4 ms·

I like the position of this author and think it's quite correct, but FWIW the logical conclusion if we pull the lever all the way over to this line of thinking

I like the position of this author and think it's quite correct, but FWIW the logical conclusion if we pull the lever all the way over to this line of thinking is that in the modern era, the FOSS ecosystem has failed as a business model and companies will be better off developing their cores in-house (with all the opacity and lock-in that implies), and the pendulum swings again. Fortunately, we need not pull the lever all the way in that direction. As with so many aspects of the open source ecosystem, the real most valuable element is trust.

di4na 4y ago
Author here. The difference is that FOSS is not a business model. It is far closer to infrastructure, which is usually supported by other means than business models. Things like community structures for common goods (regularly called government but not always). There is a different problem here, which I have chosen to not talk about here, but that is the problem of funding profitable software products. We simply... do not do that. We do not have the tools for that. But that is a different rant.
- shadowgovt 4y ago
  Agreed. What I'm thinking of specifically is the leftpad attack vector, where a trusted actor suddenly went malicious and broke the software many people were lying upon who didn't realize they were relying upon it (and weren't really in a position to be aware of the issues the author had encountered). If that happens too much, corporations re-evaluate rush and costs and start developing things in isolation and in-house. But I expect leftpad will be a rare event.
  - di4na 4y ago
    I would note that the trusted actor did not went malicious. He did exactly what he was entitled to. If we follow the rules, the people that went malicious are all the trusted users and package repository that broke his intent. He was totally in the limits of his rights and the social contract of the licencing for FOSS. The fact we present these maintainers as "going malicious" is exactly what i am ranting against in this post.
    - shadowgovt 4y ago
      If those are the rules, then the risk is too high for corporations to trust strangers, they shall have to stop using FOSS, the ecosystem collapses (because nobody can build on an untrustable system), and the FOSS experiment fails (in the sense we're back in the bad old days of closed software and while people can develop with FOSS, no same user would trust it for use). If my company has to be responsible for every line of code, we may as well own them. I'd argue that he very much did break the social contract. Not the letter of the actual contract, but it's generally assumed FOSS developers aren't in it to screw consumers of their offerings actively. That's the social contract that's the lifeblood of the movement, and if it breaks in the general case, the movement dies. (There's a lot of things people can do that they're perfectly entitled to that would destroy ecosystems because they shatter expectations. Linus could sneak a very clever backdoor into Linux [hypothetically, perhaps not without collusion with multiple actors and a lot of prep work], and he wouldn't break the license but he would severely injure the project's reputation).
      - bombolo 4y ago
        > If my company has to be responsible for every line of code, we may as well own them. Good luck with that… your company has the skills to reimplement node? > but it's generally assumed FOSS developers aren't in it to screw consumers of their offerings actively It's generally assumed they are in it to get screwed actively… but often that isn't the case. > Linus could sneak a very clever backdoor into Linux You are aware of a difference between writing a malware and deleting a project you own right?
        shadowgovt 4y ago
        > You are aware of a difference between writing a malware and deleting a project you own right? You are quite correct; the npm ecosystem may be a special cade since it has been built on a huge amount of trust-assumption, and the real issue there was that trust model, not FOSS in general. Still, in that ecosystem, unpublishing a module unilaterally that so many systems relied upon was, at besst, negligent (morally not legally), showing a disregard for the concerns of those outside the fight with npm operators. In that context, the unpublish was more malicious than an adherence to the old "user beware" rule. Indeed, it would be hard for Linus to unpublish Linux, given the distributed nature of its hosting; unpublishing leftpad looks more like taking advantage of a mis-design in npm's package model to screw over thousands of third-parties.
- Rochus 4y ago
  > The difference is that FOSS is not a business model FOSS can be part of a business model, but only if there are contracting parties who agree on the mutual obligations. If someone simply develops open source software and this is used by arbitrary people, essential prerequisites are missing for a contract to come into being. Instead, there are no obligations to the developer.
- D13Fd 4y ago
  "FOSS is infrastructure" and "FOSS maintainers are not suppliers" seem pretty at odds. It can't be both "infrastructure" and akin to a couch you dump in the trash (as in the example in your comment below).
  - di4na 4y ago
    the road in front of your door are not a business model ;)
  - raisin_churn 4y ago
    FOSS as infrastructure doesn't mean every piece of FOSS is. And infrastructure can be incidental. While we're using analogies tortured beyond all meaning, a goat path in the forest is infrastructure if I ride my bicycle on it to get somewhere, but the goat herder was just herding their goats. If you want to rely on something (code, forest path, whatever), you should probably take steps to ensure the longevity and security of that thing, especially if you depend on it to make money. If I really need my goat/bicycle path, I could do path maintenance on it or try to get the government to do it, but complaining that I'm late for work because the goat herder didn't clear a fallen tree that their goats can jump over but I can't bike around is both foolish and obnoxious.
    - shadowgovt 4y ago
      I'm more concerned about the goat herder intentionally dropping a tree on the path because he's having a bad day and wants it to be your problem too. Perhaps it's a distinction without a difference. But if it happens a lot, you'd stop using that path.
- cortesoft 4y ago
  I am curious… what percentage of FOSS work for the most critical systems is done by people working for free verse people on a company payroll? I feel like most big FOSS projects have corporate sponsors.
  - quanticle 4y ago
    Most big FOSS projects do have corporate sponsors, but what about their dependencies? And the dependencies of the dependencies? Eventually you end up with a situation like what you have with OpenSSL or NTP, where an obscure but important component is owned by someone who has a day job and can't properly look after it.
  - di4na 4y ago
    Nearly none for the really critical components. Even the one with sponsors do not make that much. Typical example. Last year was the first time the curl project could pay for their website hosting vs the author paying it from his own pocket. Curl.
sneak 4y ago
Most of the most valuable software in the world (iOS, Play Services, Google Workspace, all the Nvidia libs enabling the AI revolution, Windows, Excel, GitHub, etc) is proprietary. It's easy to see the huge successes of f/oss and forget that it's only the tip of the value iceberg. k8s and such tip the scales a bit, but there is still 10x more value locked up in proprietary software than with us software freedom zealots. I will continue to release every piece of code I write into the public domain. I recognize however that the majority of people making valuable software do not share my ideology about the illegitimacy of the fiction that is "intellectual property".
- D13Fd 4y ago
  I strongly disagree. FOSS software is king when it comes to value provided (but not, obviously, revenue generated). All of those things you list incorporate free software (e.g., MIT licensed software, public domain software) or at a minimum rely on servers servers and infrastructure that do.
- LamaOfRuin 4y ago
  5 of the 7 things you listed would not exist in any recognizable form without having been built on top of open source software.
josephcsible 4y ago
I don't see how this position means FOSS would fail as a business model. It's not like anyone would be saying "we won't ever provide these guarantees." It's instead "if you just want to use my software without paying, go for it. But if you want any supply chain guarantees, then pay me for them."
- shadowgovt 4y ago
  Agreed; "as a business model" was a bad phrasing. I meant to say "as an alternative to the traditional closed-source business model." If the FOSS ecosystem can't be safely built upon, companies have to build their own. If they have to build their own, they'll want to own it.
mesozoic 4y ago
Seems better we keep pretending it's ok. Let big stupid business build big stupid generally pointless stuff and hope they contribute back to the foundational open source stuff before they go out of business.
massysett 4y ago
Doesn’t paid support to middlemen mitigate this problem? If Bigcorp pays Red Hat, Red Hat should fix the software and work with upstream to do so, thus making the fix Red Hat’s problem. Red Hat knows how to work with upstream to get fixes merged long-term.

di4na 4y ago

Author here. The difference is that FOSS is not a business model. It is far closer to infrastructure, which is usually supported by other means than business models. Things like community structures for common goods (regularly called government but not always). There is a different problem here, which I have chosen to not talk about here, but that is the problem of funding profitable software products. We simply... do not do that. We do not have the tools for that. But that is a different rant.

shadowgovt 4y ago
Agreed. What I'm thinking of specifically is the leftpad attack vector, where a trusted actor suddenly went malicious and broke the software many people were lying upon who didn't realize they were relying upon it (and weren't really in a position to be aware of the issues the author had encountered). If that happens too much, corporations re-evaluate rush and costs and start developing things in isolation and in-house. But I expect leftpad will be a rare event.
- di4na 4y ago
  I would note that the trusted actor did not went malicious. He did exactly what he was entitled to. If we follow the rules, the people that went malicious are all the trusted users and package repository that broke his intent. He was totally in the limits of his rights and the social contract of the licencing for FOSS. The fact we present these maintainers as "going malicious" is exactly what i am ranting against in this post.
  - shadowgovt 4y ago
    If those are the rules, then the risk is too high for corporations to trust strangers, they shall have to stop using FOSS, the ecosystem collapses (because nobody can build on an untrustable system), and the FOSS experiment fails (in the sense we're back in the bad old days of closed software and while people can develop with FOSS, no same user would trust it for use). If my company has to be responsible for every line of code, we may as well own them. I'd argue that he very much did break the social contract. Not the letter of the actual contract, but it's generally assumed FOSS developers aren't in it to screw consumers of their offerings actively. That's the social contract that's the lifeblood of the movement, and if it breaks in the general case, the movement dies. (There's a lot of things people can do that they're perfectly entitled to that would destroy ecosystems because they shatter expectations. Linus could sneak a very clever backdoor into Linux [hypothetically, perhaps not without collusion with multiple actors and a lot of prep work], and he wouldn't break the license but he would severely injure the project's reputation).
    - bombolo 4y ago
      > If my company has to be responsible for every line of code, we may as well own them. Good luck with that… your company has the skills to reimplement node? > but it's generally assumed FOSS developers aren't in it to screw consumers of their offerings actively It's generally assumed they are in it to get screwed actively… but often that isn't the case. > Linus could sneak a very clever backdoor into Linux You are aware of a difference between writing a malware and deleting a project you own right?
      - shadowgovt 4y ago
        > You are aware of a difference between writing a malware and deleting a project you own right? You are quite correct; the npm ecosystem may be a special cade since it has been built on a huge amount of trust-assumption, and the real issue there was that trust model, not FOSS in general. Still, in that ecosystem, unpublishing a module unilaterally that so many systems relied upon was, at besst, negligent (morally not legally), showing a disregard for the concerns of those outside the fight with npm operators. In that context, the unpublish was more malicious than an adherence to the old "user beware" rule. Indeed, it would be hard for Linus to unpublish Linux, given the distributed nature of its hosting; unpublishing leftpad looks more like taking advantage of a mis-design in npm's package model to screw over thousands of third-parties.
Rochus 4y ago
> The difference is that FOSS is not a business model FOSS can be part of a business model, but only if there are contracting parties who agree on the mutual obligations. If someone simply develops open source software and this is used by arbitrary people, essential prerequisites are missing for a contract to come into being. Instead, there are no obligations to the developer.
D13Fd 4y ago
"FOSS is infrastructure" and "FOSS maintainers are not suppliers" seem pretty at odds. It can't be both "infrastructure" and akin to a couch you dump in the trash (as in the example in your comment below).
- di4na 4y ago
  the road in front of your door are not a business model ;)
- raisin_churn 4y ago
  FOSS as infrastructure doesn't mean every piece of FOSS is. And infrastructure can be incidental. While we're using analogies tortured beyond all meaning, a goat path in the forest is infrastructure if I ride my bicycle on it to get somewhere, but the goat herder was just herding their goats. If you want to rely on something (code, forest path, whatever), you should probably take steps to ensure the longevity and security of that thing, especially if you depend on it to make money. If I really need my goat/bicycle path, I could do path maintenance on it or try to get the government to do it, but complaining that I'm late for work because the goat herder didn't clear a fallen tree that their goats can jump over but I can't bike around is both foolish and obnoxious.
  - shadowgovt 4y ago
    I'm more concerned about the goat herder intentionally dropping a tree on the path because he's having a bad day and wants it to be your problem too. Perhaps it's a distinction without a difference. But if it happens a lot, you'd stop using that path.
cortesoft 4y ago
I am curious… what percentage of FOSS work for the most critical systems is done by people working for free verse people on a company payroll? I feel like most big FOSS projects have corporate sponsors.
- quanticle 4y ago
  Most big FOSS projects do have corporate sponsors, but what about their dependencies? And the dependencies of the dependencies? Eventually you end up with a situation like what you have with OpenSSL or NTP, where an obscure but important component is owned by someone who has a day job and can't properly look after it.
- di4na 4y ago
  Nearly none for the really critical components. Even the one with sponsors do not make that much. Typical example. Last year was the first time the curl project could pay for their website hosting vs the author paying it from his own pocket. Curl.

sneak 4y ago

Most of the most valuable software in the world (iOS, Play Services, Google Workspace, all the Nvidia libs enabling the AI revolution, Windows, Excel, GitHub, etc) is proprietary. It's easy to see the huge successes of f/oss and forget that it's only the tip of the value iceberg. k8s and such tip the scales a bit, but there is still 10x more value locked up in proprietary software than with us software freedom zealots. I will continue to release every piece of code I write into the public domain. I recognize however that the majority of people making valuable software do not share my ideology about the illegitimacy of the fiction that is "intellectual property".

D13Fd 4y ago
I strongly disagree. FOSS software is king when it comes to value provided (but not, obviously, revenue generated). All of those things you list incorporate free software (e.g., MIT licensed software, public domain software) or at a minimum rely on servers servers and infrastructure that do.
LamaOfRuin 4y ago
5 of the 7 things you listed would not exist in any recognizable form without having been built on top of open source software.

josephcsible 4y ago

I don't see how this position means FOSS would fail as a business model. It's not like anyone would be saying "we won't ever provide these guarantees." It's instead "if you just want to use my software without paying, go for it. But if you want any supply chain guarantees, then pay me for them."

shadowgovt 4y ago
Agreed; "as a business model" was a bad phrasing. I meant to say "as an alternative to the traditional closed-source business model." If the FOSS ecosystem can't be safely built upon, companies have to build their own. If they have to build their own, they'll want to own it.

mesozoic 4y ago

Seems better we keep pretending it's ok. Let big stupid business build big stupid generally pointless stuff and hope they contribute back to the foundational open source stuff before they go out of business.

massysett 4y ago

Doesn’t paid support to middlemen mitigate this problem? If Bigcorp pays Red Hat, Red Hat should fix the software and work with upstream to do so, thus making the fix Red Hat’s problem. Red Hat knows how to work with upstream to get fixes merged long-term.