5 ms·

> You need a proper "asshole" in such organizations that will go and threaten complete lack of support if the bill isn't paid. That's the point, they don't pay

by jbk 5y ago

> You need a proper "asshole" in such organizations that will go and threaten complete lack of support if the bill isn't paid. That's the point, they don't pay, and they don't get support. But they still complain when there is a major CVE. > For comparison, $1M is the total yearly cost of ~3 average engineers at FAANGs. I wish we got that...

bogwog 5y ago
1) Create a funding report newsletter for FFMPEG 2) When funding is low, big scary exclamation marks all over the place 3) Include a bulleted list of doomsday scenarios showing what could happen to YOU if a bug/vulnerability is found 4) Add a picture of a sad kitten or crying baby for good measure Now just subscribe all of the non-tech business people at organizations that use FFMPEG, and wait for them to panic. (Make sure that they need to call you to unsubscribe from the newsletter, especially if they work at the New York Times)
- justinclift 5y ago
  > Now just subscribe all of the non-tech business people at organizations that use FFMPEG ... Don't do that bit unless you're sure it's not illegal in your (and their) jurisdiction. Spam being a thing, and there being laws against it.
  - bogwog 5y ago
    Easy solution, update the FFMPEG license with something like: > By using this software, you agree to subscribe to our monthly newsletter (I was joking btw, in case that wasn't clear)
- DarylZero 5y ago
  >Now just subscribe all of the non-tech business people at organizations Ah, if only one could "just" get a mass of people's attention and send the message
infogulch 5y ago
Note "yearly cost". Between administrative and organizational overhead, taxes, benefits, etc, typically only 50% of that cost is actually taken home as employee-visible salary [1] (which the employee then pays income taxes on...). $175k is still a healthy salary especially when compared to other locales, but it's not the $333k that is easy to presume based on GP's comment. [1]: From what I've seen this ~50% number seems to be pretty close to the mark across virtually all industries and jobs. I.e. it's pretty safe to assume that the total cost to your employer to retain you is around double your take home pay.
- cma 5y ago
  It doesn't seem like that 50% number would just keep scaling with salary. There is a cap on payroll tax [1], administration stuff around administering health, vacation, etc. doesn't change that much, office space.. maybe so with things like the Apple spaceship ($5 billion with capabilities for 12,000 employees; amortized over 25 years would be $16,000 per employee so I wouldn't think so). [1] https://en.wikipedia.org/wiki/Payroll_tax#/media/File:Effective_Payroll_Tax_rate_for_Different_Income_Percentiles_(2010).gif https://en.wikipedia.org/wiki/Payroll_tax#/media/File:Effect...
watwut 5y ago
Do those specific managers and layers really complain about CVE? Afaik they don't care or know.
bscphil 5y ago
> That's the point, they don't pay, and they don't get support. But they still complain You've put your finger on the core of the issue with FiloSottile's suggestion. The problem is that to sell something to a big corporation, you need to have something tangible you can sell. What you have are enormous pieces of widely used software, being given away for free. Many companies are going to take that and run with it, and forgo a support contract entirely. You may argue that they want support when there's an issue, but the truth is they're happy enough with the status quo and just complaining a lot. In FiloSottile's model, a corporation needs to use your software for something specific, but also expects to need changes to it or prioritized issue support and approaches you; you send them an invoice with five zeroes on it as a bill for your services and they are heavily incentivized to pay for it. Unfortunately that's not the reality for 99.9% of open source maintainers, a figure that includes most creators of popular software like VLC. I've personally contributed to a bunch of projects and maintain some of my own, but it's a hobby. As far as I know no corporations are even using any of them. Figuring out some software niche that no one yet has a product it, building it, and waiting for a corporation to swoop in and drop me a six figure yearly check cannot be a career strategy.
- nerdponx 5y ago
  Would it be unethical to refuse to fix bugs reported by employees of large corporations, unless those corporations pay a support contract or contribute a patch themselves?
  - coryrc 5y ago
    No
  - bfung 5y ago
    It’s not unethical. In fact, why not!? Sure, someone else may start a competing project…
  - Aeolun 5y ago
    I mean, I’d eventually get around to them I guess? But on my schedule, not theirs. If you want it fixed now submit a PR that I can accept. That’s what I do anyway.

by jbk 5y ago

bogwog 5y ago

1) Create a funding report newsletter for FFMPEG 2) When funding is low, big scary exclamation marks all over the place 3) Include a bulleted list of doomsday scenarios showing what could happen to YOU if a bug/vulnerability is found 4) Add a picture of a sad kitten or crying baby for good measure Now just subscribe all of the non-tech business people at organizations that use FFMPEG, and wait for them to panic. (Make sure that they need to call you to unsubscribe from the newsletter, especially if they work at the New York Times)

justinclift 5y ago
> Now just subscribe all of the non-tech business people at organizations that use FFMPEG ... Don't do that bit unless you're sure it's not illegal in your (and their) jurisdiction. Spam being a thing, and there being laws against it.
- bogwog 5y ago
  Easy solution, update the FFMPEG license with something like: > By using this software, you agree to subscribe to our monthly newsletter (I was joking btw, in case that wasn't clear)
DarylZero 5y ago
>Now just subscribe all of the non-tech business people at organizations Ah, if only one could "just" get a mass of people's attention and send the message

infogulch 5y ago

Note "yearly cost". Between administrative and organizational overhead, taxes, benefits, etc, typically only 50% of that cost is actually taken home as employee-visible salary [1] (which the employee then pays income taxes on...). $175k is still a healthy salary especially when compared to other locales, but it's not the $333k that is easy to presume based on GP's comment. [1]: From what I've seen this ~50% number seems to be pretty close to the mark across virtually all industries and jobs. I.e. it's pretty safe to assume that the total cost to your employer to retain you is around double your take home pay.

cma 5y ago
It doesn't seem like that 50% number would just keep scaling with salary. There is a cap on payroll tax [1], administration stuff around administering health, vacation, etc. doesn't change that much, office space.. maybe so with things like the Apple spaceship ($5 billion with capabilities for 12,000 employees; amortized over 25 years would be $16,000 per employee so I wouldn't think so). [1] https://en.wikipedia.org/wiki/Payroll_tax#/media/File:Effective_Payroll_Tax_rate_for_Different_Income_Percentiles_(2010).gif https://en.wikipedia.org/wiki/Payroll_tax#/media/File:Effect...

watwut 5y ago

Do those specific managers and layers really complain about CVE? Afaik they don't care or know.

bscphil 5y ago

> That's the point, they don't pay, and they don't get support. But they still complain You've put your finger on the core of the issue with FiloSottile's suggestion. The problem is that to sell something to a big corporation, you need to have something tangible you can sell. What you have are enormous pieces of widely used software, being given away for free. Many companies are going to take that and run with it, and forgo a support contract entirely. You may argue that they want support when there's an issue, but the truth is they're happy enough with the status quo and just complaining a lot. In FiloSottile's model, a corporation needs to use your software for something specific, but also expects to need changes to it or prioritized issue support and approaches you; you send them an invoice with five zeroes on it as a bill for your services and they are heavily incentivized to pay for it. Unfortunately that's not the reality for 99.9% of open source maintainers, a figure that includes most creators of popular software like VLC. I've personally contributed to a bunch of projects and maintain some of my own, but it's a hobby. As far as I know no corporations are even using any of them. Figuring out some software niche that no one yet has a product it, building it, and waiting for a corporation to swoop in and drop me a six figure yearly check cannot be a career strategy.

nerdponx 5y ago
Would it be unethical to refuse to fix bugs reported by employees of large corporations, unless those corporations pay a support contract or contribute a patch themselves?
- coryrc 5y ago
  No
- bfung 5y ago
  It’s not unethical. In fact, why not!? Sure, someone else may start a competing project…
- Aeolun 5y ago
  I mean, I’d eventually get around to them I guess? But on my schedule, not theirs. If you want it fixed now submit a PR that I can accept. That’s what I do anyway.