4 ms·
You can’t control others emotions. But setting healthy expectations goes a long way. One of my takeaways from the log4j issue is that the log4j devs should hav
by josephg 5y ago
You can’t control others emotions. But setting healthy expectations goes a long way.
One of my takeaways from the log4j issue is that the log4j devs should have never accepted the patches to add LDAP urls in the first place. Or perhaps, they should have removed that feature when it became burdensome. I would have. There’s a pressure to accept whatever patches come your way as an opensource developer, but actually, you’re under no obligation to do any such thing. Open source also means the source is available - so people are free to take your code, mix in their patches and maintain it themselves. And if they can’t be bothered doing that, why should I shoulder that burden?
I think us opensource devs should get more comfortable saying no. “I hear that this feature is important to you but it doesn’t solve a problem I (or anyone else I know) cares about. Please maintain those patches in your own fork.”
- nradov 5y agoAnother alternative is to build a stable plug-in API rather than handling such requests in the core product. That way users with particular needs can code their own plug-ins rather than forking the entire code base. Now obviously open source maintainers have no obligation to do that, but purely from an engineering perspective it's an approach worth considering.
- pjc50 5y agoYou then hit the two problems that everyone with a plugin API hits: - you can't rearchitecture your software beyond a certain amount without breaking the plugin API - if a plugin crashes, people will blame the host, no matter how you attempt to deflect this
- GoblinSlayer 5y agoThat's what log4net does, and presumably log4j has a plugin api too.
- xxpor 5y agoThey didn't add ldap support explicitly though, AFAICT. They added JNDI support, using a fairly small patch the guy who filed the request wrote for them. JNDI is a standard Java thing, so I'd guess they didn't think too deeply about all of the things it could do (not criticizing them, I'd probably have done the same thing).
- raxxorrax 5y agoReminds me of Signal and Apple M1 support issue. People expect you to accept the PR. As if that wouldn't mean more work for the maintainer in any case.