5 ms·

Very well written. This feels like the log4j conversation all over again. Cray/HPE knows what the problem is, and they know the developers aren't being paid to

Very well written. This feels like the log4j conversation all over again. Cray/HPE knows what the problem is, and they know the developers aren't being paid to fix the bug, the customer is hounding them, not the original developers. This is their problem to solve, they don't get to pretend that it's someone else's fault that they're too cheap to shell out the money for proper maintenance. If this was a bug in Cray/HPE's own internal software, they would pay a developer to fix it. It's wild as a company to assume that because you're using someone else's stuff for free, your responsibility for maintenance is now their problem as well. > Hi Bill, per our operational security procedure we can't talk about ieee_arithmetic, especially when we dont get paid. Good on the developers for saying this. You support people, or you don't get to tell them what to do. And if you're a commercial company taking on a contract that involves nuclear weapons, maybe you devote some resources to making that contract and the software running well, because that's what the client is paying you to do. So sick and tired of the backwards mentality that giving something away to the world for free means that you now have an additional obligation to fix everyone else's problems for free. The "as is" clauses in Open Source licenses are there for a reason.

toss1 5y ago
Yup, and there's nothing saying Cray, or [customer w/nuclear weapons], or anyone else is required to use that OS package. Perhaps they would have been better off writing their own in this instance. Or, better yet, they could write a fix and add it to the OS package (kind of the way it's supposed to work - the set of users maintain it so everyone benefits?).
908B64B197 5y ago
> So sick and tired of the backwards mentality that giving something away to the world for free means that you now have an additional obligation to fix everyone else's problems for free. The "as is" clauses in Open Source licenses are there for a reason. That's one of the differences between coders and engineers. Coders just import libraries to avoid re-inventing the wheel. Engineers consider each import as a dependency they'll have to maintain, buy support for or replace. Log4j just highlighted this difference, with some knowing exactly what to patch and others franctically trying to determine if one of the thousands of dependencies they imported into their app actually used it.
- eyelidlessness 5y ago
  But, and I’m not disagreeing with you, that puts the impetus squarely on the user of this library. Not on the creators/maintainers.

toss1 5y ago

Yup, and there's nothing saying Cray, or [customer w/nuclear weapons], or anyone else is required to use that OS package. Perhaps they would have been better off writing their own in this instance. Or, better yet, they could write a fix and add it to the OS package (kind of the way it's supposed to work - the set of users maintain it so everyone benefits?).

908B64B197 5y ago

> So sick and tired of the backwards mentality that giving something away to the world for free means that you now have an additional obligation to fix everyone else's problems for free. The "as is" clauses in Open Source licenses are there for a reason. That's one of the differences between coders and engineers. Coders just import libraries to avoid re-inventing the wheel. Engineers consider each import as a dependency they'll have to maintain, buy support for or replace. Log4j just highlighted this difference, with some knowing exactly what to patch and others franctically trying to determine if one of the thousands of dependencies they imported into their app actually used it.

eyelidlessness 5y ago
But, and I’m not disagreeing with you, that puts the impetus squarely on the user of this library. Not on the creators/maintainers.