6 ms·

If you think that's bad, try figuring out where to report bugs or even find the original source code for several of the tools and libraries we all use every day

by l0b0 5y ago

If you think that's bad, try figuring out where to report bugs or even find the original source code for several of the tools and libraries we all use every day. Some of them don't seem to have a web site, only a bunch of unofficial mirrors in various states of disrepair. Some have no way to get to the source code history; only the tarballs for the releases are available. Some have no issue tracker, and, if you're extra unlucky, no mailing list. Even worse, some have buggy mailing list or issue tracker setups, where I'm unable to create a new account, the activation email never arrives, I can't figure out the password requirements, the CAPTCHA refuses to accept any of my answers, or submitting the bug just sends you to an empty/error page, having helpfully cleared the form data from your browser so you can't go back to resubmit. Oh, and some projects won't create a new release for simple bug fixes, so you won't get a fixed version through your package manager anytime soon. It's no wonder we're still finding critical issues in core projects. What's a real wonder is how someone managed to navigate the maze to trigger the process to get a change all the way through release. You'll notice how I'm not mentioning how to fix any of these problems, and that's intentional. Each project will need significant effort and/or money to get to a reasonable state, but many people who want to help will give up.

JoeAltmaier 5y ago
Nobody wants to work on those things. There's no glory. You'd have to be paid to struggle with maintenance. A fundamental issue with open source to be sure.
faizshah 5y ago
Now try doing all that but without a properly functioning search engine or good docs while navigating multiple layers of bureaucracy for a 1 line bugfix. Welcome to working at a megacorp.
hsbauauvhabzb 5y ago
You mean like putty only being served over HTTP until like 2019?
- cblconfederate 5y ago
  incidental, have you donated to putty?
  - Chris2048 5y ago
    Are you implying putty devs didn't serve over httpS b/c they couldn't afford to?
    - ori_b 5y ago
      Because they were busy with their paid job.
      - mjw1007 5y ago
        Perhaps more likely: because they were the sort of people that disliked the certificate authority cartel, and preferred to rely on a GPG signature until letsencrypt came along.
      - Chris2048 5y ago
        Then why aren't they too busy to develop putty also? I don't like the idea of security matters being payed extras. Would you make free cupcakes for people, but refuse to wash you hands while doing so unless someone paid you to? "Hey, I'm too busy with paid work to make my cupcakes hygienic; you want clean cupcakes, make your own!"
        ori_b 5y ago
        If someone made free cupcakes and didn't wash their hands, I wouldn't eat them. I wouldn't get angry that they spent their free time making cupcakes that I didn't really want. And the wonderful thing about open source is that you can take the existing code, fork it, and do things the way you think they should be done. No salary? No obligations.
        5y ago
cblconfederate 5y ago
You might want to consider how much the people who are (not) paid to maintain them make.
- l0b0 5y ago
  That's a cheap barb. First, I maintain a bunch of (small, to be fair) FOSS projects, mostly with zero payment over many years. Second, I've supported several projects with actual money. Third, if I can't reach anyone at the project, how am I supposed to support them with time or money?
  - cblconfederate 5y ago
    That's irrelevant. Just like how nobody should have expectations from you, we can't have them from anyone who donated her free time once upon a time.
    - yebyen 5y ago
      It's not irrelevant. When a community project depends on another project, it depends on it, (both factually and tautologically.) If the original maintainer evaporates, the community project needs to adapt by either moving somewhere else or forking away and adopting the project. Else the community is in a broken state, all other expectations aside! That's not to say the original author owes any debt to the community, but when pay is the only motivation you wind up with chronically broken communities optimized for rent extraction. (And I'm definitely not saying that OSS authors shouldn't be paid either...) authors can walk away from their creations, but it doesn't make the result of doing that without any concern any less important or relevant here. You're not really suggesting that OP's concerns are somehow irrelevant because code owners need to be protected from bad actors by annoying/bugged-out or broken gatekeeping robots, are you?
- 3np 5y ago
  If only they provided a way to give them money without doxxing myself. If I have to register a Paypal/Stripe account or otherwise give a third-party sensitive information, it's a no-go. There are several times when I've started the process of donating, only to abort because whatever payment processor they use blanket-403 Tor. GH Sponsors works great when you're sponsoring as a company; I can't use it as an individual. An easy way to provide this is to put up a BTC address (and potentionally ETH if the recipient is willing to deal with the potential managerial overhead of that).

by l0b0 5y ago

JoeAltmaier 5y ago

Nobody wants to work on those things. There's no glory. You'd have to be paid to struggle with maintenance. A fundamental issue with open source to be sure.

faizshah 5y ago

Now try doing all that but without a properly functioning search engine or good docs while navigating multiple layers of bureaucracy for a 1 line bugfix. Welcome to working at a megacorp.

hsbauauvhabzb 5y ago

You mean like putty only being served over HTTP until like 2019?

cblconfederate 5y ago
incidental, have you donated to putty?
- Chris2048 5y ago
  Are you implying putty devs didn't serve over httpS b/c they couldn't afford to?
  - ori_b 5y ago
    Because they were busy with their paid job.
    - mjw1007 5y ago
      Perhaps more likely: because they were the sort of people that disliked the certificate authority cartel, and preferred to rely on a GPG signature until letsencrypt came along.
    - Chris2048 5y ago
      Then why aren't they too busy to develop putty also? I don't like the idea of security matters being payed extras. Would you make free cupcakes for people, but refuse to wash you hands while doing so unless someone paid you to? "Hey, I'm too busy with paid work to make my cupcakes hygienic; you want clean cupcakes, make your own!"
      - ori_b 5y ago
        If someone made free cupcakes and didn't wash their hands, I wouldn't eat them. I wouldn't get angry that they spent their free time making cupcakes that I didn't really want. And the wonderful thing about open source is that you can take the existing code, fork it, and do things the way you think they should be done. No salary? No obligations.
        5y ago

cblconfederate 5y ago

You might want to consider how much the people who are (not) paid to maintain them make.

l0b0 5y ago
That's a cheap barb. First, I maintain a bunch of (small, to be fair) FOSS projects, mostly with zero payment over many years. Second, I've supported several projects with actual money. Third, if I can't reach anyone at the project, how am I supposed to support them with time or money?
- cblconfederate 5y ago
  That's irrelevant. Just like how nobody should have expectations from you, we can't have them from anyone who donated her free time once upon a time.
  - yebyen 5y ago
    It's not irrelevant. When a community project depends on another project, it depends on it, (both factually and tautologically.) If the original maintainer evaporates, the community project needs to adapt by either moving somewhere else or forking away and adopting the project. Else the community is in a broken state, all other expectations aside! That's not to say the original author owes any debt to the community, but when pay is the only motivation you wind up with chronically broken communities optimized for rent extraction. (And I'm definitely not saying that OSS authors shouldn't be paid either...) authors can walk away from their creations, but it doesn't make the result of doing that without any concern any less important or relevant here. You're not really suggesting that OP's concerns are somehow irrelevant because code owners need to be protected from bad actors by annoying/bugged-out or broken gatekeeping robots, are you?
3np 5y ago
If only they provided a way to give them money without doxxing myself. If I have to register a Paypal/Stripe account or otherwise give a third-party sensitive information, it's a no-go. There are several times when I've started the process of donating, only to abort because whatever payment processor they use blanket-403 Tor. GH Sponsors works great when you're sponsoring as a company; I can't use it as an individual. An easy way to provide this is to put up a BTC address (and potentionally ETH if the recipient is willing to deal with the potential managerial overhead of that).