7 ms·

Incidents caused by unappreciated OSS maintainers or underfunded OSS projects

154 points by pabs3 4y ago

Kukumber 4y ago
our model of society is not compatible with open source there needs to be a massive shift and appreciate more the work of volunteers, contributors and benevolent until then, these problems will amplify and i'm not talking about github sponsors since it's opt in, and it's more of a popularity check than anything else i'm talking about that dude who will randomly appear to send a PR that fixes something important, the dude who decide overnight to open source his work but is agoraphobic, that other dude who help write documentation, that other dude who help triage issues, countless hidden people who never are rewarded
- uri4 4y ago
  - deleted 4y ago
    [deleted]
  - Shared404 4y ago
    Phone keyboard, or trying to avoid auto filtering? In addition, why not come say this with your main account?
- the_gipsy 4y ago
  If it's not compatible, then how come it thrives so well? We can improve it, sure, but let's ask why it works to begin with, and then improve on that. I don't think money is an issue.
  - eqvinox 4y ago
    > If it's not compatible, then how come it thrives so well? Careful — some societies a while back "thrived" by relying on slavery. OSS is not slavery, but drawing conclusions just from apparent thriving is dangerous. (Other analogies: recent bubble collapses from the housing market & dotcom before that — those seemed to "thrive" too, before the bubble collapsed.) > […] let's ask why it works to begin with, […] One thing I'd throw on that list is people trying to build a name and reputation hoping to get hired in the future. This includes bright youths fresh out of high school, but also PhD students whose thesis delivery is turning into a dreading life change. They're running on borrowed time, and if it doesn't work out it's both them and their projects that are screwed.
    - the_gipsy 4y ago
      > slavery Have you thought that maybe (a lot of) people make OSS for the fun of it?
  - smoldesu 4y ago
    It's got a weird bit of nuance to it. I think Open Source does well because it's economically infeasible for it to fail. The cost of hosting source code is next to nothing, and the idea of writing a shared library/tool gives it long-term appeal. The problem boils down to human nature, and the greed/ambition/entitlement we feel isn't balanced with a proper respect for our surroundings. If you train people to be entrepreneurs, they'll nickle-and-dime every free software product they find. There's not really a problem with FOSS software, as I see it. It's okay to disagree with it's principles (or even for the purposes of a single project), but the concepts of public licensing are completely moral and just. If we frame this as a money problem, corporate FOSS benefactors will build us a money pit. That's not what Free Software (capital F) needs.
  - Kukumber 4y ago
    > If it's not compatible, then how come it thrives so well? Construction industry in Quatar thrives so well, specially thanks to the construction of their brand new football stadiums for the world cup Manufacturing industry thrives to well in Asia, specially thanks to their ability to mass produce cheap Nike shoes Do you endorse kids labor and slavery, is it compatible? And i never mentioned "money", it's funny that you thought about it yourself I can understand that it is hard to seek VC funding if you have to split the money with the real contributors, and not just that idea dude
- indymike 4y ago
  > our model of society is not compatible with open source I’d say evidence is to the contrary. This message wouldn’t be possible without open source working on multiple devices at every layer of the network. I think the problem of funding open source well, that is a different problem and has a lot of the same problems getting anything funded does. Not every piece of code can have an enterprise built around it, and that means there will be no one to even look at bugs. Finally, let’s talk about volunteering. Most often volunteering is doing something that doesn’t get cash budgeted towards it. You go in doing something necessary but unbudgeted because you want to… and with no reward other than knowing you made something work. Maybe you even give up something you could be doing with time instead of volunteering. Manning the directions kiosk at the hospital, picking up garbage in a neighborhood, nailing the roof onto a house the owner can’t afford to buy, putting letters in envelopes, and answering the phone at a fundraiser are all examples of this. You know what you are getting in to and you know what you are getting paid. No injustice in it at all. And for a lot of people it’s the most important thing they do.
acta_non_verba 4y ago
One of the unspoken benefits of paying OSS projects is that you then attract the money motivated rather than the ideologically or politically movement. That has value in and of itself.
- kilovoltaire 4y ago
  "money motivated" doesn't necessarily lead in the best direction
didgetmaster 4y ago
I have a project that I have thought about open sourcing. When I hear horror stories about demanding 'customers' who don't pay you anything but somehow expect you to drop everything and address their immediate concern (feature, bug, documentation, etc.), that gives me pause. I wonder how many other projects have also been kept out of the OSS realm for the same reasons.
- buro9 4y ago
  If you choose a license like AGPL then this will exclude most corps who will not pay for open source from using it, which turns out to have a large overlap with the corps that expect you to drop everything and address their immediate concern. It keeps the project within OSS more, or those who are willing to invest in OSS (because if they do anything more than just use the library / application then they now have a burden to publish changes and be visible so they're forced to invest something from their side). Recently this has been my thought... that my future projects should be AGPL from day one. To the existing ones, especially the successful one... if it does get too much for me, I shall relicense.
  - protomikron 4y ago
    Yes, I think so too. > Recently this has been my thought... that my future projects should be AGPL from day one. If that means that companies can't use it, because that would mean, if they use it they would be required to open-source their managed SaaS solution ... that's a feature?
    - buro9 4y ago
      Where I think it's a feature is that instead of them taking from open source and expecting to be able to do that without having to do anything from their side (except demand fixes / updates / features)... AGPL forces them to invest some time and money into sharing any changes they've made and contributing back. It prevents corps running their own version without sharing those changes back, and it forces corps to think carefully about whether they are willing to invest (their time and effort) in the OSS projects that they consume. I doubt it would mean that they have to OSS their SaaS offerings. Most likely things are all implemented as little services and the boundary of what they'd have to OSS at most is one of those. More it forces them to be a better and more mindful consumer of OSS.
nlrtalk 4y ago
That is a problem. On the other hand I know more incidents caused by overfunded corporate OSS developers who have taken over projects and justify their existence by manically rewriting the code base for no reason. Many of these incidents are covered up. Contradicting the corporate politicians is dangerous, because often they have installed dozens of other developers who always agree with them and are ready to libel dissenters. OSS funding is a hard problem. OSS was best when it wasn't funded at all.
- ricardobeat 4y ago
  Your post is controversial, but hard agree on that last sentence. The environment changed completely in the past decade after the lines were blurred, and not in a good way.
- cratermoon 4y ago
  > Many of these incidents are covered up Extraordinary claims require extraordinary evidence. This vaguely conspiratorial comment about things "they" have done is a problem.
- b112 4y ago
  [flagged]
  - scrollaway 4y ago
    I flagged your post because at this point, talking about systemd is just flamebait. You have an opinion about what an init system "should" be. Systemd developers have another. If you don't want systemd, don't use it. What's that, you can't "not" use it because your distribution decided to use it? There's a good reason they did. If you think you know better, use one that doesn't, or do your own distro… Systemd is also a poor example of an "overfunded" project. Some of its developers are paid, but it's not funded "as a project", it's just maintained by a company. Want an overfunded open source project? Look at React. And yet, look at how incredibly popular and useful it is. The "overfunding" goes into conferences and developer advocacy. Bad thesis, bad examples, easy to find counter examples. Money in open source can be problematic. More often than not, it's the lack thereof that is.
ricardobeat 4y ago
These always ignore the possibility that a large % of OSS development happens during working hours at an existing employer. Very few projects are led by devs who decided to do OSS full time without an existing income source. Some real numbers on this would be nice to have too. If you've seen any research in this area please share.
- auslegung 4y ago
  > These always ignore the fact that a large chunk (maybe the majority?) of OSS development happens during working hours at an existing employer. Do you have any sources for this? It doesn’t seem right to make a vague statement (a large chunk) which sounds bad, nor a somewhat less vague conjecture (maybe the majority?) without sources. In my very limited experience, any developer who is significantly supporting OSS with code contributions is a high contributor for their employer, and if they don’t always do the agreed-upon number of hours/week for their employer, I doubt it’s far off. So I disagree with you anecdotally, which doesn’t matter much, and I question your sources, which matters more.
  - ricardobeat 4y ago
    Fair point, edited to be less vague. These statements are based on my own observations. Would love to see a poll in 'the state of X' style regarding who contributes to OSS or not.
  - return_to_monke 4y ago
    I think what they meant is that a lot of popular open source projects are maintained/created originally by companies. So, Facebook created React. FB devs are, i assume, paid for working on React, even though it doesn't directly benefit FB itself (they aren't writing a new messenger feature, for example)
    - throwaway858 4y ago
      For every React there are 1000 other open source projects run entirely by volunteers. I am curious if there is actual data on the number of man-hours that are spent on open source per year, and how many of those are funded by corporations. My guess is that it is less than 1%.
analognoise 4y ago
How entitled do you have to be to expect other people to fund your hobby? It's a hobby, not a job. If it's becoming too much of a distraction - just...stop doing it?
- WrtCdEvrydy 4y ago
  > It's a hobby, not a job. If it's becoming too much of a distraction - just...stop doing it? Sounds good, I'll just remove my libraries from npm... (oh wait, that's left-pad) Okay, plan B, I'll hand it over to a random person... (oh wait, that's event-stream)
  - analognoise 4y ago
    ...and? Like the internet will collapse without left-pad?
    - monetus 4y ago
      Things are so complex, I sometimes wonder if left-pad being removed caused a car crash anywhere.
    - moron4hire 4y ago
      I mean, it kind of did. I don't know if you were there, but if it didn't have an impact, we wouldn't be talking about it today.
- yaddaor 4y ago
  When other people rely on your hobby it can be hard to just walk away. There is pride, dedication and the feeling of providing value in FOSS. But if others make tremendous amounts of money based on your unpaid work, and show entitlement to its benefits and free support or development, it is hard not not feel a tiny bit entitled for compensation.
  - analognoise 4y ago
    If other people are making money off of your hard work... stop rewarding them with free work. But it's nauseatingly entitled to just expect people to pay a person for their hobby. Pick a different hobby if it upsets you? There are other things a person can do with their time.
remram 4y ago
None of those categories seem to be "caused" by underfunding or unappreciation, except perhaps the faker.js issue? There are more incidents in that category though, for example many Python developers stopped maintaining their projects in protest when pypi.org put additional requirements on people whose projects were particularly popular (those people were forced to enable 2FA).
- iforgotpassword 4y ago
  The left-pad one too I guess. Some of them could've been caused by underfunding, if a maintainer would have preferred to spend more time and care on their project but had to some other work to make ends meet, and got sloppy with their OSS project.
  - remram 4y ago
    This is arguably true of anything, and therefore not very interesting IMHO: any project could be better with more funding, any bug could have been avoided with more effort.
    - iforgotpassword 4y ago
      Yes but this would be measurable with effort. If something like this happened, investigate, talk to maintainers and assess the situation the project is in. It would be interesting what the ratio of "that's just how we roll" vs. "I'm stressed out and can't keep up with bug reports and PRs and just committed stuff to keep up" is.
- Tainnor 4y ago
  > There are more incidents in that category though, for example many Python developers stopped maintaining their projects in protest when pypi.org put additional requirements on people whose projects were particularly popular (those people were forced to enable 2FA). Yikes. Everyone is absolutely free to ignore security wherever they wish on their personal projects, but that just means I won't let any such code anywhere near a production codebase.
tisc 4y ago
I have been wondering about this, whether this is not simply a shift of the problem? Let’s assume we get into a world where we pay for open source. Who would we pay? The maintainer I guess. What about the contributors? When the maintainer(s) receive financial rewarding for the code, will contributors receive a part of this as well? And how would that be divided?
- wmf 4y ago
  Everybody will be the maintainer of a one-person project.
- duxup 4y ago
  I wonder about conflicts / arguments over money. Gamification of contributions… shoehorning projects into other projects that get funding. Forks just to try to rake in contributions. Just free avoids a lot of problems, but certainly isn’t problem free.
- iforgotpassword 4y ago
  I've been thinking about this on and off. I try to support OSS (currently via Patreon only) and am currently at about 55€ per month. It is really hard to pick the right projects, because I use a lot of OSS, and it's not like I have infinite money to spend. So right now I mostly fund smaller projects because it feels they need it more, but at the same time I think I should also consider how important some piece of software is to me, or how much I depend on it, which gets really hard as soon as you don't just include "visible" software, but also libraries. I guess I'd have a really bad time without a jpeg library, for example. But that leads into your point about rewarding contributors. Ideally, every project that receives donations will fairly redistribute a share of it to every contributor and library they depend on, but that seems absolutely impractical to get right, especially for larger projects. Also, should you take the complexity of a project into account? Not to diminish the work of the folks behind eg libjpeg-turbo, but a jpeg encoder/decoder isn't exactly rocket science, so should they receive less than for example libx264? So yeah, I think this is a fairly deep topic that you can put a lot of thought into, and even get a bit philosophical about. Interested to hear other people's approach to this.
- 4y ago
deleted 4y ago
[deleted]
denton-scratch 4y ago
Judging from the article, most of these problems seem to have manifested on NPM. Is there a reason for that?
- forgotpwd16 4y ago
  The node ecosystem takes the micro-package architecture to extreme. Examples are the infamous is-odd and is-even that is just `return !isOdd(i)`. The result of building an app utilizing numerous dependencies and the dependecy tree that is formed is an increased incident surface.
- the-printer 4y ago
  From my vantage point: Lots of people use Node and projects built with it seem notorious for having a lot of dependencies, so incidents such as the ones listed are high profile and easily proliferated.
- dtolnay 4y ago
  NPM has an order of magnitude more packages than the other language-specific package registries. It has more packages than every other registry put together (including Maven Central, PyPI, crates.io, etc). http://www.modulecounts.com http://www.modulecounts.com
jpollock 4y ago
Isn't this the responsibility of the team choosing to use that project (transitively or directly)? If this was a commercial vendor that went out of business, we wouldn't be discussing it. It would be a failure in the procurement process that didn't detect (and risk manage) the supplier's insolvency. The same due diligence should apply to open source projects. The benefit of open source is that it makes code escrow (and follow-on maintenance) a lot easier.
- x86x87 4y ago
  In theory you are right. In the real world the reality is that most of the software out there is built on the shoulders of open source. Due diligence for every thing you pull in (along with planning on what to do if you need to remove/maintain yourself) is prohibitory expensive. If you rely on something you should try to ensure that it survives and trives. Especially if you are raking in money as a result of using that something.
  - jpollock 4y ago
    Paying for maintenance is part of a viable risk management plan. Due diligence is a measure of the size of the risk. Eventually, the risk will outweigh the cost of checking. Some firms will track the cost vs risk and act based on that, others wait until it explodes. e.g. The company is using software stack "D", and is launching a new business. They have no money. If they get sued, they close up shop and move on. They have a successful funding round and get an injection of $100m. This hits the news, and they are immediately hit with a lawsuit alleging copyright infringement through their use of "D" (GPLv3 perhaps?). Somewhere between launch and funding there was a point where the cost of diligence (detecting the license problem) would have dropped below the risk adjusted settlement cost (remediation + lawyers fees + lost sales), hopefully allowing the lawsuit to be avoided. Then again, it might never have crossed below. Knowing that line is an acceptance of the risk. That's also perfectly valid.
- TheRealPomax 4y ago
  This is a list of "destructive" incidents, rather than the usual "the project died and dropped off the web as a result" that you're thinking of (based on the vendor going out of business reference). A more apt comparison would be if a vendor didn't want to support an obsolete product anymore and so they remotely rig it to intentionally take down their client's business portal when they try to update instead of just not being available anymore. (And of course, that's the analogy, many of the items on this list don't hold up to it, as is the case with all analogies)
Proven 4y ago
hinkley 4y ago
So half the time when I claim there’s a social contract to be maintained by FOSS creators with regard to fitness to purpose and documentation, I get downvoted to invisibility. But you guys think it’s okay to have a social contract on enjoying that software? Isn’t that being a little precious? People don’t get paid for play. So we collectively need to decide if open source is for fun or adulting. You can’t have your cake and eat it too, and insisting on it is going to get us labeled as narcissists. They label everything as narcissism these days, but still.
VLM 4y ago
The middle class suburban neighborhood beautification model works. None of us work as full time landscapers, we all mow our lawns so all our houses look better as a group. People too antisocial to live in our neighborhood... don't. There would have to be a solution to those people. They probably don't drag us down too much so they might not matter, either WRT neighborhoods OR source code. I don't mow my lawn because my neighbor sends me micropayments for it or I have some elaborate and weird "HOA"-like contractual obligation to mow my lawn, I just mow it because that's what homeowners do around here and I moved here to fit in with them so obviously I don't mind, its good exercise at worst and almost hobby recreation when I'm planting flowers in the springtime. Likewise I do a pitiful amount of FOSS stuff but more than nothing, because that's what 'my people', and the people I like to hand out with, do. Don't have a day job doing ONLY corporate work or ONLY FOSS work, do some of each. And don't expect a paycheck for the volunteer work. When I help pack boxes of food for hungry people at church I don't expect much of a paycheck either, but its just something I do with some of my spare time. The hidden assumption is always that if paid corporates had not relied on free FOSS their paid for code would be higher quality... Naah they'd probably get powned twice as much its just they wouldn't be able to outsource the responsibility for bad code to some other organization. Fundamentally at the end of the day every org in the link "made more money" because of FOSS than they would have lost if they wrote inferior non-FOSS copycats of the FOSS code.
- rpastuszak 4y ago
  > Don't have a day job doing ONLY corporate work or ONLY FOSS work, do some of each. And don't expect a paycheck for the volunteer work. Some FOSS projects will require people working on them full-time. I think a better, long-term approach would be to make FOSS work sustainable.
  - throwawaaarrgh 4y ago
    give money to somebody to develop something given away for free? just because it enables businesses / keeps people secure / gives agency to customers / reduces monopoly dependency / increases derivative works? that's Commie talk! I'll take it if someone makes it free, of course. but I'll be damned if I'm going to pay some insignificant tax to support it!!
rubenv 4y ago
For all it's good intentions, also be warned that paydevs is promoting "break the build" as a valid strategy. https://www.paydevs.com/pages/faq https://www.paydevs.com/pages/faq I tried reasoning with the founder about how, as a build engineer, I find that highly disturbing, but they don't see any trouble with that. Wouldn't recommend, for that reason alone. Tidelift may be a better option here.
- scrollaway 4y ago
  Both Tidelift and Paydevs solve a pretty specific scenario. IMO, they are not useful unless you are writing a library, or similar type of open source project which is usually invisible (yet can still be critical). Most libraries rarely need the kind of maintenance work that justifies paying people full-time on them. It's often the case that a library is written and then done - future development may be maintenance type work (supporting newer versions of whatever), or increased coverage of the library's use cases. For all this, Tidelift and Paydevs are a good fit. But most projects that really need continuous chunks of money are going to be end user apps, adapters/sdks (i lied, those are libraries, but they're more visible and often against a moving target), web services, infra services, etc. For those, I recommend taking more ownership of the finance and setting up sponsorships via Open Collective (https://opencollective.com/ https://opencollective.com/) Source: I run my own open collectives, have corporate sponsorships through there, I've helped several OSS projects monetize, created my own successful open source startup, etc. If you're an open source maintainer and need advice on this, feel free to email me and AMA (see profile)
- a_c 4y ago
  I think software distribution is a lighthouse problem. Software distribution has close to zero marginal cost. Any cost imposed on zero marginal cost good will reduce the benefit provided by the good. If a developer wants to make software for better cause, open source is the way to go. But I have no solution to how to support the effort of developer. This is the challenge faced with journalism: free but rubbish articles yet with ads or paywalling everything. Both are not ideal IMO https://courses.cit.cornell.edu/econ335/out/lighthouse.pdf https://courses.cit.cornell.edu/econ335/out/lighthouse.pdf
- deleted 4y ago
Genghis_9000 4y ago
where is the list of these open source projects that get funded? i dont want to use any of them. of course no sane person would use node in the first place
- pabs3 4y ago
  To start with, most of the changes to the Linux kernel are funded by large (and small) companies: https://lwn.net/Articles/909625/ https://lwn.net/Articles/909625/
perihelions 4y ago
It's probably helpful context that this repo is a startup who wants to act as a middleman for OSS monetization payments. - "PayDevs is "Monetization as a Service" for open source libraries. At paydevs.com, we provide closed registries for OSS maintainers to publish their compiled software libraries (or built packages). We restrict access to these registries and collect a contribution from private and corporate users to fill a money pool that is distributed each month based on the number of users a library has."
- rozab 4y ago
  That method for splitting income seems completely unworkable. Wouldn't this give the author of left-pad the lion's share? How is that fair?
  - dtolnay 4y ago
    https://thanks.dev https://thanks.dev has a good model for this. By default they'll split your monthly contribution equally among your dependencies (and exponentially decaying among transitive dependencies) but you can go in and "boost" or "unboost" specific dependencies or developers by up to a factor of 20 up or down. So if I have 2 dependencies which are equally important to my project but one is vastly higher effort to maintain, I can reflect that in the allocation.
    - elkos 4y ago
      What if one of yours dependencies hasn't setup an account in Thanks Dev?
      - dtolnay 4y ago
        See the explanation by the thanks.dev founder (qwerki) here: https://news.ycombinator.com/item?id=33368045 https://news.ycombinator.com/item?id=33368045
stopspaaaam 4y ago
This paydevs "startup" is made by this german dude called Jörg. 2 weeks ago he scraped all emails from npm/github and spammed everyone with his cheap promo for paydevs. I would not trust whatever he does.
bawolff 4y ago
Ugh. Having maintainers be well paid will not magically make your software bug free. Google pays their devs, their software still has bugs. I wonder if the real problem it solves is a bunch of corporate types are starting to feel the ethical pressure of leeching off open source, and a nominal fee is the only way they understand the concept of giving back.
- chillfox 4y ago
  No, of course not, but everyone's gotta eat and money can reduce stress and eliminate the risk of someone deleting or sabotaging their code due to reasons related to a lack of money.
  - bawolff 4y ago
    Everyone has got to eat, but they don't neccesarily have to eat on the direct basis of their open source contributions. Let volunteers be volunteers.
    - chillfox 4y ago
      I guess the core issue here is if open source is volunteer work, a hobby or art. If you see it as volunteer work, then yes you should not be paid, but you should also not provide services to wealthy organizations as they don't need it and can pay for their own needs. If this is a hobby, then why are you putting your code on GitHub? you should just share it with small communities you enjoy hanging out with. And don't provide any services unless you personally know the requester and like them. If this is more like art (think music), then you want to make it big, you want to share the code far and wide and for it to become popular, you help out developers from big companies (like record labels) hoping they notice you and pay you some day. I personally think open source can take any of those forms as it's more about how the person works and their aspirations.
      - bawolff 4y ago
        > If this is a hobby, then why are you putting your code on GitHub? you should just share it with small communities you enjoy hanging out with. And don't provide any services unless you personally know the requester and like them. I'm confused. The vast majority of code on github pretty obviously falls into this category. And quite frankly its pretty condescending. Would you tell someone who enjoys gardening to only do their backyard lest other people see it? For that matter, who are you to tell people who they can and cannot "provide services" to. Do you also object to people acting in local community theater? > If this is more like art (think music), then you want to make it big, you want to share the code far and wide and for it to become popular, you help out developers from big companies (like record labels) hoping they notice you and pay you some day. Similarly, how many artists have you met? Some do actually yearn for that sort of thing, but most are not in it to do that.
KingOfCoders 4y ago
"A categorized list of incidents caused by unappreciated OSS maintainers or underfunded OSS library projects." The Log4J incident?
lifeisstillgood 4y ago
Some thoughts: - FOSS is high quality because really talented people with drive work to build the best they can, across global boundaries - FOSS is also high quality because it's an almost perfect market - discoverability is high, transfer costs low and so the best becomes dominant - There is also a lot of bad FOSS code out there. - Lots of FOSS like lots of proprietary code is just bloated. - There needs to be some maintenance - but equally some ... it used to be called systems integration. - I think the layer of for profit, not for profit and charitable work should focus there - systems integration. Imagine a world where a ISV gets "certified" on say a Python MatPlotlib, with at least two employees having made accepted pull requests. or something. Now we have a layer of companies that have profit and cash flow and an interest in maintaining those foss projects. Not merely using them for free.
pabs3 4y ago
For those looking to get paid to work on OSS, the FOSSjobs folks have some job ads and other resources for that. https://www.fossjobs.net/ https://www.fossjobs.net/ https://github.com/fossjobs/fossjobs/wiki/resources https://github.com/fossjobs/fossjobs/wiki/resources
foverzar 4y ago
Ugh, this is just childish. You publish the software under a permissive free license and then make a pikachu confused face when people start using it according to the said license. What the hell did you expect would happen? If you wanted to get paid for software, why did you instead tell everyone that it can be used for free? If you want to get paid for maintenance, then why are you doing it for free, instead of setting up some kind of a bug bounty, when you only react after payment? Just add a bot that automatically adds payment link to new Github Issues or whatever you use. If you don't want your software to be used for making money without paying you, then add this explicitly to your LICENSE. It's srsly THAT simple. And don't give me that "evil corporations make money on free software" bullshit. I remember it were the devs themselves who pushed for the use of OSS for their own convenience, back in the day the use of OSS was a hard NO in most enterprise shops, somewhere it's still is. Throwing a tantrum just cuz people use the software the way that YOU explicitly told them to is plain stupid.

154 points by pabs3 4y ago

our model of society is not compatible with open source there needs to be a massive shift and appreciate more the work of volunteers, contributors and benevolent until then, these problems will amplify and i'm not talking about github sponsors since it's opt in, and it's more of a popularity check than anything else i'm talking about that dude who will randomly appear to send a PR that fixes something important, the dude who decide overnight to open source his work but is agoraphobic, that other dude who help write documentation, that other dude who help triage issues, countless hidden people who never are rewarded

uri4 4y ago
- deleted 4y ago
  [deleted]
- Shared404 4y ago
  Phone keyboard, or trying to avoid auto filtering? In addition, why not come say this with your main account?
the_gipsy 4y ago
If it's not compatible, then how come it thrives so well? We can improve it, sure, but let's ask why it works to begin with, and then improve on that. I don't think money is an issue.
- eqvinox 4y ago
  > If it's not compatible, then how come it thrives so well? Careful — some societies a while back "thrived" by relying on slavery. OSS is not slavery, but drawing conclusions just from apparent thriving is dangerous. (Other analogies: recent bubble collapses from the housing market & dotcom before that — those seemed to "thrive" too, before the bubble collapsed.) > […] let's ask why it works to begin with, […] One thing I'd throw on that list is people trying to build a name and reputation hoping to get hired in the future. This includes bright youths fresh out of high school, but also PhD students whose thesis delivery is turning into a dreading life change. They're running on borrowed time, and if it doesn't work out it's both them and their projects that are screwed.
  - the_gipsy 4y ago
    > slavery Have you thought that maybe (a lot of) people make OSS for the fun of it?
- smoldesu 4y ago
  It's got a weird bit of nuance to it. I think Open Source does well because it's economically infeasible for it to fail. The cost of hosting source code is next to nothing, and the idea of writing a shared library/tool gives it long-term appeal. The problem boils down to human nature, and the greed/ambition/entitlement we feel isn't balanced with a proper respect for our surroundings. If you train people to be entrepreneurs, they'll nickle-and-dime every free software product they find. There's not really a problem with FOSS software, as I see it. It's okay to disagree with it's principles (or even for the purposes of a single project), but the concepts of public licensing are completely moral and just. If we frame this as a money problem, corporate FOSS benefactors will build us a money pit. That's not what Free Software (capital F) needs.
- Kukumber 4y ago
  > If it's not compatible, then how come it thrives so well? Construction industry in Quatar thrives so well, specially thanks to the construction of their brand new football stadiums for the world cup Manufacturing industry thrives to well in Asia, specially thanks to their ability to mass produce cheap Nike shoes Do you endorse kids labor and slavery, is it compatible? And i never mentioned "money", it's funny that you thought about it yourself I can understand that it is hard to seek VC funding if you have to split the money with the real contributors, and not just that idea dude
indymike 4y ago
> our model of society is not compatible with open source I’d say evidence is to the contrary. This message wouldn’t be possible without open source working on multiple devices at every layer of the network. I think the problem of funding open source well, that is a different problem and has a lot of the same problems getting anything funded does. Not every piece of code can have an enterprise built around it, and that means there will be no one to even look at bugs. Finally, let’s talk about volunteering. Most often volunteering is doing something that doesn’t get cash budgeted towards it. You go in doing something necessary but unbudgeted because you want to… and with no reward other than knowing you made something work. Maybe you even give up something you could be doing with time instead of volunteering. Manning the directions kiosk at the hospital, picking up garbage in a neighborhood, nailing the roof onto a house the owner can’t afford to buy, putting letters in envelopes, and answering the phone at a fundraiser are all examples of this. You know what you are getting in to and you know what you are getting paid. No injustice in it at all. And for a lot of people it’s the most important thing they do.

acta_non_verba 4y ago

One of the unspoken benefits of paying OSS projects is that you then attract the money motivated rather than the ideologically or politically movement. That has value in and of itself.

kilovoltaire 4y ago
"money motivated" doesn't necessarily lead in the best direction

didgetmaster 4y ago

I have a project that I have thought about open sourcing. When I hear horror stories about demanding 'customers' who don't pay you anything but somehow expect you to drop everything and address their immediate concern (feature, bug, documentation, etc.), that gives me pause. I wonder how many other projects have also been kept out of the OSS realm for the same reasons.

buro9 4y ago
If you choose a license like AGPL then this will exclude most corps who will not pay for open source from using it, which turns out to have a large overlap with the corps that expect you to drop everything and address their immediate concern. It keeps the project within OSS more, or those who are willing to invest in OSS (because if they do anything more than just use the library / application then they now have a burden to publish changes and be visible so they're forced to invest something from their side). Recently this has been my thought... that my future projects should be AGPL from day one. To the existing ones, especially the successful one... if it does get too much for me, I shall relicense.
- protomikron 4y ago
  Yes, I think so too. > Recently this has been my thought... that my future projects should be AGPL from day one. If that means that companies can't use it, because that would mean, if they use it they would be required to open-source their managed SaaS solution ... that's a feature?
  - buro9 4y ago
    Where I think it's a feature is that instead of them taking from open source and expecting to be able to do that without having to do anything from their side (except demand fixes / updates / features)... AGPL forces them to invest some time and money into sharing any changes they've made and contributing back. It prevents corps running their own version without sharing those changes back, and it forces corps to think carefully about whether they are willing to invest (their time and effort) in the OSS projects that they consume. I doubt it would mean that they have to OSS their SaaS offerings. Most likely things are all implemented as little services and the boundary of what they'd have to OSS at most is one of those. More it forces them to be a better and more mindful consumer of OSS.

nlrtalk 4y ago

That is a problem. On the other hand I know more incidents caused by overfunded corporate OSS developers who have taken over projects and justify their existence by manically rewriting the code base for no reason. Many of these incidents are covered up. Contradicting the corporate politicians is dangerous, because often they have installed dozens of other developers who always agree with them and are ready to libel dissenters. OSS funding is a hard problem. OSS was best when it wasn't funded at all.

ricardobeat 4y ago
Your post is controversial, but hard agree on that last sentence. The environment changed completely in the past decade after the lines were blurred, and not in a good way.
cratermoon 4y ago
> Many of these incidents are covered up Extraordinary claims require extraordinary evidence. This vaguely conspiratorial comment about things "they" have done is a problem.
b112 4y ago
[flagged]
- scrollaway 4y ago
  I flagged your post because at this point, talking about systemd is just flamebait. You have an opinion about what an init system "should" be. Systemd developers have another. If you don't want systemd, don't use it. What's that, you can't "not" use it because your distribution decided to use it? There's a good reason they did. If you think you know better, use one that doesn't, or do your own distro… Systemd is also a poor example of an "overfunded" project. Some of its developers are paid, but it's not funded "as a project", it's just maintained by a company. Want an overfunded open source project? Look at React. And yet, look at how incredibly popular and useful it is. The "overfunding" goes into conferences and developer advocacy. Bad thesis, bad examples, easy to find counter examples. Money in open source can be problematic. More often than not, it's the lack thereof that is.

ricardobeat 4y ago

These always ignore the possibility that a large % of OSS development happens during working hours at an existing employer. Very few projects are led by devs who decided to do OSS full time without an existing income source. Some real numbers on this would be nice to have too. If you've seen any research in this area please share.

auslegung 4y ago
> These always ignore the fact that a large chunk (maybe the majority?) of OSS development happens during working hours at an existing employer. Do you have any sources for this? It doesn’t seem right to make a vague statement (a large chunk) which sounds bad, nor a somewhat less vague conjecture (maybe the majority?) without sources. In my very limited experience, any developer who is significantly supporting OSS with code contributions is a high contributor for their employer, and if they don’t always do the agreed-upon number of hours/week for their employer, I doubt it’s far off. So I disagree with you anecdotally, which doesn’t matter much, and I question your sources, which matters more.
- ricardobeat 4y ago
  Fair point, edited to be less vague. These statements are based on my own observations. Would love to see a poll in 'the state of X' style regarding who contributes to OSS or not.
- return_to_monke 4y ago
  I think what they meant is that a lot of popular open source projects are maintained/created originally by companies. So, Facebook created React. FB devs are, i assume, paid for working on React, even though it doesn't directly benefit FB itself (they aren't writing a new messenger feature, for example)
  - throwaway858 4y ago
    For every React there are 1000 other open source projects run entirely by volunteers. I am curious if there is actual data on the number of man-hours that are spent on open source per year, and how many of those are funded by corporations. My guess is that it is less than 1%.

analognoise 4y ago

How entitled do you have to be to expect other people to fund your hobby? It's a hobby, not a job. If it's becoming too much of a distraction - just...stop doing it?

WrtCdEvrydy 4y ago
> It's a hobby, not a job. If it's becoming too much of a distraction - just...stop doing it? Sounds good, I'll just remove my libraries from npm... (oh wait, that's left-pad) Okay, plan B, I'll hand it over to a random person... (oh wait, that's event-stream)
- analognoise 4y ago
  ...and? Like the internet will collapse without left-pad?
  - monetus 4y ago
    Things are so complex, I sometimes wonder if left-pad being removed caused a car crash anywhere.
  - moron4hire 4y ago
    I mean, it kind of did. I don't know if you were there, but if it didn't have an impact, we wouldn't be talking about it today.
yaddaor 4y ago
When other people rely on your hobby it can be hard to just walk away. There is pride, dedication and the feeling of providing value in FOSS. But if others make tremendous amounts of money based on your unpaid work, and show entitlement to its benefits and free support or development, it is hard not not feel a tiny bit entitled for compensation.
- analognoise 4y ago
  If other people are making money off of your hard work... stop rewarding them with free work. But it's nauseatingly entitled to just expect people to pay a person for their hobby. Pick a different hobby if it upsets you? There are other things a person can do with their time.

remram 4y ago

None of those categories seem to be "caused" by underfunding or unappreciation, except perhaps the faker.js issue? There are more incidents in that category though, for example many Python developers stopped maintaining their projects in protest when pypi.org put additional requirements on people whose projects were particularly popular (those people were forced to enable 2FA).

iforgotpassword 4y ago
The left-pad one too I guess. Some of them could've been caused by underfunding, if a maintainer would have preferred to spend more time and care on their project but had to some other work to make ends meet, and got sloppy with their OSS project.
- remram 4y ago
  This is arguably true of anything, and therefore not very interesting IMHO: any project could be better with more funding, any bug could have been avoided with more effort.
  - iforgotpassword 4y ago
    Yes but this would be measurable with effort. If something like this happened, investigate, talk to maintainers and assess the situation the project is in. It would be interesting what the ratio of "that's just how we roll" vs. "I'm stressed out and can't keep up with bug reports and PRs and just committed stuff to keep up" is.
Tainnor 4y ago
> There are more incidents in that category though, for example many Python developers stopped maintaining their projects in protest when pypi.org put additional requirements on people whose projects were particularly popular (those people were forced to enable 2FA). Yikes. Everyone is absolutely free to ignore security wherever they wish on their personal projects, but that just means I won't let any such code anywhere near a production codebase.

tisc 4y ago

I have been wondering about this, whether this is not simply a shift of the problem? Let’s assume we get into a world where we pay for open source. Who would we pay? The maintainer I guess. What about the contributors? When the maintainer(s) receive financial rewarding for the code, will contributors receive a part of this as well? And how would that be divided?

wmf 4y ago
Everybody will be the maintainer of a one-person project.
duxup 4y ago
I wonder about conflicts / arguments over money. Gamification of contributions… shoehorning projects into other projects that get funding. Forks just to try to rake in contributions. Just free avoids a lot of problems, but certainly isn’t problem free.
iforgotpassword 4y ago
I've been thinking about this on and off. I try to support OSS (currently via Patreon only) and am currently at about 55€ per month. It is really hard to pick the right projects, because I use a lot of OSS, and it's not like I have infinite money to spend. So right now I mostly fund smaller projects because it feels they need it more, but at the same time I think I should also consider how important some piece of software is to me, or how much I depend on it, which gets really hard as soon as you don't just include "visible" software, but also libraries. I guess I'd have a really bad time without a jpeg library, for example. But that leads into your point about rewarding contributors. Ideally, every project that receives donations will fairly redistribute a share of it to every contributor and library they depend on, but that seems absolutely impractical to get right, especially for larger projects. Also, should you take the complexity of a project into account? Not to diminish the work of the folks behind eg libjpeg-turbo, but a jpeg encoder/decoder isn't exactly rocket science, so should they receive less than for example libx264? So yeah, I think this is a fairly deep topic that you can put a lot of thought into, and even get a bit philosophical about. Interested to hear other people's approach to this.
4y ago

deleted 4y ago

[deleted]

denton-scratch 4y ago

Judging from the article, most of these problems seem to have manifested on NPM. Is there a reason for that?

forgotpwd16 4y ago
The node ecosystem takes the micro-package architecture to extreme. Examples are the infamous is-odd and is-even that is just `return !isOdd(i)`. The result of building an app utilizing numerous dependencies and the dependecy tree that is formed is an increased incident surface.
the-printer 4y ago
From my vantage point: Lots of people use Node and projects built with it seem notorious for having a lot of dependencies, so incidents such as the ones listed are high profile and easily proliferated.
dtolnay 4y ago
NPM has an order of magnitude more packages than the other language-specific package registries. It has more packages than every other registry put together (including Maven Central, PyPI, crates.io, etc). http://www.modulecounts.com http://www.modulecounts.com

jpollock 4y ago

Isn't this the responsibility of the team choosing to use that project (transitively or directly)? If this was a commercial vendor that went out of business, we wouldn't be discussing it. It would be a failure in the procurement process that didn't detect (and risk manage) the supplier's insolvency. The same due diligence should apply to open source projects. The benefit of open source is that it makes code escrow (and follow-on maintenance) a lot easier.

x86x87 4y ago
In theory you are right. In the real world the reality is that most of the software out there is built on the shoulders of open source. Due diligence for every thing you pull in (along with planning on what to do if you need to remove/maintain yourself) is prohibitory expensive. If you rely on something you should try to ensure that it survives and trives. Especially if you are raking in money as a result of using that something.
- jpollock 4y ago
  Paying for maintenance is part of a viable risk management plan. Due diligence is a measure of the size of the risk. Eventually, the risk will outweigh the cost of checking. Some firms will track the cost vs risk and act based on that, others wait until it explodes. e.g. The company is using software stack "D", and is launching a new business. They have no money. If they get sued, they close up shop and move on. They have a successful funding round and get an injection of $100m. This hits the news, and they are immediately hit with a lawsuit alleging copyright infringement through their use of "D" (GPLv3 perhaps?). Somewhere between launch and funding there was a point where the cost of diligence (detecting the license problem) would have dropped below the risk adjusted settlement cost (remediation + lawyers fees + lost sales), hopefully allowing the lawsuit to be avoided. Then again, it might never have crossed below. Knowing that line is an acceptance of the risk. That's also perfectly valid.
TheRealPomax 4y ago
This is a list of "destructive" incidents, rather than the usual "the project died and dropped off the web as a result" that you're thinking of (based on the vendor going out of business reference). A more apt comparison would be if a vendor didn't want to support an obsolete product anymore and so they remotely rig it to intentionally take down their client's business portal when they try to update instead of just not being available anymore. (And of course, that's the analogy, many of the items on this list don't hold up to it, as is the case with all analogies)

Proven 4y ago

hinkley 4y ago

So half the time when I claim there’s a social contract to be maintained by FOSS creators with regard to fitness to purpose and documentation, I get downvoted to invisibility. But you guys think it’s okay to have a social contract on enjoying that software? Isn’t that being a little precious? People don’t get paid for play. So we collectively need to decide if open source is for fun or adulting. You can’t have your cake and eat it too, and insisting on it is going to get us labeled as narcissists. They label everything as narcissism these days, but still.

VLM 4y ago

The middle class suburban neighborhood beautification model works. None of us work as full time landscapers, we all mow our lawns so all our houses look better as a group. People too antisocial to live in our neighborhood... don't. There would have to be a solution to those people. They probably don't drag us down too much so they might not matter, either WRT neighborhoods OR source code. I don't mow my lawn because my neighbor sends me micropayments for it or I have some elaborate and weird "HOA"-like contractual obligation to mow my lawn, I just mow it because that's what homeowners do around here and I moved here to fit in with them so obviously I don't mind, its good exercise at worst and almost hobby recreation when I'm planting flowers in the springtime. Likewise I do a pitiful amount of FOSS stuff but more than nothing, because that's what 'my people', and the people I like to hand out with, do. Don't have a day job doing ONLY corporate work or ONLY FOSS work, do some of each. And don't expect a paycheck for the volunteer work. When I help pack boxes of food for hungry people at church I don't expect much of a paycheck either, but its just something I do with some of my spare time. The hidden assumption is always that if paid corporates had not relied on free FOSS their paid for code would be higher quality... Naah they'd probably get powned twice as much its just they wouldn't be able to outsource the responsibility for bad code to some other organization. Fundamentally at the end of the day every org in the link "made more money" because of FOSS than they would have lost if they wrote inferior non-FOSS copycats of the FOSS code.

rpastuszak 4y ago
> Don't have a day job doing ONLY corporate work or ONLY FOSS work, do some of each. And don't expect a paycheck for the volunteer work. Some FOSS projects will require people working on them full-time. I think a better, long-term approach would be to make FOSS work sustainable.
- throwawaaarrgh 4y ago
  give money to somebody to develop something given away for free? just because it enables businesses / keeps people secure / gives agency to customers / reduces monopoly dependency / increases derivative works? that's Commie talk! I'll take it if someone makes it free, of course. but I'll be damned if I'm going to pay some insignificant tax to support it!!

rubenv 4y ago

For all it's good intentions, also be warned that paydevs is promoting "break the build" as a valid strategy. https://www.paydevs.com/pages/faq https://www.paydevs.com/pages/faq I tried reasoning with the founder about how, as a build engineer, I find that highly disturbing, but they don't see any trouble with that. Wouldn't recommend, for that reason alone. Tidelift may be a better option here.

scrollaway 4y ago
Both Tidelift and Paydevs solve a pretty specific scenario. IMO, they are not useful unless you are writing a library, or similar type of open source project which is usually invisible (yet can still be critical). Most libraries rarely need the kind of maintenance work that justifies paying people full-time on them. It's often the case that a library is written and then done - future development may be maintenance type work (supporting newer versions of whatever), or increased coverage of the library's use cases. For all this, Tidelift and Paydevs are a good fit. But most projects that really need continuous chunks of money are going to be end user apps, adapters/sdks (i lied, those are libraries, but they're more visible and often against a moving target), web services, infra services, etc. For those, I recommend taking more ownership of the finance and setting up sponsorships via Open Collective (https://opencollective.com/ https://opencollective.com/) Source: I run my own open collectives, have corporate sponsorships through there, I've helped several OSS projects monetize, created my own successful open source startup, etc. If you're an open source maintainer and need advice on this, feel free to email me and AMA (see profile)
a_c 4y ago
I think software distribution is a lighthouse problem. Software distribution has close to zero marginal cost. Any cost imposed on zero marginal cost good will reduce the benefit provided by the good. If a developer wants to make software for better cause, open source is the way to go. But I have no solution to how to support the effort of developer. This is the challenge faced with journalism: free but rubbish articles yet with ads or paywalling everything. Both are not ideal IMO https://courses.cit.cornell.edu/econ335/out/lighthouse.pdf https://courses.cit.cornell.edu/econ335/out/lighthouse.pdf
deleted 4y ago

Genghis_9000 4y ago

where is the list of these open source projects that get funded? i dont want to use any of them. of course no sane person would use node in the first place

pabs3 4y ago
To start with, most of the changes to the Linux kernel are funded by large (and small) companies: https://lwn.net/Articles/909625/ https://lwn.net/Articles/909625/

perihelions 4y ago

It's probably helpful context that this repo is a startup who wants to act as a middleman for OSS monetization payments. - "PayDevs is "Monetization as a Service" for open source libraries. At paydevs.com, we provide closed registries for OSS maintainers to publish their compiled software libraries (or built packages). We restrict access to these registries and collect a contribution from private and corporate users to fill a money pool that is distributed each month based on the number of users a library has."

rozab 4y ago
That method for splitting income seems completely unworkable. Wouldn't this give the author of left-pad the lion's share? How is that fair?
- dtolnay 4y ago
  https://thanks.dev https://thanks.dev has a good model for this. By default they'll split your monthly contribution equally among your dependencies (and exponentially decaying among transitive dependencies) but you can go in and "boost" or "unboost" specific dependencies or developers by up to a factor of 20 up or down. So if I have 2 dependencies which are equally important to my project but one is vastly higher effort to maintain, I can reflect that in the allocation.
  - elkos 4y ago
    What if one of yours dependencies hasn't setup an account in Thanks Dev?
    - dtolnay 4y ago
      See the explanation by the thanks.dev founder (qwerki) here: https://news.ycombinator.com/item?id=33368045 https://news.ycombinator.com/item?id=33368045

stopspaaaam 4y ago

This paydevs "startup" is made by this german dude called Jörg. 2 weeks ago he scraped all emails from npm/github and spammed everyone with his cheap promo for paydevs. I would not trust whatever he does.

bawolff 4y ago

Ugh. Having maintainers be well paid will not magically make your software bug free. Google pays their devs, their software still has bugs. I wonder if the real problem it solves is a bunch of corporate types are starting to feel the ethical pressure of leeching off open source, and a nominal fee is the only way they understand the concept of giving back.

chillfox 4y ago
No, of course not, but everyone's gotta eat and money can reduce stress and eliminate the risk of someone deleting or sabotaging their code due to reasons related to a lack of money.
- bawolff 4y ago
  Everyone has got to eat, but they don't neccesarily have to eat on the direct basis of their open source contributions. Let volunteers be volunteers.
  - chillfox 4y ago
    I guess the core issue here is if open source is volunteer work, a hobby or art. If you see it as volunteer work, then yes you should not be paid, but you should also not provide services to wealthy organizations as they don't need it and can pay for their own needs. If this is a hobby, then why are you putting your code on GitHub? you should just share it with small communities you enjoy hanging out with. And don't provide any services unless you personally know the requester and like them. If this is more like art (think music), then you want to make it big, you want to share the code far and wide and for it to become popular, you help out developers from big companies (like record labels) hoping they notice you and pay you some day. I personally think open source can take any of those forms as it's more about how the person works and their aspirations.
    - bawolff 4y ago
      > If this is a hobby, then why are you putting your code on GitHub? you should just share it with small communities you enjoy hanging out with. And don't provide any services unless you personally know the requester and like them. I'm confused. The vast majority of code on github pretty obviously falls into this category. And quite frankly its pretty condescending. Would you tell someone who enjoys gardening to only do their backyard lest other people see it? For that matter, who are you to tell people who they can and cannot "provide services" to. Do you also object to people acting in local community theater? > If this is more like art (think music), then you want to make it big, you want to share the code far and wide and for it to become popular, you help out developers from big companies (like record labels) hoping they notice you and pay you some day. Similarly, how many artists have you met? Some do actually yearn for that sort of thing, but most are not in it to do that.

KingOfCoders 4y ago

"A categorized list of incidents caused by unappreciated OSS maintainers or underfunded OSS library projects." The Log4J incident?

lifeisstillgood 4y ago

Some thoughts: - FOSS is high quality because really talented people with drive work to build the best they can, across global boundaries - FOSS is also high quality because it's an almost perfect market - discoverability is high, transfer costs low and so the best becomes dominant - There is also a lot of bad FOSS code out there. - Lots of FOSS like lots of proprietary code is just bloated. - There needs to be some maintenance - but equally some ... it used to be called systems integration. - I think the layer of for profit, not for profit and charitable work should focus there - systems integration. Imagine a world where a ISV gets "certified" on say a Python MatPlotlib, with at least two employees having made accepted pull requests. or something. Now we have a layer of companies that have profit and cash flow and an interest in maintaining those foss projects. Not merely using them for free.

pabs3 4y ago

For those looking to get paid to work on OSS, the FOSSjobs folks have some job ads and other resources for that. https://www.fossjobs.net/ https://www.fossjobs.net/ https://github.com/fossjobs/fossjobs/wiki/resources https://github.com/fossjobs/fossjobs/wiki/resources

foverzar 4y ago

Ugh, this is just childish. You publish the software under a permissive free license and then make a pikachu confused face when people start using it according to the said license. What the hell did you expect would happen? If you wanted to get paid for software, why did you instead tell everyone that it can be used for free? If you want to get paid for maintenance, then why are you doing it for free, instead of setting up some kind of a bug bounty, when you only react after payment? Just add a bot that automatically adds payment link to new Github Issues or whatever you use. If you don't want your software to be used for making money without paying you, then add this explicitly to your LICENSE. It's srsly THAT simple. And don't give me that "evil corporations make money on free software" bullshit. I remember it were the devs themselves who pushed for the use of OSS for their own convenience, back in the day the use of OSS was a hard NO in most enterprise shops, somewhere it's still is. Throwing a tantrum just cuz people use the software the way that YOU explicitly told them to is plain stupid.