8 ms·

No, it's not broken -- it's thriving. Everyone involved has their own incentives, and gets to make their own decisions about when and where to invest their tim

No, it's not broken -- it's thriving. Everyone involved has their own incentives, and gets to make their own decisions about when and where to invest their time and money. Some devs are in it for the passion, some for the experience, some for the challenge, some for the learning, some so their work will live on when they change employers. Startups get to use well-tested community supported libraries and don't have to build everything from scratch. Big companies get tech branding cred and can attract better talent, etc, etc. And yes, maintainers sometimes get burnt out, consumers sometimes act inappropriately entitled, massively profitable enterprises often give back relatively little in return. But that's all part of the deal going in, and everyone is fully aware of all the trade-offs straight from the onset. What's so beautiful is that there are so many options whenever conditions change for any party. A maintainer goes to jail for vehicular manslaughter and a bugs needs fixing, no problem. Stand up a fork and the project continues on. A company's new leadership takes its own source project in a questionable direction and consumers are upset, no problem. Community forks and the project lives on. And the result is we have this thriving, organic, creative, productive ecosystem which benefits us all in the end.

CaptArmchair 5y ago
I think this argument massively ignores the underlying message of this blogpost: addressing that the human beings that make and use software aren't always treated as, well, human beings. > A maintainer goes to jail for vehicular manslaughter and a bugs needs fixing, no problem The author didn't seem to hint that open bugs in core-js or its usefulness to its community of users are / is problematic. They hinted that maintainers are people with real life problems, whether that's struggling to make a livelihood, or facing imprisonment and ignoring that social/economic context is problematic. Stating "well, let's just fork their code and off we go" basically ignores the person behind the code entirely. It reduces the value of a person to their ability to spend time and effort on maintaining code. And that's just a morally very questionable way of approaching other people. That kind of behavior just doesn't foster any mutual trust or respect which are the basic requirements for open source to thrive to begin with. > But that's all part of the deal going in, and everyone is fully aware of all the trade-offs straight from the onset. No, absolutely not. That's not how the original instigators of the Open Source movement envisioned this. Yes, open source licensing allows forking, but that's not something you'd do, for instance, because a maintainer fails to respond to your issues on GitHub. Eric S. Raymond can be quoted from his seminal essay "Homesteading the noosphere": > The three taboos we observed above make perfect sense under this analysis. One's reputation can suffer unfairly if someone else misappropriates or mangles one's work; these taboos (and related customs) attempt to prevent this from happening. (Or, to put it more pragmatically, hackers generally refrain from forking or rogue-patching others' projects in order to be able to deny legitimacy to the same behavior practiced against themselves.) > Forking projects is bad because it exposes pre-fork contributors to a reputation risk they can only control by being active in both child projects simultaneously after the fork. (This would generally be too confusing or difficult to be practical.) > Distributing rogue patches (or, much worse, rogue binaries) exposes the owners to an unfair reputation risk. Even if the official code is perfect, the owners will catch flak from bugs in the patches (but see [RP]). > Surreptitiously filing someone's name off a project is, in cultural context, one of the ultimate crimes. Doing this steals the victim's gift to be presented as the thief's own. http://catb.org/~esr/writings/homesteading/homesteading/ar01s09.html http://catb.org/~esr/writings/homesteading/homesteading/ar01... Especially the last taboo is incriminating. In the past, I kept a handful of tiny open source libraries in PHP on Packagist. Someone forked one of those without notifying me and started directly competing with mine. I can't express how off putting that experience was at the time. It has made me quite apprehensive of pro-actively sharing code I write in my spare time under an open source license. Because someone falls on hard times or isn't available for a while, that doesn't justify taking their work and presenting it as your own under the guise of "having a thriving, organic, creative, productive ecosystem."
- icambron 5y ago
  ESR doesn't get to decide how it works; the revealed preferences of the participants do. And those revealed preferences are that everyone pretty much does what they want, and nobody owes anybody anything. And it seems to have clearly created a vibrant ecosystem. If you're in it for money or the fame, you're going to end up very unhappy. If you prioritize OSS work above addressing your real life problems, you're going to end up unhappy. If you invest your ego into the success of the project, you'll probably end up unhappy Those aren't broken properties of the system; they're the consequences of transparently poor decisions by participants. Those people would be better served by simply not doing OSS instead of trying to convince everyone else to fund their coding adventures. I am the sole maintainer of a project with almost 12k stars on GH and 2M weekly downloads from NPM. It would be a massive amount of work if I let it be. The entitlement and indifference of users would eat me alive if it were a real workplace. And the pay would be hilariously bad if I expected income from it. But none of those predicates are true. No one asked me to make it, no one pays me for it, and no one controls what I spend my time on. Those mutual obligations are properties of jobs, exactly what I don't want out my hobby work. When I don't want to work on it, I just don't. When a bunch of people want a feature I have no wish to add, I don't add it and they're free to fork. When I write or merge a bug, I lose no sleep over it. When people "threaten" to use a "competing" library, I laugh: who cares? Building it is fun for me and it's apparently useful to others. What's the problem? Since all that seems to work pretty well, the right answer is to keep doing it. Sure, you'll end up with occasional log4j RCEs, but it's not like anyone is going to look at that and say, "I guess I won't use OSS". It was always caveat emptor.
  - CaptArmchair 5y ago
    You're addressing maintainers who somehow arrive at open source with expectations which set them up for failure and disappointment. I can agree with you there. In the past, I've made comments that open source isn't a business model. It's a licensing model which governs intellectual property. My comment, however, isn't addressing maintainers. It's addressing their audience and their behavior: anyone who uses and leverages open source code without consideration of the labor that goes into it, which is a big difference. ESR is absolutely right when he points out that anyone who shares creative work also shows themselves vulnerable when it comes to reputation, good name and public perception. Sure, you could use the argument that "open source doesn't make any promises regarding support". But that still doesn't excuse the entitlement and indifference. If you can happily ignore it, that's great for you. Calling it out for what it is, however, isn't any less valid a way of responding. Even when it's just a hobby project and you don't get paid. Every so often, there's a case where a small open source project with limited maintenance ends up being leveraged by entire industries with interests worth billions. When things fall apart, media outlets and pundits will report about the failings of that small project and how it affects big interests, but they won't point out the elephant in the room: how these projects are maintained by a skeleton crew working in their spare time. The Ars Technica article is an example of this: https://arstechnica.com/information-technology/2021/12/minecraft-and-other-apps-face-serious-threat-from-new-code-execution-bug/ https://arstechnica.com/information-technology/2021/12/minec... At most, the lack of due diligence of these big passive players gets called out, like in this Wired article: https://www.wired.com/story/log4j-flaw-hacking-internet/ https://www.wired.com/story/log4j-flaw-hacking-internet/ Sure, none of this is going to awaken people's minds to be more apprehensive or more empathic to the challenges of maintaining a popular OSS project. The value proposition of being able to leverage free labor is simply too attractive. Meanwhile though, the log4j maintainers are now stuck being perceived as not having done enough to avoid these kinds of bugs. Whether that's trough investing "enough" time, making the "right" calls (whatever those are) or finding "appropriate sources of funding" for themselves. Thousands of engineers are scrambling to roll out fixes upstream. And millions of end users merely learn how "a software bug almost breaks the Internet and Minecraft." Ultimately, nobody gains from these disasters as a result of a lack of assuming shared responsibility for a common good.
suriyaG 5y ago
I mostly agree with your argument. But, if we just de facto accept everything for how it has been in the past. Then we stop making things better, for everybody involved. Is Open-Source thriving? yes. Can we make fix the places where it's broken? Also, Yes.
- deleted 5y ago
  [deleted]
- jchw 5y ago
  > Can we make fix the places where it's broken? Also, Yes. Two problems: 1. How is it broken? As I and others in this thread attest to, the thing that makes open source so powerful is, in fact, the lack of legal and moral obligation to do anything in exchange for the right to use the software. Not having obligations is a two-way street. Same for donations; donations do not give you any additional assurances. 2. If it is truly broken, then what is the solution? Nobody has really offered any solution, that I can see. If the solution is that everyone rushes to support a project the moment it hits the news, that's not sustainable. It's good that log4j and its maintainer(s) will get more attention and hopefully funding as a result of this snafu, but it's not a sustainable solution to a problem. (As a clarification, I am not implying that the answer is "it's not broken." I certainly do agree that open source is underfunded, though I think this is more of a procedural issue than anything.)
  - historynops 5y ago
    "everyone rushes to support a project the moment it hits the news, that's not sustainable." This is exactly how a lot of things function, especially in government and disasters. So apparently it is sustainable. It's just not ideal, but this element is always going to be a part of human nature as our collective consciousness can only focus on fixing a few things at a time.
  - Master_Odin 5y ago
    I feel like a lot of this isn't that individuals are the ones who should be forking over money, but rather corporations who are making tens of millions or billions who rely on this stuff as a core to their stack, but do nothing to support the ecosystem monetarily.
Operyl 5y ago
> But that's all part of the deal going in, and everyone is fully aware of all the trade-offs straight from the onset. I think part of the problem here, in all honesty, is that some people just _are not_ aware of the trade-offs upfront. They learn these after getting started, and it bites them in the butt one way or another.
- rboes 5y ago
  I was going to say this. Most are just looking for some experience outside school/work and next thing you know they are the only one maintaining something big companies rely on.
littlestymaar 5y ago
Yes it's thriving, but it's also broken. From a tweet[1] cited in the article: > This is the maintainer who fixed the vulnerability that's causing millions(++?) of dollars of damage. > "I work on Log4j in my spare time" > "always dreamed of working on open source full time" > "3 sponsors are funding @rgoers's work: Michael, Glenn, Matt" [1]: https://twitter.com/FiloSottile/status/1469441487175880711 https://twitter.com/FiloSottile/status/1469441487175880711
- charcircuit 5y ago
  No one is entitled to money. There's nothing broken about that. If you want to make money it would be a good idea to make a business plan. Making and maintaining a piece of software and giving it away for free isn't a great business plan, or at best it's an incomplete one.
  - thr0wawayf00 5y ago
    > No one is entitled to money. There's nothing broken about that. If you want to make money it would be a good idea to make a business plan. This attitude totally ignores how hard it is to actually run a software tooling business and collect when you have a free/community offering. Take the Obsidian note app, for example. It's technically free until you start using it for revenue-generating, work-related activity per their license, but how do they go about enforcing that? If they were to dig through customer data to see who is violating the agreement, they'd get roasted on Twitter in an instant and risk losing their user base. Should they hire attorneys to investigate and shake down violators for the $25/mo fee plus damages? Again, major risk of losing the customer base. Software devs have to represent a significant, if not majority share of the user base of Obsidian, and I'd bet a year of my salary that most of them aren't paying for it when they're using it for work. Committing to a business plan is an important step, but software's value is directly correlated with it's use, and more widely used software is inherently more valuable, but achieving that kind of growth without giving it away free is a major challenge. It kinda feels like tipping in the restaurant industry, where folks argue that it's to ensure proper service, when in reality it's often just a way for the restaurant owner to not have to pay minimum wage by offloading that portion of a workers wages onto the customer, who often just doesn't give a tip.
zebraflask 5y ago
Just out of curiosity - I wouldn't use vehicular manslaughter as a point of comparison for open source projects? Is there a reference I'm missing with that part of the comment?
- xena 5y ago
  See https://www.theregister.com/2020/03/26/corejs_maintainer_jailed_code_release/ https://www.theregister.com/2020/03/26/corejs_maintainer_jai... for more context.
  - zebraflask 5y ago
    Ah. Unfortunate.
zozbot234 5y ago
ESR - the person who coined "open source" in the first place! - agrees that this is a problem worth addressing. See his Loadsharers initiatve http://www.catb.org/esr/loadsharers/ http://www.catb.org/esr/loadsharers/ (more info at https://esr.gitlab.io/loadsharers/ https://esr.gitlab.io/loadsharers/ ) discussed http://esr.ibiblio.org/?p=8383 http://esr.ibiblio.org/?p=8383 http://esr.ibiblio.org/?p=8387 http://esr.ibiblio.org/?p=8387 http://esr.ibiblio.org/?p=8403 http://esr.ibiblio.org/?p=8403
- cxr 5y ago
  > ESR - the person who coined "open source" in the first place! He popularized the term. He didn't coin it (and AFAIK he doesn't claim to, although even if he were, it would be a separate matter).
- jchw 5y ago
  I think most people, at least certainly myself, do not disagree that open source infrastructure projects are often underappreciated and underfunded. However, there's a dramatic difference between the way that ESR's LBIP initiative frames the problem vs this article (not to single anyone out - this article expresses a commonly held belief among plenty of influential and intelligent people, and no doubt the person who wrote the article is one.) To me, the money quote is here: > If log4j2 is responsible for your company's success, you have a moral obligation to donate to the person who creates this library thanklessly. I don't agree. I think that it is tragic if nobody does, but I draw the line at "moral obligation." Furthermore, the article doesn't really provide any sustainable solution, it just expresses that it's broken and says people should pay for it. Initiatives like ESR's LBIP proves that there are some attempts to get more funding in, but the problem is manyfold, and simply put: I don't think trying to create a new norm that there is a moral obligation to pay your dependencies is really a good idea, nor do I think it solves the problems that lead to this situation. I think that discovery and awareness of load-bearing dependencies is an even greater problem, and that plenty of entities that relied heavily on log4j had honestly not even realized it until now. I'll repeat myself: It's good that log4j will now see additional attention and funding, if only temporarily, but it's still not fixing the sustainability problem if we only ever fund things when they become newsworthy snafus.
pjmlp 5y ago
Hence why SaaS are thriving, what better way to get free beer while charging subscriptions to their users, and give zero back.
KronisLV 5y ago
> Some devs are in it for the passion, some for the experience, some for the challenge, some for the learning, some so their work will live on when they change employers. Sure, but what about people who could write code, help with docs, testing etc., but can't because of the current financial disincentives to do that? With my current salary in my country, i make around $21k a year, about which i wrote here (including information about my savings): https://blog.kronis.dev/articles/on-finances-and-savings https://blog.kronis.dev/articles/on-finances-and-savings With these current circumstances, i cannot be in my right mind and decide to meaningfully commit to open source, apart from small bug fixes or something, unless i want to miss out on spending time with family or anything else over the evenings and weekends, because my day job takes up the rest of my time. Sure, you can talk about that particular salary number (though it's similar for many people in Eastern Europe, India and many other places), or talk about how i should try to convince my management to allow me to contribute to open source (which is a non starter in many circumstances), but at the end of the day it'd be like quitting my job because i want to develop a video game or something without having a clear plan on how to make money and just vague hopes and dreams instead (which i've seen often as well). For example, i'd have to give up freelancing to do that, which would just further hurt my finances. I commented on another thread here, but just look at this: https://staltz.com/software-below-the-poverty-line.html https://staltz.com/software-below-the-poverty-line.html Open source isn't a financially responsible choice for many non-privileged folks out there (e.g. company doesn't invest in it, don't have savings to avoid having to live paycheck to paycheck). Just look at this comment in the other thread: https://news.ycombinator.com/item?id=29525272 https://news.ycombinator.com/item?id=29525272 > The default is that no one will use your thing, no one will contribute, no one will fund you, etc. In my eyes, doing meaningful work is logically supposed to be followed by not being punished for it, such as not having to starve or be homeless (maybe the "just world" fallacy on my part). No one should be able to praise the open source devs for their work and then just turn around in that same sentence and shun them for wanting to be supported financially for doing that, or claim that these incentives are not valid in some way.

CaptArmchair 5y ago

I think this argument massively ignores the underlying message of this blogpost: addressing that the human beings that make and use software aren't always treated as, well, human beings. > A maintainer goes to jail for vehicular manslaughter and a bugs needs fixing, no problem The author didn't seem to hint that open bugs in core-js or its usefulness to its community of users are / is problematic. They hinted that maintainers are people with real life problems, whether that's struggling to make a livelihood, or facing imprisonment and ignoring that social/economic context is problematic. Stating "well, let's just fork their code and off we go" basically ignores the person behind the code entirely. It reduces the value of a person to their ability to spend time and effort on maintaining code. And that's just a morally very questionable way of approaching other people. That kind of behavior just doesn't foster any mutual trust or respect which are the basic requirements for open source to thrive to begin with. > But that's all part of the deal going in, and everyone is fully aware of all the trade-offs straight from the onset. No, absolutely not. That's not how the original instigators of the Open Source movement envisioned this. Yes, open source licensing allows forking, but that's not something you'd do, for instance, because a maintainer fails to respond to your issues on GitHub. Eric S. Raymond can be quoted from his seminal essay "Homesteading the noosphere": > The three taboos we observed above make perfect sense under this analysis. One's reputation can suffer unfairly if someone else misappropriates or mangles one's work; these taboos (and related customs) attempt to prevent this from happening. (Or, to put it more pragmatically, hackers generally refrain from forking or rogue-patching others' projects in order to be able to deny legitimacy to the same behavior practiced against themselves.) > Forking projects is bad because it exposes pre-fork contributors to a reputation risk they can only control by being active in both child projects simultaneously after the fork. (This would generally be too confusing or difficult to be practical.) > Distributing rogue patches (or, much worse, rogue binaries) exposes the owners to an unfair reputation risk. Even if the official code is perfect, the owners will catch flak from bugs in the patches (but see [RP]). > Surreptitiously filing someone's name off a project is, in cultural context, one of the ultimate crimes. Doing this steals the victim's gift to be presented as the thief's own. http://catb.org/~esr/writings/homesteading/homesteading/ar01s09.html http://catb.org/~esr/writings/homesteading/homesteading/ar01... Especially the last taboo is incriminating. In the past, I kept a handful of tiny open source libraries in PHP on Packagist. Someone forked one of those without notifying me and started directly competing with mine. I can't express how off putting that experience was at the time. It has made me quite apprehensive of pro-actively sharing code I write in my spare time under an open source license. Because someone falls on hard times or isn't available for a while, that doesn't justify taking their work and presenting it as your own under the guise of "having a thriving, organic, creative, productive ecosystem."

icambron 5y ago
ESR doesn't get to decide how it works; the revealed preferences of the participants do. And those revealed preferences are that everyone pretty much does what they want, and nobody owes anybody anything. And it seems to have clearly created a vibrant ecosystem. If you're in it for money or the fame, you're going to end up very unhappy. If you prioritize OSS work above addressing your real life problems, you're going to end up unhappy. If you invest your ego into the success of the project, you'll probably end up unhappy Those aren't broken properties of the system; they're the consequences of transparently poor decisions by participants. Those people would be better served by simply not doing OSS instead of trying to convince everyone else to fund their coding adventures. I am the sole maintainer of a project with almost 12k stars on GH and 2M weekly downloads from NPM. It would be a massive amount of work if I let it be. The entitlement and indifference of users would eat me alive if it were a real workplace. And the pay would be hilariously bad if I expected income from it. But none of those predicates are true. No one asked me to make it, no one pays me for it, and no one controls what I spend my time on. Those mutual obligations are properties of jobs, exactly what I don't want out my hobby work. When I don't want to work on it, I just don't. When a bunch of people want a feature I have no wish to add, I don't add it and they're free to fork. When I write or merge a bug, I lose no sleep over it. When people "threaten" to use a "competing" library, I laugh: who cares? Building it is fun for me and it's apparently useful to others. What's the problem? Since all that seems to work pretty well, the right answer is to keep doing it. Sure, you'll end up with occasional log4j RCEs, but it's not like anyone is going to look at that and say, "I guess I won't use OSS". It was always caveat emptor.
- CaptArmchair 5y ago
  You're addressing maintainers who somehow arrive at open source with expectations which set them up for failure and disappointment. I can agree with you there. In the past, I've made comments that open source isn't a business model. It's a licensing model which governs intellectual property. My comment, however, isn't addressing maintainers. It's addressing their audience and their behavior: anyone who uses and leverages open source code without consideration of the labor that goes into it, which is a big difference. ESR is absolutely right when he points out that anyone who shares creative work also shows themselves vulnerable when it comes to reputation, good name and public perception. Sure, you could use the argument that "open source doesn't make any promises regarding support". But that still doesn't excuse the entitlement and indifference. If you can happily ignore it, that's great for you. Calling it out for what it is, however, isn't any less valid a way of responding. Even when it's just a hobby project and you don't get paid. Every so often, there's a case where a small open source project with limited maintenance ends up being leveraged by entire industries with interests worth billions. When things fall apart, media outlets and pundits will report about the failings of that small project and how it affects big interests, but they won't point out the elephant in the room: how these projects are maintained by a skeleton crew working in their spare time. The Ars Technica article is an example of this: https://arstechnica.com/information-technology/2021/12/minecraft-and-other-apps-face-serious-threat-from-new-code-execution-bug/ https://arstechnica.com/information-technology/2021/12/minec... At most, the lack of due diligence of these big passive players gets called out, like in this Wired article: https://www.wired.com/story/log4j-flaw-hacking-internet/ https://www.wired.com/story/log4j-flaw-hacking-internet/ Sure, none of this is going to awaken people's minds to be more apprehensive or more empathic to the challenges of maintaining a popular OSS project. The value proposition of being able to leverage free labor is simply too attractive. Meanwhile though, the log4j maintainers are now stuck being perceived as not having done enough to avoid these kinds of bugs. Whether that's trough investing "enough" time, making the "right" calls (whatever those are) or finding "appropriate sources of funding" for themselves. Thousands of engineers are scrambling to roll out fixes upstream. And millions of end users merely learn how "a software bug almost breaks the Internet and Minecraft." Ultimately, nobody gains from these disasters as a result of a lack of assuming shared responsibility for a common good.

suriyaG 5y ago

I mostly agree with your argument. But, if we just de facto accept everything for how it has been in the past. Then we stop making things better, for everybody involved. Is Open-Source thriving? yes. Can we make fix the places where it's broken? Also, Yes.

deleted 5y ago
[deleted]
jchw 5y ago
> Can we make fix the places where it's broken? Also, Yes. Two problems: 1. How is it broken? As I and others in this thread attest to, the thing that makes open source so powerful is, in fact, the lack of legal and moral obligation to do anything in exchange for the right to use the software. Not having obligations is a two-way street. Same for donations; donations do not give you any additional assurances. 2. If it is truly broken, then what is the solution? Nobody has really offered any solution, that I can see. If the solution is that everyone rushes to support a project the moment it hits the news, that's not sustainable. It's good that log4j and its maintainer(s) will get more attention and hopefully funding as a result of this snafu, but it's not a sustainable solution to a problem. (As a clarification, I am not implying that the answer is "it's not broken." I certainly do agree that open source is underfunded, though I think this is more of a procedural issue than anything.)
- historynops 5y ago
  "everyone rushes to support a project the moment it hits the news, that's not sustainable." This is exactly how a lot of things function, especially in government and disasters. So apparently it is sustainable. It's just not ideal, but this element is always going to be a part of human nature as our collective consciousness can only focus on fixing a few things at a time.
- Master_Odin 5y ago
  I feel like a lot of this isn't that individuals are the ones who should be forking over money, but rather corporations who are making tens of millions or billions who rely on this stuff as a core to their stack, but do nothing to support the ecosystem monetarily.

Operyl 5y ago

> But that's all part of the deal going in, and everyone is fully aware of all the trade-offs straight from the onset. I think part of the problem here, in all honesty, is that some people just _are not_ aware of the trade-offs upfront. They learn these after getting started, and it bites them in the butt one way or another.

rboes 5y ago
I was going to say this. Most are just looking for some experience outside school/work and next thing you know they are the only one maintaining something big companies rely on.

littlestymaar 5y ago

Yes it's thriving, but it's also broken. From a tweet[1] cited in the article: > This is the maintainer who fixed the vulnerability that's causing millions(++?) of dollars of damage. > "I work on Log4j in my spare time" > "always dreamed of working on open source full time" > "3 sponsors are funding @rgoers's work: Michael, Glenn, Matt" [1]: https://twitter.com/FiloSottile/status/1469441487175880711 https://twitter.com/FiloSottile/status/1469441487175880711

charcircuit 5y ago
No one is entitled to money. There's nothing broken about that. If you want to make money it would be a good idea to make a business plan. Making and maintaining a piece of software and giving it away for free isn't a great business plan, or at best it's an incomplete one.
- thr0wawayf00 5y ago
  > No one is entitled to money. There's nothing broken about that. If you want to make money it would be a good idea to make a business plan. This attitude totally ignores how hard it is to actually run a software tooling business and collect when you have a free/community offering. Take the Obsidian note app, for example. It's technically free until you start using it for revenue-generating, work-related activity per their license, but how do they go about enforcing that? If they were to dig through customer data to see who is violating the agreement, they'd get roasted on Twitter in an instant and risk losing their user base. Should they hire attorneys to investigate and shake down violators for the $25/mo fee plus damages? Again, major risk of losing the customer base. Software devs have to represent a significant, if not majority share of the user base of Obsidian, and I'd bet a year of my salary that most of them aren't paying for it when they're using it for work. Committing to a business plan is an important step, but software's value is directly correlated with it's use, and more widely used software is inherently more valuable, but achieving that kind of growth without giving it away free is a major challenge. It kinda feels like tipping in the restaurant industry, where folks argue that it's to ensure proper service, when in reality it's often just a way for the restaurant owner to not have to pay minimum wage by offloading that portion of a workers wages onto the customer, who often just doesn't give a tip.

zebraflask 5y ago

Just out of curiosity - I wouldn't use vehicular manslaughter as a point of comparison for open source projects? Is there a reference I'm missing with that part of the comment?

xena 5y ago
See https://www.theregister.com/2020/03/26/corejs_maintainer_jailed_code_release/ https://www.theregister.com/2020/03/26/corejs_maintainer_jai... for more context.
- zebraflask 5y ago
  Ah. Unfortunate.

zozbot234 5y ago

ESR - the person who coined "open source" in the first place! - agrees that this is a problem worth addressing. See his Loadsharers initiatve http://www.catb.org/esr/loadsharers/ http://www.catb.org/esr/loadsharers/ (more info at https://esr.gitlab.io/loadsharers/ https://esr.gitlab.io/loadsharers/ ) discussed http://esr.ibiblio.org/?p=8383 http://esr.ibiblio.org/?p=8383 http://esr.ibiblio.org/?p=8387 http://esr.ibiblio.org/?p=8387 http://esr.ibiblio.org/?p=8403 http://esr.ibiblio.org/?p=8403

cxr 5y ago
> ESR - the person who coined "open source" in the first place! He popularized the term. He didn't coin it (and AFAIK he doesn't claim to, although even if he were, it would be a separate matter).
jchw 5y ago
I think most people, at least certainly myself, do not disagree that open source infrastructure projects are often underappreciated and underfunded. However, there's a dramatic difference between the way that ESR's LBIP initiative frames the problem vs this article (not to single anyone out - this article expresses a commonly held belief among plenty of influential and intelligent people, and no doubt the person who wrote the article is one.) To me, the money quote is here: > If log4j2 is responsible for your company's success, you have a moral obligation to donate to the person who creates this library thanklessly. I don't agree. I think that it is tragic if nobody does, but I draw the line at "moral obligation." Furthermore, the article doesn't really provide any sustainable solution, it just expresses that it's broken and says people should pay for it. Initiatives like ESR's LBIP proves that there are some attempts to get more funding in, but the problem is manyfold, and simply put: I don't think trying to create a new norm that there is a moral obligation to pay your dependencies is really a good idea, nor do I think it solves the problems that lead to this situation. I think that discovery and awareness of load-bearing dependencies is an even greater problem, and that plenty of entities that relied heavily on log4j had honestly not even realized it until now. I'll repeat myself: It's good that log4j will now see additional attention and funding, if only temporarily, but it's still not fixing the sustainability problem if we only ever fund things when they become newsworthy snafus.

pjmlp 5y ago

Hence why SaaS are thriving, what better way to get free beer while charging subscriptions to their users, and give zero back.

KronisLV 5y ago

> Some devs are in it for the passion, some for the experience, some for the challenge, some for the learning, some so their work will live on when they change employers. Sure, but what about people who could write code, help with docs, testing etc., but can't because of the current financial disincentives to do that? With my current salary in my country, i make around $21k a year, about which i wrote here (including information about my savings): https://blog.kronis.dev/articles/on-finances-and-savings https://blog.kronis.dev/articles/on-finances-and-savings With these current circumstances, i cannot be in my right mind and decide to meaningfully commit to open source, apart from small bug fixes or something, unless i want to miss out on spending time with family or anything else over the evenings and weekends, because my day job takes up the rest of my time. Sure, you can talk about that particular salary number (though it's similar for many people in Eastern Europe, India and many other places), or talk about how i should try to convince my management to allow me to contribute to open source (which is a non starter in many circumstances), but at the end of the day it'd be like quitting my job because i want to develop a video game or something without having a clear plan on how to make money and just vague hopes and dreams instead (which i've seen often as well). For example, i'd have to give up freelancing to do that, which would just further hurt my finances. I commented on another thread here, but just look at this: https://staltz.com/software-below-the-poverty-line.html https://staltz.com/software-below-the-poverty-line.html Open source isn't a financially responsible choice for many non-privileged folks out there (e.g. company doesn't invest in it, don't have savings to avoid having to live paycheck to paycheck). Just look at this comment in the other thread: https://news.ycombinator.com/item?id=29525272 https://news.ycombinator.com/item?id=29525272 > The default is that no one will use your thing, no one will contribute, no one will fund you, etc. In my eyes, doing meaningful work is logically supposed to be followed by not being punished for it, such as not having to starve or be homeless (maybe the "just world" fallacy on my part). No one should be able to praise the open source devs for their work and then just turn around in that same sentence and shun them for wanting to be supported financially for doing that, or claim that these incentives are not valid in some way.