7 ms·

> We need the critical role of Open Source maintainer to professionalize. Do we? I do open source work and maintainership, and am happy that this is outside th

by hpcoke 5y ago

> We need the critical role of Open Source maintainer to professionalize. Do we? I do open source work and maintainership, and am happy that this is outside the control and influence of industry. Must even this that "makes the Internet special" also bow to industry needs?

FiloSottile 5y ago
The alternative is not the status quo. Look at all the talk of supply chain security from the big players. The alternative is that all power and profit is just moved to large institutional middlemen or directly to a few big companies who can afford such a program. If you don't care about control over the downstream of your project, or funding, no one is forcing you to professionalize! I just want that to be available as an option to those who do.
- jka 5y ago
  I worry that if the majority of open source contributors professionalize, then we're left with something that resembles top-down directed corporate work (and an absence of a lot of the freedom that draws people towards developing free and open source software in the first place). Proprietary and corporate players are equally useless at securing their supply chains; I don't love that (from my perspective) they're now blaming and trying to coerce open source to become more like them to ostensibly fix the same problems they propagate themselves. I'm not a security nihilist: I think improvement is possible. But in my experience, not many corporate managers or project sponsors ask for removal of features and reduction of attack surface.
  - jka 5y ago
    Anticipating a counter-argument: wouldn't individuals become the arbiters of the software functionality that is developed, if all open source software was based on a sponsor model? Isn't that more democratic? Perhaps; some financial statistics that I'd suggest to consider would be: - As of June 2018, U.S. households in the 0-40% income-level group had $0 median savings[1] - From the same source: the median savings for a household in the U.S. is approximately $11k. There are approximately 120m households in the U.S. according to the U.S. Government census[2]. - As of 2022, thirteen firms from within the S&P 500 hold a combined $1 trillion in cash-on-reserve[3] And yep, it'd be sensible to debate whether individuals or companies would be more likely to influence the direction of software; it's a disingenuous comparison to draw in that regard. But even if we consider only individual citizens, there would still be significant disenfranchisement in dollar-voting ability. [1] - https://www.cnbc.com/2018/09/27/heres-how-much-money-americans-have-in-savings-at-every-income-level.html https://www.cnbc.com/2018/09/27/heres-how-much-money-america... [2] - https://www.census.gov/quickfacts/fact/table/US/HSD410219 https://www.census.gov/quickfacts/fact/table/US/HSD410219 [3] - https://www.investors.com/etfs-and-funds/sectors/sp500-companies-stockpile-1-trillion-cash-investors-want-it/ https://www.investors.com/etfs-and-funds/sectors/sp500-compa...
raverbashing 5y ago
Well, you tell us, based on your experience. Do you like working for free? Do you like people making unreasonable demands? How would you like spending the weekend like the log4j people trying to solve a Prio 0 bug?
- marginalia_nu 5y ago
  The thing is, if you aren't getting paid, people can demand all they want. Scream until their faces turn blue, stomp their feet, bawl like a baby, write mean things on twitter, stick a voodoo doll full of needles. It's entirely your prerogative to say no.
  - CannisterFlux 5y ago
    It isn't nice though, as the maintainer. I gave up on doing any kind of open source stuff probably a decade ago for way less than screaming. Just getting bug reports is depressing, it was a relief to walk away and never have to think about it again. I know I didn't owe people anything, but hearing that I'd written buggy incomplete code (which worked and was good enough for me) sucked the joy out of it all.
    - thrashh 5y ago
      Idk I used to run some big projects and I just told people straight up that I’d love to add or fix that but that I don’t have time Some people still idolized the hell out of me
    - pkolaczk 5y ago
      For me, getting bug reports and feature requests is actually fun and makes the project more interesting. It is telling me that someone uses my software seriously and the bug was worth reporting. Many people don't report bugs because it takes some effort.
      - CannisterFlux 5y ago
        It can be, yeah, it just ground me down in the end. Deciding to stop was a huge weight off, I can only imagine the stress someone running a big successful project must feel.
CJefferson 5y ago
I think it's fine when you are doing open source for fun, and for other individual users. If a company is basing their livelihood on your library, they should (in my opinion) be supporting it somehow -- either by paying you, or paying someone to keep an eye on new versions. The other choice is they are trusting you to fix bugs and not be malicious, which isn't (in my opinion) reasonable, as you get nothing in return.
- jckahn 5y ago
  Nobody has any right to expect labor from an unpaid person. I get feature requests from people who make money with my OSS work (which I don’t begrudge), but unless I find the work inherently interesting to prioritize then I respectfully ask them to compensate me, make a PR, or file a GitHub feature request so that someone else can. I fix legitimate bug reports for free ASAP because I care about the quality of my work. Nobody has ever offered my compensation, despite the fact that my work has been used by millions of people. That’s fine with me though, OSS is just a hobby for me. :) Anyone can choose this strategy, and I don’t quite understand why more OSS maintainers don’t.
  - tarsinge 5y ago
    > Nobody has any right to expect labor from an unpaid person. I'm very grateful for OSS projects and maintainers but this is an interesting question: is doing something for free a free pass for false promises (advertising)? If I commit to help someone for free I then have a responsibility to show up. If an OSS developer advertise their projects as production ready then they have a responsibility to honor what is promised. Otherwise it should be stated plainly that the project should not be used in production ("This is a hobby project, use it at your own risks"). Sure it's less attractive and can be incompatible with success and resume building, but it's not possible to have it both way.
    - jleahy 5y ago
      This is why we have licenses: … PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE I think it’s particularly clear, and that part is even in all capitals.
rjzzleep 5y ago
In my opinion Filo is completely off base. It's the Americanization of Open Source. Notice some of the OSS conferences in the US are big sponsored events by O'reilly, to some extent big recruiting events. Contrast that to FOSDEM, which is completely different. This isn't just an offspring of early hacker culture. This is as offspring of how "socialist" european university systems were. A lot of bigger OSS projects were started during peoples university time and what's so fundamentally different between how universities in Europe were before? You didn't have care about graduating. Some people stayed in University for 10 years, it was free and sometimes even had some benefits, like cheaper healthcare. Now studying forever subsidized isn't always a good thing, but it has some nice side effects, like being able to work on your side project without having to worry about your livelihood(something that is unthinkable in the US). The European higher ed systems has gotten more and more close to the US system with the Bologna process[1]. Most Americans immediately think about how to monetize things, and don't get me wrong, being able to live off of your open source project is nice, but it wasn't the focus in the past. [1] https://en.wikipedia.org/wiki/Bologna_Process https://en.wikipedia.org/wiki/Bologna_Process
- raverbashing 5y ago
  This is an interesting aspect, and some good projects do come from Europe But open source projects still need a roadmap, focus and maintenance, regardless of how they are funded.
  - phoronixrly 5y ago
    Whether a project needs those things is up to its author(s) to decide. If you don't agree with them you're welcome to fork.
    - raverbashing 5y ago
      If you want a real project then you need those If you just want to share code, that's fine as well, but that's not an OSS project (sure, it can be an open source "project" - but not a project that grows)

by hpcoke 5y ago

FiloSottile 5y ago

The alternative is not the status quo. Look at all the talk of supply chain security from the big players. The alternative is that all power and profit is just moved to large institutional middlemen or directly to a few big companies who can afford such a program. If you don't care about control over the downstream of your project, or funding, no one is forcing you to professionalize! I just want that to be available as an option to those who do.

jka 5y ago
I worry that if the majority of open source contributors professionalize, then we're left with something that resembles top-down directed corporate work (and an absence of a lot of the freedom that draws people towards developing free and open source software in the first place). Proprietary and corporate players are equally useless at securing their supply chains; I don't love that (from my perspective) they're now blaming and trying to coerce open source to become more like them to ostensibly fix the same problems they propagate themselves. I'm not a security nihilist: I think improvement is possible. But in my experience, not many corporate managers or project sponsors ask for removal of features and reduction of attack surface.
- jka 5y ago
  Anticipating a counter-argument: wouldn't individuals become the arbiters of the software functionality that is developed, if all open source software was based on a sponsor model? Isn't that more democratic? Perhaps; some financial statistics that I'd suggest to consider would be: - As of June 2018, U.S. households in the 0-40% income-level group had $0 median savings[1] - From the same source: the median savings for a household in the U.S. is approximately $11k. There are approximately 120m households in the U.S. according to the U.S. Government census[2]. - As of 2022, thirteen firms from within the S&P 500 hold a combined $1 trillion in cash-on-reserve[3] And yep, it'd be sensible to debate whether individuals or companies would be more likely to influence the direction of software; it's a disingenuous comparison to draw in that regard. But even if we consider only individual citizens, there would still be significant disenfranchisement in dollar-voting ability. [1] - https://www.cnbc.com/2018/09/27/heres-how-much-money-americans-have-in-savings-at-every-income-level.html https://www.cnbc.com/2018/09/27/heres-how-much-money-america... [2] - https://www.census.gov/quickfacts/fact/table/US/HSD410219 https://www.census.gov/quickfacts/fact/table/US/HSD410219 [3] - https://www.investors.com/etfs-and-funds/sectors/sp500-companies-stockpile-1-trillion-cash-investors-want-it/ https://www.investors.com/etfs-and-funds/sectors/sp500-compa...

raverbashing 5y ago

Well, you tell us, based on your experience. Do you like working for free? Do you like people making unreasonable demands? How would you like spending the weekend like the log4j people trying to solve a Prio 0 bug?

marginalia_nu 5y ago
The thing is, if you aren't getting paid, people can demand all they want. Scream until their faces turn blue, stomp their feet, bawl like a baby, write mean things on twitter, stick a voodoo doll full of needles. It's entirely your prerogative to say no.
- CannisterFlux 5y ago
  It isn't nice though, as the maintainer. I gave up on doing any kind of open source stuff probably a decade ago for way less than screaming. Just getting bug reports is depressing, it was a relief to walk away and never have to think about it again. I know I didn't owe people anything, but hearing that I'd written buggy incomplete code (which worked and was good enough for me) sucked the joy out of it all.
  - thrashh 5y ago
    Idk I used to run some big projects and I just told people straight up that I’d love to add or fix that but that I don’t have time Some people still idolized the hell out of me
  - pkolaczk 5y ago
    For me, getting bug reports and feature requests is actually fun and makes the project more interesting. It is telling me that someone uses my software seriously and the bug was worth reporting. Many people don't report bugs because it takes some effort.
    - CannisterFlux 5y ago
      It can be, yeah, it just ground me down in the end. Deciding to stop was a huge weight off, I can only imagine the stress someone running a big successful project must feel.

CJefferson 5y ago

I think it's fine when you are doing open source for fun, and for other individual users. If a company is basing their livelihood on your library, they should (in my opinion) be supporting it somehow -- either by paying you, or paying someone to keep an eye on new versions. The other choice is they are trusting you to fix bugs and not be malicious, which isn't (in my opinion) reasonable, as you get nothing in return.

jckahn 5y ago
Nobody has any right to expect labor from an unpaid person. I get feature requests from people who make money with my OSS work (which I don’t begrudge), but unless I find the work inherently interesting to prioritize then I respectfully ask them to compensate me, make a PR, or file a GitHub feature request so that someone else can. I fix legitimate bug reports for free ASAP because I care about the quality of my work. Nobody has ever offered my compensation, despite the fact that my work has been used by millions of people. That’s fine with me though, OSS is just a hobby for me. :) Anyone can choose this strategy, and I don’t quite understand why more OSS maintainers don’t.
- tarsinge 5y ago
  > Nobody has any right to expect labor from an unpaid person. I'm very grateful for OSS projects and maintainers but this is an interesting question: is doing something for free a free pass for false promises (advertising)? If I commit to help someone for free I then have a responsibility to show up. If an OSS developer advertise their projects as production ready then they have a responsibility to honor what is promised. Otherwise it should be stated plainly that the project should not be used in production ("This is a hobby project, use it at your own risks"). Sure it's less attractive and can be incompatible with success and resume building, but it's not possible to have it both way.
  - jleahy 5y ago
    This is why we have licenses: … PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE I think it’s particularly clear, and that part is even in all capitals.

rjzzleep 5y ago

In my opinion Filo is completely off base. It's the Americanization of Open Source. Notice some of the OSS conferences in the US are big sponsored events by O'reilly, to some extent big recruiting events. Contrast that to FOSDEM, which is completely different. This isn't just an offspring of early hacker culture. This is as offspring of how "socialist" european university systems were. A lot of bigger OSS projects were started during peoples university time and what's so fundamentally different between how universities in Europe were before? You didn't have care about graduating. Some people stayed in University for 10 years, it was free and sometimes even had some benefits, like cheaper healthcare. Now studying forever subsidized isn't always a good thing, but it has some nice side effects, like being able to work on your side project without having to worry about your livelihood(something that is unthinkable in the US). The European higher ed systems has gotten more and more close to the US system with the Bologna process[1]. Most Americans immediately think about how to monetize things, and don't get me wrong, being able to live off of your open source project is nice, but it wasn't the focus in the past. [1] https://en.wikipedia.org/wiki/Bologna_Process https://en.wikipedia.org/wiki/Bologna_Process

raverbashing 5y ago
This is an interesting aspect, and some good projects do come from Europe But open source projects still need a roadmap, focus and maintenance, regardless of how they are funded.
- phoronixrly 5y ago
  Whether a project needs those things is up to its author(s) to decide. If you don't agree with them you're welcome to fork.
  - raverbashing 5y ago
    If you want a real project then you need those If you just want to share code, that's fine as well, but that's not an OSS project (sure, it can be an open source "project" - but not a project that grows)