6 ms·

It seems like you haven't quite got the concept of open source. Making something open source is about granting freedoms for users of that thing. One of those f

It seems like you haven't quite got the concept of open source. Making something open source is about granting freedoms for users of that thing. One of those freedoms is usually "you owe nothing and can do with it what you wish: sell it, fork it, modify it" in exchange for "the author provides no guarantees and is not liable for this software". Open source authors that expect some benefactor to appear and sprinkle money so that they can quit their day job and work on their hobby full time are, for lack of a better term, delusional. The default is that no one will use your thing, no one will contribute, no one will fund you, etc. Anything beyond that is a fluke.

wpietri 5y ago
> "you owe nothing and can do with it what you wish: sell it, fork it, modify it" in exchange for "the author provides no guarantees and is not liable for this software". This is demonstrably not how many people many treat open-source authors. Just look at how the Log4J folks are feeling right now: https://twitter.com/yazicivo/status/1469349956880408583 https://twitter.com/yazicivo/status/1469349956880408583 I do have some open-source code out there where people have been mostly pleasant and reasonable. It's targeted at developers in particular niches and they do act mostly as you describe. But once it shifts from a peer relationship to a producer/consumer relationship, things can easily get ugly. Ugly in a way that drives people out of open source and keeps people from open-sourcing useful code. You appear to be fine with that. But if anybody's delusional here, it's the people who expect to keep taking from open-source software without worrying about its sustainability.
- pxc 5y ago
  the text of the tweet: > Log4j maintainers have been working sleeplessly on mitigation measures; fixes, docs, CVE, replies to inquiries, etc. Yet nothing is stopping people to bash us, for work we aren't paid for, for a feature we all dislike yet needed to keep due to backward compatibility concerns. Why don't they 'resolve' the security issue by removing the feature and then set up a bug bounty for backporting fixes to the shitty feature? Then the companies that depend on it will actually be on the hook for once. Too much collateral damage for downstream F/OSS? Too unseemly a move, in a moment of ‘crisis’?
  - acidbaseextract 5y ago
    I don't know why you're getting downvoted. This seems like exactly the right move.
  - eyegor 5y ago
    So your proposed solution is for the open source maintainers to release a hotfix build and to put up their own money to host a bug bounty program so someone else can fix it?
    - Aeolun 5y ago
      I think what they mean is: If you want this misfeature back, pay us $50k to do it properly.
  - meribold 5y ago
    Can anyone recommend a service that allows people to back specific GitHub issues (pledge money) other than Bountysource?
    - trevyn 5y ago
      You don’t really need a service, you can just post in the issue “I will pay $X for a merged PR that closes this issue.”
      - meribold 5y ago
        Commenting may work if the issue has one or two large backers that can independently be vetted to be trustworthy. But if there are several dozen small backers, having to track them all down after closing the issue seems less than ideal.
donw 5y ago
I'm not sure to whom you are replying. I can't think of anyone I've ever met that started an open-source project expecting it to become their day job in short order. When your project blows up and mints a herd of new gazillionaires, yes, it's reasonable to ask those companies to fund what is now an important community project. Anybody that says "nope, their money, they do what they want" is spouting the same flavor of dipshittery as "free speech only means the government can't censor, private companies are free to do what they want". Technically correct and functionally disastrous. Societies worth living in can and do not endure this behavior for long. Americans used to understand this. Know why there are schools all over the country named after Andrew Carnegie? Because that ruthless capitalist mercenary, after crushing every one of his competitors to dust, invested a large chunk of his fortune on infrastructure for national wealth that would propel another three generations.
- saghm 5y ago
  I think the point is that while it would be awesome to just have everyone pay open source maintainers what they can afford to when they use their project, in practice relying on people's (or worse, companies') good will is a losing strategy. It seem wildly unrealistic to just expect that everyone will just naturally give back to open source in a meaningful way absent any actual incentives or requirements, and even if it did start happening there would be nothing the situation from returning to the way it was before. I think most of the arguments you'll see against the idea of "just give back to open source maintainers even though you aren't required to" aren't skeptical of the idea that people should be compensated for their work, but just skeptical that peer pressure is the only thing needed to turn the current open source model into one where all maintainers are fairly compensated.
  - donw 5y ago
    You're largely correct, but I'm not speaking about peer pressure. 'Tis the season, so we've been listening to a lot of Christmas carols. One of my favorites is Good King Wenceslas, which concludes with the verse: "Therefore, Christian men, be sure, wealth or rank possessing, Ye who now will bless the poor, shall yourselves find blessing." Charity used to be a behavioral expectation in the West. Charity is not "giving money to somebody else so they can do charity on your behalf" nor is it "paying taxes to fund social programs". Charity is you, directly, investing your resources in your community, with no expectation of return. Today, this assumption no longer holds. The result is the current state of open source, which needs to figure out a license that extracts value from players big enough to pay it, without punishing upstarts into oblivion (and thus forming a protective moat for existing large players). Some percentage of net revenue share strikes me as the right sort of license, with sensible caps and/or some sort of shared pooling mechanism.

wpietri 5y ago

> "you owe nothing and can do with it what you wish: sell it, fork it, modify it" in exchange for "the author provides no guarantees and is not liable for this software". This is demonstrably not how many people many treat open-source authors. Just look at how the Log4J folks are feeling right now: https://twitter.com/yazicivo/status/1469349956880408583 https://twitter.com/yazicivo/status/1469349956880408583 I do have some open-source code out there where people have been mostly pleasant and reasonable. It's targeted at developers in particular niches and they do act mostly as you describe. But once it shifts from a peer relationship to a producer/consumer relationship, things can easily get ugly. Ugly in a way that drives people out of open source and keeps people from open-sourcing useful code. You appear to be fine with that. But if anybody's delusional here, it's the people who expect to keep taking from open-source software without worrying about its sustainability.

pxc 5y ago
the text of the tweet: > Log4j maintainers have been working sleeplessly on mitigation measures; fixes, docs, CVE, replies to inquiries, etc. Yet nothing is stopping people to bash us, for work we aren't paid for, for a feature we all dislike yet needed to keep due to backward compatibility concerns. Why don't they 'resolve' the security issue by removing the feature and then set up a bug bounty for backporting fixes to the shitty feature? Then the companies that depend on it will actually be on the hook for once. Too much collateral damage for downstream F/OSS? Too unseemly a move, in a moment of ‘crisis’?
- acidbaseextract 5y ago
  I don't know why you're getting downvoted. This seems like exactly the right move.
- eyegor 5y ago
  So your proposed solution is for the open source maintainers to release a hotfix build and to put up their own money to host a bug bounty program so someone else can fix it?
  - Aeolun 5y ago
    I think what they mean is: If you want this misfeature back, pay us $50k to do it properly.
- meribold 5y ago
  Can anyone recommend a service that allows people to back specific GitHub issues (pledge money) other than Bountysource?
  - trevyn 5y ago
    You don’t really need a service, you can just post in the issue “I will pay $X for a merged PR that closes this issue.”
    - meribold 5y ago
      Commenting may work if the issue has one or two large backers that can independently be vetted to be trustworthy. But if there are several dozen small backers, having to track them all down after closing the issue seems less than ideal.

donw 5y ago

I'm not sure to whom you are replying. I can't think of anyone I've ever met that started an open-source project expecting it to become their day job in short order. When your project blows up and mints a herd of new gazillionaires, yes, it's reasonable to ask those companies to fund what is now an important community project. Anybody that says "nope, their money, they do what they want" is spouting the same flavor of dipshittery as "free speech only means the government can't censor, private companies are free to do what they want". Technically correct and functionally disastrous. Societies worth living in can and do not endure this behavior for long. Americans used to understand this. Know why there are schools all over the country named after Andrew Carnegie? Because that ruthless capitalist mercenary, after crushing every one of his competitors to dust, invested a large chunk of his fortune on infrastructure for national wealth that would propel another three generations.

saghm 5y ago
I think the point is that while it would be awesome to just have everyone pay open source maintainers what they can afford to when they use their project, in practice relying on people's (or worse, companies') good will is a losing strategy. It seem wildly unrealistic to just expect that everyone will just naturally give back to open source in a meaningful way absent any actual incentives or requirements, and even if it did start happening there would be nothing the situation from returning to the way it was before. I think most of the arguments you'll see against the idea of "just give back to open source maintainers even though you aren't required to" aren't skeptical of the idea that people should be compensated for their work, but just skeptical that peer pressure is the only thing needed to turn the current open source model into one where all maintainers are fairly compensated.
- donw 5y ago
  You're largely correct, but I'm not speaking about peer pressure. 'Tis the season, so we've been listening to a lot of Christmas carols. One of my favorites is Good King Wenceslas, which concludes with the verse: "Therefore, Christian men, be sure, wealth or rank possessing, Ye who now will bless the poor, shall yourselves find blessing." Charity used to be a behavioral expectation in the West. Charity is not "giving money to somebody else so they can do charity on your behalf" nor is it "paying taxes to fund social programs". Charity is you, directly, investing your resources in your community, with no expectation of return. Today, this assumption no longer holds. The result is the current state of open source, which needs to figure out a license that extracts value from players big enough to pay it, without punishing upstarts into oblivion (and thus forming a protective moat for existing large players). Some percentage of net revenue share strikes me as the right sort of license, with sensible caps and/or some sort of shared pooling mechanism.