3 ms·
Most companies are just free-riding because they can and because it makes financial sense, at least superficially. I don't see why this would change. Sometimes
by hiq 5y ago
Most companies are just free-riding because they can and because it makes financial sense, at least superficially. I don't see why this would change. Sometimes they get hit by the occasional security vulnerability in a badly supported dependency, but if it's commonly used in the industry the fallout will be negligible anyway, so why would they reevaluate their stance?
Companies that heavily rely on one specific FOSS project and have well-defined requests naturally get more invested in them one way or another. But even for these, which tend to be bigger tech companies with more cash, "just pay the maintainer" is a tough sell when they can just either come up with their own project (even FOSS and recoup the "losses" in proprietary IP with hiring marketing) or fork it if PRs from employees are not well-received by the maintainer.
- pengaru 5y ago> "just pay the maintainer" is a tough sell when they can just either come up with their own project (even FOSS and recoup the "losses" in proprietary IP with hiring marketing) or fork it if PRs from employees are not well-received by the maintainer. Also "just pay the maintainer" doesn't contribute towards most managers' primary goal of empire-building. In my experience even getting individual contractors paid for work can be a tough sell, managers want headcount and the opportunity to abuse their minions. A "maintainer" receiving funds somewhere on the internet to play in their sandbox just looks like enabling escape from management's prison.
- wmf 5y agoMaybe liability would encourage some changes. If you pay the maintainer they are liable for security vulnerabilities but if you don't pay then you are liable.
- deleted 5y ago[deleted]