4 ms·

I mostly agree with your argument. But, if we just de facto accept everything for how it has been in the past. Then we stop making things better, for everybody

I mostly agree with your argument. But, if we just de facto accept everything for how it has been in the past. Then we stop making things better, for everybody involved. Is Open-Source thriving? yes. Can we make fix the places where it's broken? Also, Yes.

deleted 5y ago
[deleted]
jchw 5y ago
> Can we make fix the places where it's broken? Also, Yes. Two problems: 1. How is it broken? As I and others in this thread attest to, the thing that makes open source so powerful is, in fact, the lack of legal and moral obligation to do anything in exchange for the right to use the software. Not having obligations is a two-way street. Same for donations; donations do not give you any additional assurances. 2. If it is truly broken, then what is the solution? Nobody has really offered any solution, that I can see. If the solution is that everyone rushes to support a project the moment it hits the news, that's not sustainable. It's good that log4j and its maintainer(s) will get more attention and hopefully funding as a result of this snafu, but it's not a sustainable solution to a problem. (As a clarification, I am not implying that the answer is "it's not broken." I certainly do agree that open source is underfunded, though I think this is more of a procedural issue than anything.)
- historynops 5y ago
  "everyone rushes to support a project the moment it hits the news, that's not sustainable." This is exactly how a lot of things function, especially in government and disasters. So apparently it is sustainable. It's just not ideal, but this element is always going to be a part of human nature as our collective consciousness can only focus on fixing a few things at a time.
- Master_Odin 5y ago
  I feel like a lot of this isn't that individuals are the ones who should be forking over money, but rather corporations who are making tens of millions or billions who rely on this stuff as a core to their stack, but do nothing to support the ecosystem monetarily.
  - DarylZero 5y ago
    Tax the corporations and publicly fund free software.
  - sangnoir 5y ago
    Any large tech company probably uses thousands or tens of thousands of open source components (because the licenses are well understood). Sone even support the projects officially, or unofficially by paying salaries to developers who contribute in their free time. I like licenses that bind all users equally: whether you're a lone developer, a charity, or developing nukes. If you do not like a certain class of use using your software, then choose a license that matches your philosophy. One shouldn't piggyback on common licenses for popularity and then complain about users keeping to the terms if the license.
mbrodersen 5y ago
If you give your work away for $0 then the world will expect to pay $0 for it. That’s it. It isn’t rocket science. If you value your work make companies pay for it.
- city41 5y ago
  Doesn't the reverse hold true too? If you rely on software you paid $0 for and it fails you, you got what you paid for.
  - rboes 5y ago
    Exactly, the companies should be blamed for using the software not the maintainer for not catching the bug on his free time.
  - mbrodersen 5y ago
    Absolutely. However in reality if you give away your work for $0 then people value your work at $0 which means that they expect you to fix problems for $0. The problem is the maintainers giving away their work for $0. OSS is not about free (as in $0) it is about Open Source.
    - em-bee 5y ago
      if this were true then FOSS would never have reached the popularity that it does now. FOSS users give a lot of valuable feedback that makes software better, and they don't generally expect their problems fixed for free. that mainly comes from greedy corporations that exploit free resources for their own gain. i give away my software for free to give back to the community that gives me tons of other free software and to get feedback and patches. if i were to sell it, that would just not happen because we would all compete on price. and because i can't tell the difference between individual FOSS users and large corporations when the software gets downloaded i can't force corporations to pay. nor can i make a license that forces payment from a select group because that would not longer be FOSS.
      - 5y ago
acje 5y ago
I think of open source as a force of nature, sure you can create incentives in your own proximity, and if you are FAANG the radius can be huge, but finite. The fundamental failure here is not related to open source but in how software is integrated and isolated. We need more robust typing in the integration and capabilities to define the isolation. Capabilities alone might have eliminated this whole class of failure to escalate, but not eliminate the initial injection failure. Pretty sure that could have been demonstrated on wasmcloud.dev

deleted 5y ago

[deleted]

jchw 5y ago

> Can we make fix the places where it's broken? Also, Yes. Two problems: 1. How is it broken? As I and others in this thread attest to, the thing that makes open source so powerful is, in fact, the lack of legal and moral obligation to do anything in exchange for the right to use the software. Not having obligations is a two-way street. Same for donations; donations do not give you any additional assurances. 2. If it is truly broken, then what is the solution? Nobody has really offered any solution, that I can see. If the solution is that everyone rushes to support a project the moment it hits the news, that's not sustainable. It's good that log4j and its maintainer(s) will get more attention and hopefully funding as a result of this snafu, but it's not a sustainable solution to a problem. (As a clarification, I am not implying that the answer is "it's not broken." I certainly do agree that open source is underfunded, though I think this is more of a procedural issue than anything.)

historynops 5y ago
"everyone rushes to support a project the moment it hits the news, that's not sustainable." This is exactly how a lot of things function, especially in government and disasters. So apparently it is sustainable. It's just not ideal, but this element is always going to be a part of human nature as our collective consciousness can only focus on fixing a few things at a time.
Master_Odin 5y ago
I feel like a lot of this isn't that individuals are the ones who should be forking over money, but rather corporations who are making tens of millions or billions who rely on this stuff as a core to their stack, but do nothing to support the ecosystem monetarily.
- DarylZero 5y ago
  Tax the corporations and publicly fund free software.
- sangnoir 5y ago
  Any large tech company probably uses thousands or tens of thousands of open source components (because the licenses are well understood). Sone even support the projects officially, or unofficially by paying salaries to developers who contribute in their free time. I like licenses that bind all users equally: whether you're a lone developer, a charity, or developing nukes. If you do not like a certain class of use using your software, then choose a license that matches your philosophy. One shouldn't piggyback on common licenses for popularity and then complain about users keeping to the terms if the license.

mbrodersen 5y ago

If you give your work away for $0 then the world will expect to pay $0 for it. That’s it. It isn’t rocket science. If you value your work make companies pay for it.

city41 5y ago
Doesn't the reverse hold true too? If you rely on software you paid $0 for and it fails you, you got what you paid for.
- rboes 5y ago
  Exactly, the companies should be blamed for using the software not the maintainer for not catching the bug on his free time.
- mbrodersen 5y ago
  Absolutely. However in reality if you give away your work for $0 then people value your work at $0 which means that they expect you to fix problems for $0. The problem is the maintainers giving away their work for $0. OSS is not about free (as in $0) it is about Open Source.
  - em-bee 5y ago
    if this were true then FOSS would never have reached the popularity that it does now. FOSS users give a lot of valuable feedback that makes software better, and they don't generally expect their problems fixed for free. that mainly comes from greedy corporations that exploit free resources for their own gain. i give away my software for free to give back to the community that gives me tons of other free software and to get feedback and patches. if i were to sell it, that would just not happen because we would all compete on price. and because i can't tell the difference between individual FOSS users and large corporations when the software gets downloaded i can't force corporations to pay. nor can i make a license that forces payment from a select group because that would not longer be FOSS.
    - 5y ago

acje 5y ago

I think of open source as a force of nature, sure you can create incentives in your own proximity, and if you are FAANG the radius can be huge, but finite. The fundamental failure here is not related to open source but in how software is integrated and isolated. We need more robust typing in the integration and capabilities to define the isolation. Capabilities alone might have eliminated this whole class of failure to escalate, but not eliminate the initial injection failure. Pretty sure that could have been demonstrated on wasmcloud.dev