that the user doesn't even knwo about
  - n_marcetic 5y ago
    Not really, there is a lot of projects doing this as an anonymous statistic, for example InfluxDB sends anonymous statistics about your InfluxDB instance to their server. This way they have overview/statistic of usage (they are visualize it on word map, looks amazing), together with data like OS, version you use etc... You can disable this in config https://influxdbcom.readthedocs.io/en/latest/content/docs/v0.9/administration/config/ https://influxdbcom.readthedocs.io/en/latest/content/docs/v0...
  - csharptwdec19 5y ago
    Frankly, there could be some value to OSS contributors in saying 'There is Telemetry' very up front, but also in the same breath telling people that instructions for disabling Telemetry is in the Docs. Could help lower the number of GH issues that are filed because people don't read said docs...
Cthulhu_ 5y ago
I feel like Github and co could do a LOT more to help open source project maintainers and contributors rewarded. They can offer a new subscription model for people with expendable income and companies with benefits, on a per user basis instead of a per project one. They can offer monetizing issues, e.g. promoting a question or issue report with an X amount of currency. OS maintainers can create a bot that asks people to contribute financially or to reach out to their employer to do so. Github can push their sponsors program more, and aim it at companies / "enterprise" sponsors.
- supportlocal4h 5y ago
  Sounds like you've got some ideas. That's cool. Take a risk and try to run with some of your ideas. Maybe you can help them grow legs. You could just leave it up to somebody else to solve, but if you've got viable ideas, give it a shot.
- llaolleh 5y ago
  These are great ideas. You should shoot the higher ups an email and a link to the thread. Your suggestions seem like a win win for Github and the hardworking OSS maintainers.
- lolsal 5y ago
  A counter-argument to these ideas is that because it's open source, I'd just fork whatever I wanted to use and re-host somewhere else. Maybe if it was an optional and project-oriented patreon-style?
- sdenton4 5y ago
  Monetizing issues would be a great move.
sebastianhoitz 5y ago
Totally agree! That's why I want to help open source maintainers monetize the ecosystem they have built. The first step: Sell add-on products/plugins/tools with a super easy Checkout paywall: https://basetools.io https://basetools.io
epmaybe 5y ago
Feels like a great opportunity for Github or another website to have these sort of analytics. Seems like quite the complicated task tho. Start small?
- mdtusz 5y ago
  Rather than centralizing on GitHub, this seems like something that could be well suited as a `.well-known` url websites/companies could use, then anyone/everyone could aggregate or just inspect what is being used.
darau1 5y ago
Or, if you can't give the dev some money, or a thank-you, fix it yourself. I think that's supposed to be the point of open source.
jcadam 5y ago
A lone developer can not maintain more than one or two open source projects at a time. I know for me, if I don't see any traction at all in the community once I get a project to some sort of MVP state, I will lose interest and move on. My github has many dead 1.0 projects :)
lumost 5y ago
For a while Open Source was a great way to project skill onto employers, and employers reaped recruiting benefits for having a large open source portfolio. This extended to the point that companies would accept internal inefficiency to support an open source release of a portion of their code. This has detectably changed in the last 5 years or so as getting a top project on github has both become more difficult as well as a more common bragging right. Everybody has some open source, so the marginal benefit to a company of releasing another project is low. It would be great if there was a method for privately tracking who uses what libraries so that the marketing/support model could be used. Tons of companies use Tensorflow to run on TPUs, but Google doesn't know if tons means 90% of their cloud customers or 5% ( unless they put library tracking directly into the TPU which ... is possible) I'd love to see a feature on Github for tracking dependents of a project. I'd also bet that most major firms would be willing to allocate a small funding level to ensure that lynchpin dependencies such as OpenSSL, git, maven and other projects remain viable - after all it's probably cheaper than migration later!
mumblemumble 5y ago
I've actively resisted open sourcing some things I've written at work - including stuff that I'm sure others would like - precisely because of fears that it would be a career-limiting move. For my employer, these libraries are only valuable to the extent that they help us build things for which we can charge money. An open source library would not be one of those things, but it would take time (and therefore company money) to maintain such a thing. So putting myself in a position to be maintaining open source software on company time has the potential to greatly reduce my value to the company.
- snth 5y ago
  I think getting your name and work out in the world with open source work is a career _advancing_ move.
  - mumblemumble 5y ago
    I've honestly never been at a job interview where people gave a crap about my open source contributions. They're typically much more interested in hearing war stories from the closed source projects I've worked on. The thing about open source projects is, they tend to be slightly generic things like "file format," "widget library," or "machine learning algorithm" that most companies see as the kind of thing they can typically get for free from open source. (They're not wrong there - the fact that we're talking about my open source contributions here makes it almost tautological.) They also tend to involve the sorts of generic programming skills that, by virtue of being stuff that we all know at least somewhat well, aren't all that valuable. Supply and demand works with job skills, too. By contrast, my commercial work tends to involve a lot of specialized knowledge that's quite uncommon, and also tends to produce the kinds of software that people are quite happy to pay a lot of money for.
    - autarch 5y ago
      > I've honestly never been at a job interview where people gave a crap about my open source contributions. They're typically much more interested in hearing war stories from the closed source projects I've worked on. Counterpoint - I have. Many times. I created some Perl libraries (most notable <a href="https://metacpan.org/dist/DateTime">DateTime</a> https://metacpan.org/dist/DateTime">DateTime</a> and <a href="https://metacpan.org/dist/Log-Dispatch">Log-Dispatch</a> https://metacpan.org/dist/Log-Dispatch">Log-Dispatch</a>) that were used by a huge percentage of companies using Perl for applications (as opposed to simple scripts or sysadmin). This often came up in interviews, and I'm sure it helped me get more and better offers. Nowadays, as fewer companies are using Perl for applications, it's probably less helpful, but it doesn't hurt.
ergot_vacation 5y ago
I've long believed "open source" is for suckers for exactly this reason. Literally being open source, having the code open for review, isn't a problem. But usually "Open Source" also ends up meaning free as in beer, for EVERYONE, whether you're some college student or a billion dollar company. The only sane, healthy, sustainable license is the "wacky" one you describe: individuals (and possibly even (very) small businesses) can use it for free. Everyone else needs to pony up. It's absurd that a ton of the software allowing giant corporations to run day-to-day is not only created but ACTIVELY MAINTAINED by an individual or groups of individuals for free, as if they were running a soup kitchen. Microsoft, Amazon and Google are not homeless. They can, and should, pay the people that make the software that keeps them going. "But if it's open source, couldn't they just fork it and keep using that for free?" Yes, but a. not legally, if the terms forbid it and b. They would now have to find a new group of people to maintain the code, after just creating a bunch of ill-will in everyone in that space. In the end nothing is absolute: you can always just pirate closed-source commercial software too. But doing so has serious negative consequences.
- zxzax 5y ago
  I've never liked that approach, it's leading with the stick and not the carrot and IMO it defeats the purpose of open source. It cuts away one of the main benefits of open source -- that companies can use it and start contributing back to it right away with no friction. AFAIK Microsoft, Amazon and Google actually DO hire a lot of open source maintainers at this time, for exactly this reason.
  - cnml123 5y ago
    Companies rarely contribute back except for very few projects like gcc and LLVM. FAANG does hire OSS devs, but a lot of them don't really do that much apart from being excellent politicians. To be fair, they don't get any time for OSS development in the first place. However, they do have time for politics and often ruin the projects. People play along because they want to get hired at GNAAF. As a result, these projects combine the worst of corporate and OSS development (horrible atmosphere and yet no money for development).
sillysaurusx 5y ago
I was recently shocked to discover that sindresorhus, one of the most prolific oss devs of all time (I think), only has around $14k/yr of app revenue. It sounded like he was saying that it was a majority of his income, so I pressed him how he could possibly live on it. He said he had GitHub sponsorships and open collective donations, and then mentioned he was living in a country with low expenses. I ended up feeling... amazed, really. I was going to say sad, but if the most prolific oss dev can’t make more than an entry level salary from 2008 on community support alone, it’s not sad — it’s simply how it is. People need to think of open source as something they do for themselves. I put stuff out for people to use. You don’t like it, you can use something else. I try to give as much help as I can, but only because it makes me happy to do that. The recipe for burn out is, you’re not putting yourself first. You should! Most people do open source the way a jazz pianist does a jam session on the weekends, but it sounds like your typical jazzist (jazzer?) ends up happier than most of us. It’s worth taking a hard look at why. Don’t do it to yourself. Life’s worth more. I understand why they left a lengthy apology here, saying “I let the community down” and such, but it’s just not true. Everyone who makes their code available for others isn t a letdown — you’re a hero to 12yo me, who would’ve given anything to get a glimpse of any closed-source gamedev engine. That’s what OSS is all about: letting people build on your work, not working yourself to death for other people.
- oh_sigh 5y ago
  It seems that he isn't really trying to make more money. Maybe I'm misinterpreting his words from his site: https://blog.sindresorhus.com/answering-anything-678ce5623798 https://blog.sindresorhus.com/answering-anything-678ce562379... > How do you make a living if you don’t have a job and don’t take donations? > I don’t make a living, currently. I have some money saved up. I don’t really care much about money or material things, don’t use much money, and don’t have a lot of monthly expenses. > Do you enjoy being homeless? > Definitely. It’s nice being free to travel anywhere at any time. I don’t really care much about material stuff either, so I have everything I need and care about in a small backpack. > How to be rich? > You don’t want to be rich — You want to be happy.
The_rationalist 5y ago
Well your comment is meaningful but you could still have recorded the total number of downloads and the monthly number in order to answer how popular is the library.
throwkeep 5y ago
So true, it's really taken for granted. Especially these days with Github and package managers which make it so easy to end up incorporating a dozen or more 3rd party libraries. There's something impersonal about it, and trivializes the amount of sweat that was poured into the code you're npm installing.
deleted 5y ago
[deleted]
lamontcg 5y ago
I'd really like GitHub to have the option of open sourcing your work but both being able to turn off pull request and be able to limit PRs and issues to trusted contributors. Open source / closed contribution on an individual level. I like the project I'm working on now, but if I release it publicly I don't want to deal with 98% of the possible users. I'm mostly worried about the idea that the itch I want to scratch will turn out to be popular, because open source is mostly horrible.
gamerDude 5y ago
I'm curious. Is there a reason to not build in some sort of ping for the software being used? Essentially doing analytics for open source usage so you can monitor how many people use it? Obviously there are some potential privacy issues here, but adding it to the README and doing a single ping on use seems like not too bad a compromise to keeping open source projects alive. It won't be 100% accurate due to offline use or available to many open source software projects due to their use case, but most applications would probably connect.
- spockz 5y ago
  Generally apps that send telemetry get a lot of flak here. Even if mentioned in the docs/faq.
- glangdale 5y ago
  Surprise telemetry is deeply unethical. Putting it in the README is borderline OK, I guess. However, even supposing it's OK, a "single ping on use" is only really feasible if the system has "main()" and some reasonably persistent usage. If you're a small tool - or a library, like we were, "single ping on use" might result in thousands of systems "beaconing" back to home base per hour. For the area we were in (pattern matching is basically computer security-adjacent), this would have been equivalent to shipping malware in terms of sheer career-destroying potential. Not everything is a long-running desktop app.
j1elo 5y ago
Maybe an easy solution is to do the thing everybody seems to discourage: add a clause to your preferred OSS license, stating that usage of the code is subject to sending a mandatory thank-you email. That change alone might be enough to break the fragile conditions that allow the license to be considered Open Source... but who cares, the mental health and happiness of OSS devs affected by the difficulties mentioned in here is more important than the technicalities of what could happen by a small clause addition.
- pizza234 5y ago
  That's Postcardware!¹ :) I remember using one, but I not exactly which one; it's not in the Wikipedia list. ¹=https://en.wikipedia.org/wiki/Postcardware#Postcardware https://en.wikipedia.org/wiki/Postcardware#Postcardware
  - pizza234 5y ago
    Found: it was (not anymore) Exact Audio Copy¹. ¹=https://www.exactaudiocopy.de/en/wp-content/uploads/2007/03/eacdoc.pdf https://www.exactaudiocopy.de/en/wp-content/uploads/2007/03/...
hinkley 5y ago
I think Richard Stallman's cynicism about licenses was misplaced 30 years ago, but that the tide is turning. I do prefer to work on libraries that are available for commercial work. But I also cannot get my employers to pay for said libraries. Which is how many of us started using OSS in the first place - because nobody could smack us with a checkbook and say no.
deleted 5y ago
[deleted]
pjmlp 5y ago
Unwilligness to pay for developer tools or desktop software is what made me gave up and just focus on Apple, Google, and Microsoft platforms. I rather work for ecosystems where customers see a value that developers keep their job.
- glangdale 5y ago
  Andy Gocke put it best, on Twitter: "Developer tools seemed like a good industry to be in, "sell shovels in the gold rush" and all, but it turns out developers prefer to dig for gold with their teeth."
  - pjmlp 5y ago
    Yeah I love the quote, specially the irony wanted to be paid, while unwilling to pay the work of others.
halfdan 5y ago
I'm so sorry to hear that has happened to the team behind hyperscan. It's truly a fantastic library and has helped us speed up some of our regex heavy workloads write drastically. I even spent some time writing about hyperscan both internally (at $dayjob) and externally. Thanks for your work on hyperscan! I think I'll identify a few other libraries that we use and reach out to their developers - it's a good reminder to not take everything for granted. https://geekmonkey.org/regular-expression-matching-at-scale-with-hyperscan/ https://geekmonkey.org/regular-expression-matching-at-scale-...
gowld 5y ago
> Much as I dislike those wacky "free for non-commercial use, otherwise, give me a call" licenses, Why? Disliking someone not giving you free money seems rude.

jiofih 5y ago

> there needs to be a way of getting paid You said you worked on the library at Intel. Doesn’t that qualify as getting paid for your work? That’s not the usual setup when developers talk about getting paid for their OSS contributions, usually off the clock, so its not clear what the lesson is here besides politics/resourcing at big co (which is a real but distinct problem). This situation was supposed to be where OSS shines - instead of a dedicated team subject to the will of a single private corporation, a project should have multiple contributors, working on their employers’ time - then there is no central team to be disbanded.

op00to 5y ago
Not always. Might be a personal project.
unreal37 5y ago
It was an Intel project. https://github.com/intel/hyperscan/ https://github.com/intel/hyperscan/
glangdale 5y ago
Fair enough - my complaint is a bit too compressed. The point here is that my experience at Intel led me to realize that corporate OSS users will take your library in secret and not even tell you - much less publicly acknowledge it, much less contribute or help support it. Obviously I'm not expecting to be paid extra while at Intel because folks are using a library. It's just rather discouraging from the perspective of working on anything else OSS as an independent developer - unless it's a pure passion project. Given that the stuff I'm interested in often tends to wind up being hauled into high-performance infrastructure that's kind of important to bigcos, it's a bit depressing. The whole multiple contributors thing is a great theory and works for some high-gloss, high-profile projects. There's a huge tail of OSS where the expertise just isn't there and most companies just want to free ride.
- deleted 5y ago
  [deleted]
mellavora 5y ago
Need to justify the time spent on it to management.
watwut 5y ago
Based on FOSS surveys I have seen, majority of OSS contributions are paid for that way. The off the clock for free contributions are smaller part of it all. I think the off-the-clock long term OSS maintenance is rare, because it is actual work. And contrary to stereotype, no matter how passionate you are, you will burn out if you work two full time jobs at the same time.
barrkel 5y ago
> You said you worked on the library at Intel. Doesn’t that qualify as getting paid for your work? It just shifts the problem along; instead of getting paid, you need to justify to Intel why they should pay you. Showing that you're keeping customers happy, building Intel brand value etc. can be part of that, but only if they give you feedback.

unreal37 5y ago

You didn't have any way of knowing who was using your library? Any way of communicating with them? A survey even? Download numbers?

glangdale 5y ago
Once it's up on Github and out there, you don't really have any control. It's not like we were keen to put big barriers on the 'try it out' side. I didn't have some mad keen quest to be able to communicate to management "hey, someone from A----- or H----- downloaded our library". That's not that interesting. A lot of people kick the tires. What I did kinda want to know is if a major Intel customer put our library into production. Sometimes we figured this out by detective work - e.g. one of our staff had a bunch of custom standing google searches hooked up to an RSS feed that would often find big vendors handing out paraphrased versions of our documentation to explain which regex patterns were supported.
- im3w1l 5y ago
  That's an interesting nuance I never considered.

altf4 5y ago

I agree. I've been working on a Go library for 8 years now that I'm sure is used by quite some people and companies, and I've been close to burnout and letting it go at least twice. I'm super happy when people just "Buy me a coffee"--not for the coffee but for the feedback you get that someone is using your project, so it's valuable for someone. I'm very grateful for that, even without financial support. I think GitHub should really have a way for users of your repository to somehow illustrate that they're using your project. Maybe that'd even help to get into contact with your users and the companies building solutions on top of your product. Maybe it's just me, but I often feel blind to how and where your project is being used. EDIT: Typo.

throwaway894345 5y ago
What’s the library, out of curiosity?
usrusr 5y ago
In the Java world we have the Maven repository dependency aggregators like mvnrepository.com that accidentally serve as some kind of citeseer equivalent. I assume similar things exist for the package managers of other languages as well? But obviously most commercial usage remains invisible. I could imagine a hybrid cultural/technological approach were dev teams publish/are allowed to publish at least usage metadata were they can't publish source (or actually contribute). There's a huge tie-in with security, I remember heated discussions were one side tries to establish this as an audit mechanism ("how vulnerable is product x really, in terms of outdated dependencies?") and incentive for updating, while the other side is crazy scared of punishing a list of potential attack surfaces. Perhaps the implied attribution benefit should become part this discussion as well?
- josephg 5y ago
  For javascript packages, npm lists which other packages which depend on any given package, and how many times a package was downloaded in the last week. That gives you a rough sense of usage, but it can also be super mysterious. As an example, here's a package I wrote which I haven't touched in 3 years: https://www.npmjs.com/package/jumprope https://www.npmjs.com/package/jumprope There are no projects on npm which depend on this, and yet it gets downloaded about 3000 times per week. Who's using it? I have no idea. Are they running into any problems? I suppose not, I mean, there aren't any issues on github. Its kinda spooky.

usrusr 5y ago

Oh, that scenario, retreating corporate sponsor would probably not have retreated if only usage was more visible, that must have been very frustrating. Almost seems as if the odd occasional visibility boost from some heavy bug or exploit could have saved it. Were Oscar Wilde and PT Barnum secretly open source visionaries?

glangdale 5y ago
One thing I found immensely frustrating was that occasionally other projects at Intel (not mentioning names) would wind up completely fucking up by, say, building the wrong thing, then they would do some heroic 8-week "save" of the mess that they made, and wind up getting Major Corporate Recognitions. A bodgy, high-touch system that required endless customization and lots of meetings would become a high profile project that could ultimately get the corporate equivalent of high fives all around. Meanwhile, if you ship a library that Just Works, people quietly link it into their product and move on with their lives.
- usrusr 5y ago
  Sorry to hear that, I was hoping that my "no such thing as bad publicity" musings were merely crazy what-ifs, not a reflection of your reality.
- pkaye 5y ago
  That has been my own experience too. The heroics to fix messes are given more recognition than a properly run projects. One company would actually give quarterly awards be those who did heroics.

tester34 5y ago

that's why telemetry is imporant If I were doing serious OSS I'd really hard consider adding just something like a once-a-week ping just to be aware of users count ofc with an ability to disable it

glangdale 5y ago
SaaS or something explicitly that people know will 'phone home' is one thing, but putting unexpected telemetry into a library would be staggeringly unprofessional.
- wrycoder 5y ago
  There is the Debian popularity contest: popcon.debian.org , which tracks how many Debian users have a given package installed.
  - account42 5y ago
    popcon is intirely opt-in though, quite different from automatic telemetry that the user doesn't even knwo about
- n_marcetic 5y ago
  Not really, there is a lot of projects doing this as an anonymous statistic, for example InfluxDB sends anonymous statistics about your InfluxDB instance to their server. This way they have overview/statistic of usage (they are visualize it on word map, looks amazing), together with data like OS, version you use etc... You can disable this in config https://influxdbcom.readthedocs.io/en/latest/content/docs/v0.9/administration/config/ https://influxdbcom.readthedocs.io/en/latest/content/docs/v0...
- csharptwdec19 5y ago
  Frankly, there could be some value to OSS contributors in saying 'There is Telemetry' very up front, but also in the same breath telling people that instructions for disabling Telemetry is in the Docs. Could help lower the number of GH issues that are filed because people don't read said docs...

Cthulhu_ 5y ago

I feel like Github and co could do a LOT more to help open source project maintainers and contributors rewarded. They can offer a new subscription model for people with expendable income and companies with benefits, on a per user basis instead of a per project one. They can offer monetizing issues, e.g. promoting a question or issue report with an X amount of currency. OS maintainers can create a bot that asks people to contribute financially or to reach out to their employer to do so. Github can push their sponsors program more, and aim it at companies / "enterprise" sponsors.

supportlocal4h 5y ago
Sounds like you've got some ideas. That's cool. Take a risk and try to run with some of your ideas. Maybe you can help them grow legs. You could just leave it up to somebody else to solve, but if you've got viable ideas, give it a shot.
llaolleh 5y ago
These are great ideas. You should shoot the higher ups an email and a link to the thread. Your suggestions seem like a win win for Github and the hardworking OSS maintainers.
lolsal 5y ago
A counter-argument to these ideas is that because it's open source, I'd just fork whatever I wanted to use and re-host somewhere else. Maybe if it was an optional and project-oriented patreon-style?
sdenton4 5y ago
Monetizing issues would be a great move.

sebastianhoitz 5y ago

Totally agree! That's why I want to help open source maintainers monetize the ecosystem they have built. The first step: Sell add-on products/plugins/tools with a super easy Checkout paywall: https://basetools.io https://basetools.io

epmaybe 5y ago

Feels like a great opportunity for Github or another website to have these sort of analytics. Seems like quite the complicated task tho. Start small?

mdtusz 5y ago
Rather than centralizing on GitHub, this seems like something that could be well suited as a `.well-known` url websites/companies could use, then anyone/everyone could aggregate or just inspect what is being used.

darau1 5y ago

Or, if you can't give the dev some money, or a thank-you, fix it yourself. I think that's supposed to be the point of open source.

jcadam 5y ago

A lone developer can not maintain more than one or two open source projects at a time. I know for me, if I don't see any traction at all in the community once I get a project to some sort of MVP state, I will lose interest and move on. My github has many dead 1.0 projects :)

lumost 5y ago

For a while Open Source was a great way to project skill onto employers, and employers reaped recruiting benefits for having a large open source portfolio. This extended to the point that companies would accept internal inefficiency to support an open source release of a portion of their code. This has detectably changed in the last 5 years or so as getting a top project on github has both become more difficult as well as a more common bragging right. Everybody has some open source, so the marginal benefit to a company of releasing another project is low. It would be great if there was a method for privately tracking who uses what libraries so that the marketing/support model could be used. Tons of companies use Tensorflow to run on TPUs, but Google doesn't know if tons means 90% of their cloud customers or 5% ( unless they put library tracking directly into the TPU which ... is possible) I'd love to see a feature on Github for tracking dependents of a project. I'd also bet that most major firms would be willing to allocate a small funding level to ensure that lynchpin dependencies such as OpenSSL, git, maven and other projects remain viable - after all it's probably cheaper than migration later!

mumblemumble 5y ago

I've actively resisted open sourcing some things I've written at work - including stuff that I'm sure others would like - precisely because of fears that it would be a career-limiting move. For my employer, these libraries are only valuable to the extent that they help us build things for which we can charge money. An open source library would not be one of those things, but it would take time (and therefore company money) to maintain such a thing. So putting myself in a position to be maintaining open source software on company time has the potential to greatly reduce my value to the company.

snth 5y ago
I think getting your name and work out in the world with open source work is a career _advancing_ move.
- mumblemumble 5y ago
  I've honestly never been at a job interview where people gave a crap about my open source contributions. They're typically much more interested in hearing war stories from the closed source projects I've worked on. The thing about open source projects is, they tend to be slightly generic things like "file format," "widget library," or "machine learning algorithm" that most companies see as the kind of thing they can typically get for free from open source. (They're not wrong there - the fact that we're talking about my open source contributions here makes it almost tautological.) They also tend to involve the sorts of generic programming skills that, by virtue of being stuff that we all know at least somewhat well, aren't all that valuable. Supply and demand works with job skills, too. By contrast, my commercial work tends to involve a lot of specialized knowledge that's quite uncommon, and also tends to produce the kinds of software that people are quite happy to pay a lot of money for.
  - autarch 5y ago
    > I've honestly never been at a job interview where people gave a crap about my open source contributions. They're typically much more interested in hearing war stories from the closed source projects I've worked on. Counterpoint - I have. Many times. I created some Perl libraries (most notable <a href="https://metacpan.org/dist/DateTime">DateTime</a> https://metacpan.org/dist/DateTime">DateTime</a> and <a href="https://metacpan.org/dist/Log-Dispatch">Log-Dispatch</a> https://metacpan.org/dist/Log-Dispatch">Log-Dispatch</a>) that were used by a huge percentage of companies using Perl for applications (as opposed to simple scripts or sysadmin). This often came up in interviews, and I'm sure it helped me get more and better offers. Nowadays, as fewer companies are using Perl for applications, it's probably less helpful, but it doesn't hurt.

ergot_vacation 5y ago

I've long believed "open source" is for suckers for exactly this reason. Literally being open source, having the code open for review, isn't a problem. But usually "Open Source" also ends up meaning free as in beer, for EVERYONE, whether you're some college student or a billion dollar company. The only sane, healthy, sustainable license is the "wacky" one you describe: individuals (and possibly even (very) small businesses) can use it for free. Everyone else needs to pony up. It's absurd that a ton of the software allowing giant corporations to run day-to-day is not only created but ACTIVELY MAINTAINED by an individual or groups of individuals for free, as if they were running a soup kitchen. Microsoft, Amazon and Google are not homeless. They can, and should, pay the people that make the software that keeps them going. "But if it's open source, couldn't they just fork it and keep using that for free?" Yes, but a. not legally, if the terms forbid it and b. They would now have to find a new group of people to maintain the code, after just creating a bunch of ill-will in everyone in that space. In the end nothing is absolute: you can always just pirate closed-source commercial software too. But doing so has serious negative consequences.

zxzax 5y ago
I've never liked that approach, it's leading with the stick and not the carrot and IMO it defeats the purpose of open source. It cuts away one of the main benefits of open source -- that companies can use it and start contributing back to it right away with no friction. AFAIK Microsoft, Amazon and Google actually DO hire a lot of open source maintainers at this time, for exactly this reason.
- cnml123 5y ago
  Companies rarely contribute back except for very few projects like gcc and LLVM. FAANG does hire OSS devs, but a lot of them don't really do that much apart from being excellent politicians. To be fair, they don't get any time for OSS development in the first place. However, they do have time for politics and often ruin the projects. People play along because they want to get hired at GNAAF. As a result, these projects combine the worst of corporate and OSS development (horrible atmosphere and yet no money for development).

sillysaurusx 5y ago

I was recently shocked to discover that sindresorhus, one of the most prolific oss devs of all time (I think), only has around $14k/yr of app revenue. It sounded like he was saying that it was a majority of his income, so I pressed him how he could possibly live on it. He said he had GitHub sponsorships and open collective donations, and then mentioned he was living in a country with low expenses. I ended up feeling... amazed, really. I was going to say sad, but if the most prolific oss dev can’t make more than an entry level salary from 2008 on community support alone, it’s not sad — it’s simply how it is. People need to think of open source as something they do for themselves. I put stuff out for people to use. You don’t like it, you can use something else. I try to give as much help as I can, but only because it makes me happy to do that. The recipe for burn out is, you’re not putting yourself first. You should! Most people do open source the way a jazz pianist does a jam session on the weekends, but it sounds like your typical jazzist (jazzer?) ends up happier than most of us. It’s worth taking a hard look at why. Don’t do it to yourself. Life’s worth more. I understand why they left a lengthy apology here, saying “I let the community down” and such, but it’s just not true. Everyone who makes their code available for others isn t a letdown — you’re a hero to 12yo me, who would’ve given anything to get a glimpse of any closed-source gamedev engine. That’s what OSS is all about: letting people build on your work, not working yourself to death for other people.

oh_sigh 5y ago
It seems that he isn't really trying to make more money. Maybe I'm misinterpreting his words from his site: https://blog.sindresorhus.com/answering-anything-678ce5623798 https://blog.sindresorhus.com/answering-anything-678ce562379... > How do you make a living if you don’t have a job and don’t take donations? > I don’t make a living, currently. I have some money saved up. I don’t really care much about money or material things, don’t use much money, and don’t have a lot of monthly expenses. > Do you enjoy being homeless? > Definitely. It’s nice being free to travel anywhere at any time. I don’t really care much about material stuff either, so I have everything I need and care about in a small backpack. > How to be rich? > You don’t want to be rich — You want to be happy.

The_rationalist 5y ago

Well your comment is meaningful but you could still have recorded the total number of downloads and the monthly number in order to answer how popular is the library.

throwkeep 5y ago

So true, it's really taken for granted. Especially these days with Github and package managers which make it so easy to end up incorporating a dozen or more 3rd party libraries. There's something impersonal about it, and trivializes the amount of sweat that was poured into the code you're npm installing.

deleted 5y ago

[deleted]

lamontcg 5y ago

I'd really like GitHub to have the option of open sourcing your work but both being able to turn off pull request and be able to limit PRs and issues to trusted contributors. Open source / closed contribution on an individual level. I like the project I'm working on now, but if I release it publicly I don't want to deal with 98% of the possible users. I'm mostly worried about the idea that the itch I want to scratch will turn out to be popular, because open source is mostly horrible.

gamerDude 5y ago

I'm curious. Is there a reason to not build in some sort of ping for the software being used? Essentially doing analytics for open source usage so you can monitor how many people use it? Obviously there are some potential privacy issues here, but adding it to the README and doing a single ping on use seems like not too bad a compromise to keeping open source projects alive. It won't be 100% accurate due to offline use or available to many open source software projects due to their use case, but most applications would probably connect.

spockz 5y ago
Generally apps that send telemetry get a lot of flak here. Even if mentioned in the docs/faq.
glangdale 5y ago
Surprise telemetry is deeply unethical. Putting it in the README is borderline OK, I guess. However, even supposing it's OK, a "single ping on use" is only really feasible if the system has "main()" and some reasonably persistent usage. If you're a small tool - or a library, like we were, "single ping on use" might result in thousands of systems "beaconing" back to home base per hour. For the area we were in (pattern matching is basically computer security-adjacent), this would have been equivalent to shipping malware in terms of sheer career-destroying potential. Not everything is a long-running desktop app.

j1elo 5y ago

Maybe an easy solution is to do the thing everybody seems to discourage: add a clause to your preferred OSS license, stating that usage of the code is subject to sending a mandatory thank-you email. That change alone might be enough to break the fragile conditions that allow the license to be considered Open Source... but who cares, the mental health and happiness of OSS devs affected by the difficulties mentioned in here is more important than the technicalities of what could happen by a small clause addition.

pizza234 5y ago
That's Postcardware!¹ :) I remember using one, but I not exactly which one; it's not in the Wikipedia list. ¹=https://en.wikipedia.org/wiki/Postcardware#Postcardware https://en.wikipedia.org/wiki/Postcardware#Postcardware
- pizza234 5y ago
  Found: it was (not anymore) Exact Audio Copy¹. ¹=https://www.exactaudiocopy.de/en/wp-content/uploads/2007/03/eacdoc.pdf https://www.exactaudiocopy.de/en/wp-content/uploads/2007/03/...

hinkley 5y ago

I think Richard Stallman's cynicism about licenses was misplaced 30 years ago, but that the tide is turning. I do prefer to work on libraries that are available for commercial work. But I also cannot get my employers to pay for said libraries. Which is how many of us started using OSS in the first place - because nobody could smack us with a checkbook and say no.

deleted 5y ago

[deleted]

pjmlp 5y ago

Unwilligness to pay for developer tools or desktop software is what made me gave up and just focus on Apple, Google, and Microsoft platforms. I rather work for ecosystems where customers see a value that developers keep their job.

glangdale 5y ago
Andy Gocke put it best, on Twitter: "Developer tools seemed like a good industry to be in, "sell shovels in the gold rush" and all, but it turns out developers prefer to dig for gold with their teeth."
- pjmlp 5y ago
  Yeah I love the quote, specially the irony wanted to be paid, while unwilling to pay the work of others.

halfdan 5y ago

I'm so sorry to hear that has happened to the team behind hyperscan. It's truly a fantastic library and has helped us speed up some of our regex heavy workloads write drastically. I even spent some time writing about hyperscan both internally (at $dayjob) and externally. Thanks for your work on hyperscan! I think I'll identify a few other libraries that we use and reach out to their developers - it's a good reminder to not take everything for granted. https://geekmonkey.org/regular-expression-matching-at-scale-with-hyperscan/ https://geekmonkey.org/regular-expression-matching-at-scale-...

gowld 5y ago

> Much as I dislike those wacky "free for non-commercial use, otherwise, give me a call" licenses, Why? Disliking someone not giving you free money seems rude.