2 ms·

These are two separate things, and it's perilous to conflate them. The OSS developer is providing software that anyone can use under whatever license terms for

These are two separate things, and it's perilous to conflate them. The OSS developer is providing software that anyone can use under whatever license terms for free. How they monetize this is entirely their responsibility. Choosing a permissive license makes them generally indistinguishable from the developers who don't want to monetize their work at all. Solving the "how do we ensure they get paid?" problem is nontrivial, but certainly out of scope for this discussion. The verification service is provided by a company to protect their customers from malicious changes to said OSS software. (Yes, even if they were deliberate changes by the original developer!) In some sense, you could try to frame the verification services as somehow predatory, but that's like saying that safety inspectors are predatory to independent carpenters. (I'm not happy with that last analogy, but it's the best I could come up with on the spot. Real-world analogies to software problems are always messy, so feel free to suggest a better one if you think of any.)

deanc 5y ago
I'm afraid we'll have to agree to disagree on this one Scott, on a philosophical level. We have companies like pullrequest.com monetizing code quality (currently only private but I presume they'll enter the OSS market at some point), and then other companies who are monetizing security audits. None of this money trickles down to the distributed teams of developers writing the software in the first place. This makes me uncomfortable - and you are right we do have to find ways to help with this.
- CiPHPerCoder 5y ago
  I think I understand why it makes you uncomfortable. I do think they're two separate problems, and must be solved independently. Left unsolved, what you're experiencing is mostly bad optics rather than a dependent nastiness. It's a bad look, and it leaves a bad taste in one's mouth. That being said, we both agree it's worth solving. However, I'm not an economist, by any measure, so I don't have any insight into what a solution looks like.

deanc 5y ago

I'm afraid we'll have to agree to disagree on this one Scott, on a philosophical level. We have companies like pullrequest.com monetizing code quality (currently only private but I presume they'll enter the OSS market at some point), and then other companies who are monetizing security audits. None of this money trickles down to the distributed teams of developers writing the software in the first place. This makes me uncomfortable - and you are right we do have to find ways to help with this.

CiPHPerCoder 5y ago
I think I understand why it makes you uncomfortable. I do think they're two separate problems, and must be solved independently. Left unsolved, what you're experiencing is mostly bad optics rather than a dependent nastiness. It's a bad look, and it leaves a bad taste in one's mouth. That being said, we both agree it's worth solving. However, I'm not an economist, by any measure, so I don't have any insight into what a solution looks like.