5 ms·

That leaves a strange taste in my mouth. I love writing open source for both me and other devs to use it and make their lives easier; I understand that big comp

That leaves a strange taste in my mouth. I love writing open source for both me and other devs to use it and make their lives easier; I understand that big companies will also use it since that's one of the places where devs work, and since I make mostly tools or meta-tools ("dev solutions" and not "business solutions") I'm happy with this arrangement. When I do a more business-like solution, I tend not to publish it as open source and remain on my list of trying-to-monetize side projects. But if you quantify it like this, "this company saved 8 billion dollars out of some extra work on your side, here is a pat in the back because they'd never even consider give back a single cent or helping in any way" it feels a bit strange. I know it's on me, and I just learned this contradictory feeling so need to unravel/understand it, but you def got the opposite feeling from me as expected. Edit: you added the "I know it sounds a bit disingenuous to say this is just for the shareholders of random corporations." later, right? Which kinda reflects a bit of this feeling

jrockway 4y ago
With no data, I'm assuming this is all business-driven. Nobody is compromising software supply chains to make your 3D printer print 8% slower for the lulz. They're doing it to hack companies and compromise user data. If open source was just hobbyists making stuff for hobbyists, it might not even require a login to update a package. With companies involved, they to reduce this risk, and this comes at the cost of people not involved with the company's business. I can see why authors get annoyed; they are being required to change their workflow for a use case that doesn't interest them. Being asked to do boring work for free is not a great solution to anything. Personally, I don't have a horse in this game. I always use 2FA when it's available. I have already made the necessary adjustments in my workflow. But I get why people are annoyed that they have to change something. Imagine that this was "we'll send you a check for $1000 if you enable 2FA on your account". Bet there would have been zero angry blog posts.
- deleted 4y ago
  [deleted]
- tsimionescu 4y ago
  > Imagine that this was "we'll send you a check for $1000 if you enable 2FA on your account". Bet there would have been zero angry blog posts. That is just entitlement on the part of some open source devs. PyPI is already providing a huge service for them: it is publishing their package free of charge. Furthermore, it is maintaining old versions, scanning others for vulnerabilities, replicating across the world, resolving dependencies etc. They have every right to ask anyone who is enjoying their completely free service to put in the minute amount of extra work required to set up 2FA. Of course, anyone is also free but to want to put in that work, and so they can stop delivering their package on PyPI. Absolutely your right as an open source maintainer, and you have no one to answer to if that breaks some builds.
- giaour 4y ago
  > Nobody is compromising software supply chains to make your 3D printer print 8% slower for the lulz. They're doing it to hack companies and compromise user data. The high-profile NPM package compromises in recent years have mostly targeted hobbyists/been indifferent to who they were targeting. Crypto miner malware doesn't care what computer it's installed on.
- tveita 4y ago
  > With no data, I'm assuming this is all business-driven. Nobody is compromising software supply chains to make your 3D printer print 8% slower for the lulz. As far as I know common targets for malicious packages are crypto (mining, wallet swiping), and credentials (SSH, package repositories), none of which is limited to businesses. There's been some cases of politically motivated sabotage lately but mostly from the maintainer themselves so far - expect more of that though. Often a compromised package will try to steal more credentials from downstream users. [1] I don't doubt that threat actors all the way from script kiddies to nation states are keeping a stash of credentials to package repositories, and it's going to suck for everyone when they decide to use them. [1] https://www.bleepingcomputer.com/news/security/compromised-javascript-package-caught-stealing-npm-credentials/ https://www.bleepingcomputer.com/news/security/compromised-j...
3pt14159 4y ago
Right, so this is why I keep harking on the fact that we need a non-billionaires OS license. People will say "oh, no, that's not real open source" but it sure is as open as their chequebook. I'm hand waving a bit here, but if you have a stakeholder that's worth a billion dollars you can pay a $1m per year for the OSS library you use. When I write open source software I'm not doing it for Bezos. I'm doing it for Heather down the street who is trying to get a cool little project off the ground and maybe pay some bills. I'm even writing it for Frank who runs a modest 20 person dev shop and maybe contributes back a bit here or there where they find the warts. I'm not building it for the psychos that have lost all touch with humanity.
- jrockway 4y ago
  That makes a lot of sense to me. I don't know if I do open source even for Heather down the street, I mostly do it for myself. "I made a thing, come look." "Come look" is not really an invitation for "we looked and we took it and can you do all these things for me for free". It's really a tradeoff between ego/reputation and time. It's possible that people can ask you for more of your time than you get returned in reputation. (Ask any artist who has made something "for the exposure." People will do it! But they'd rather be getting paid.)
  - MonkeyMalarky 4y ago
    Art is a great analogy here because you don't get to have a say in the process when an artist is doing it for themselves. You can look and critique, but you don't get to have control. If you want that, you're welcome to commission a piece and pay for it.
  - franciscop 4y ago
    I just consider future me as just another developer, and it's way too often that I've had to read my own docs to see how I was supposed to do something and thanked past me. I do have a preference of who uses my software, but in no way encode it since I believe it's just no realistic: future me > other OSS devs > indie devs > general devs > small companies > large companies.

jrockway 4y ago

With no data, I'm assuming this is all business-driven. Nobody is compromising software supply chains to make your 3D printer print 8% slower for the lulz. They're doing it to hack companies and compromise user data. If open source was just hobbyists making stuff for hobbyists, it might not even require a login to update a package. With companies involved, they to reduce this risk, and this comes at the cost of people not involved with the company's business. I can see why authors get annoyed; they are being required to change their workflow for a use case that doesn't interest them. Being asked to do boring work for free is not a great solution to anything. Personally, I don't have a horse in this game. I always use 2FA when it's available. I have already made the necessary adjustments in my workflow. But I get why people are annoyed that they have to change something. Imagine that this was "we'll send you a check for $1000 if you enable 2FA on your account". Bet there would have been zero angry blog posts.

deleted 4y ago
[deleted]
tsimionescu 4y ago
> Imagine that this was "we'll send you a check for $1000 if you enable 2FA on your account". Bet there would have been zero angry blog posts. That is just entitlement on the part of some open source devs. PyPI is already providing a huge service for them: it is publishing their package free of charge. Furthermore, it is maintaining old versions, scanning others for vulnerabilities, replicating across the world, resolving dependencies etc. They have every right to ask anyone who is enjoying their completely free service to put in the minute amount of extra work required to set up 2FA. Of course, anyone is also free but to want to put in that work, and so they can stop delivering their package on PyPI. Absolutely your right as an open source maintainer, and you have no one to answer to if that breaks some builds.
giaour 4y ago
> Nobody is compromising software supply chains to make your 3D printer print 8% slower for the lulz. They're doing it to hack companies and compromise user data. The high-profile NPM package compromises in recent years have mostly targeted hobbyists/been indifferent to who they were targeting. Crypto miner malware doesn't care what computer it's installed on.
tveita 4y ago
> With no data, I'm assuming this is all business-driven. Nobody is compromising software supply chains to make your 3D printer print 8% slower for the lulz. As far as I know common targets for malicious packages are crypto (mining, wallet swiping), and credentials (SSH, package repositories), none of which is limited to businesses. There's been some cases of politically motivated sabotage lately but mostly from the maintainer themselves so far - expect more of that though. Often a compromised package will try to steal more credentials from downstream users. [1] I don't doubt that threat actors all the way from script kiddies to nation states are keeping a stash of credentials to package repositories, and it's going to suck for everyone when they decide to use them. [1] https://www.bleepingcomputer.com/news/security/compromised-javascript-package-caught-stealing-npm-credentials/ https://www.bleepingcomputer.com/news/security/compromised-j...

3pt14159 4y ago

Right, so this is why I keep harking on the fact that we need a non-billionaires OS license. People will say "oh, no, that's not real open source" but it sure is as open as their chequebook. I'm hand waving a bit here, but if you have a stakeholder that's worth a billion dollars you can pay a $1m per year for the OSS library you use. When I write open source software I'm not doing it for Bezos. I'm doing it for Heather down the street who is trying to get a cool little project off the ground and maybe pay some bills. I'm even writing it for Frank who runs a modest 20 person dev shop and maybe contributes back a bit here or there where they find the warts. I'm not building it for the psychos that have lost all touch with humanity.

jrockway 4y ago
That makes a lot of sense to me. I don't know if I do open source even for Heather down the street, I mostly do it for myself. "I made a thing, come look." "Come look" is not really an invitation for "we looked and we took it and can you do all these things for me for free". It's really a tradeoff between ego/reputation and time. It's possible that people can ask you for more of your time than you get returned in reputation. (Ask any artist who has made something "for the exposure." People will do it! But they'd rather be getting paid.)
- MonkeyMalarky 4y ago
  Art is a great analogy here because you don't get to have a say in the process when an artist is doing it for themselves. You can look and critique, but you don't get to have control. If you want that, you're welcome to commission a piece and pay for it.
- franciscop 4y ago
  I just consider future me as just another developer, and it's way too often that I've had to read my own docs to see how I was supposed to do something and thanked past me. I do have a preference of who uses my software, but in no way encode it since I believe it's just no realistic: future me > other OSS devs > indie devs > general devs > small companies > large companies.