4 ms·

FWIW $20k is approximately the total monthly cost of an average engineer at Spotify. I am appaled at how those fundamental libraries do not get the >= 8 digit s

FWIW $20k is approximately the total monthly cost of an average engineer at Spotify. I am appaled at how those fundamental libraries do not get the >= 8 digit support that they deserve. Surely some MBA people can turn this around. FFmpeg burns more in CPU cost every second across major platforms than all those donations amount to.

robertlagrant 4y ago
Tidelift exists. I don't know why it's not more widely used.
- hobofan 4y ago
  Because it is and has always been intransparent about earnings structure (e.g. what percentage of money of a Tidelift subscription is paid out to maintainers), and thus has never achieved critical mass among maintainers. It also seems like they have mostly pivoted away towards software supply-chain analytics.
beernet 4y ago
Oh well, if you want money you shouldn't opt for open source in the first place...
- wiseowise 4y ago
  That’s not the point.
- H8crilA 4y ago
  Yes of course, but there's value in this approach for everyone. Look at Linux for example, there's a real benefit for various orgs in creating and funding a foundation to further the kernel project. It's not that I think these libraries should get something like a fair market value for their product, just a rather small (for a multibillion corp) donation plan. It's worth it for the PR / virtue signalling alone.
  - VLM 4y ago
    Donations can be very expensive to a large company. The labor cost is often huge. If you don't prevent fraud at the $500 level you'll have two problems: Lots of repeated fraud at the $500 level, and people trying to get away with fraud at the $5000, $50000, all the way up to FTX levels of fraud. So you need multiple people in different depts to agree to fund something while other people watch over to make sure the people being funded are not the spouses or shell companies of the approvers. Meanwhile there's paperwork costs to make sure the donation paperwork gets to accounting so accounting gets their tax deduction. At a "really big company" the labor cost of paying an invoice might be $2000. Now does the average programmer get more than $2K of annual value out of urllib3, given the alternatives (which could involve up to architecting around needing it?) Before you laugh and say "no way" to the $2K figure, imagine spending half of an hour long team meeting of ten software devs getting paid $100/hr but overhead etc costs the company $150/hr for them to attend that meeting, that's $750 of labor costs just to have the dev team possibly agree to support urllib3. Then its got to go up the chain to someone with signing approval, someone has to chase the paperwork to make sure it happens, frankly $2K is on the very low side of the cost of getting an invoice paid. Commercial non-free software is "put up with" where its not that some rando piece of required software costs $50 thus the cost of the company including labor and overhead is $2050 and they're happy to pay it, its more similar to if you don't dot all the Is and cross all the Ts that software will cost $10M in some crazy lawsuit, and $2050 is cheaper than $10M, so they pay up or they'll get a huge lawsuit or more likely someone will get fired after the audit, and I'd rather pay $2050 for something worth $50 if it prevents me from getting fired and better yet its not my $2050. But nobody never got fired for not paying for urllib3, so nobody's paying urllib3. Companies will pay for support and I could see a large company paying $10K/yr for a written guarantee if a dev at that company runs into a use problem or bug with urllib3 then an actual dev from the project will help them up to twenty hours per year or similar, even if no one asks for help. In contrast feel good donations are very expensive so they don't happen often, so trying to run a business off feel good donations doesn't work too well..
    - dotancohen 4y ago
      Could this be outsourced? I could create a tool - or a suite of tools - to parse e.g. a Python, PHP, Javascript (Node), Java, or other codebase and determine the dependencies. Hell, the requirements.txt file would probably be enough. Maybe I'll manually see how they use Linux, Firefox, LibreOffice, Anki, Inkscape, etc too. The company then cuts me - a reputable business that distributes funds fairly to open source projects - a check and I divvy it up, keep n% for myself, and distribute it to the projects and to the FSF. With enough clients some open source projects could see significant funds increases, and the companies would be alleviated of responsibility and worry. I could even issue "badges" to significant donors.
- jmbwell 4y ago
  (See what I mean?)
  - H8crilA 4y ago
    One internet complainer doesn't decide anything :)
- chlorion 4y ago
  Yeah open source is all about working for free for other people and not about anything else. We can read the story of why RMS came up with the idea of copyleft and it boils down to "I wanted to work for free for other people" and definitely not anything else.
SethMLarson 4y ago
I think it's less to do with a small number of companies making big donations like this, it'd be much nicer to have many organizations making even small contributions based on usage/complexity of the project. This is what Tidelift is trying to do, the biggest barrier to more projects getting the amount of funding that we do from them is the number of businesses wanting that sort of relationship with their open source dependencies. The amount we receive from Tidelift is not typical for most projects since we're a medium complexity project that is a part of almost every Python project dependency list.
jmbwell 4y ago
> Surely some MBA people can turn this around. Surely some MBA people are the ones driving currently, so you're probably not wrong, but you and I might share different outlooks on anything turning around. I believe we're expected to be grateful that there was any donation at all.
thn-gap 4y ago
That's still $20k above what they have to pay for the right of usage of the library. What donation amount above would you consider reasonable? Or how would you budget Spotify's donation accross all open source projects that they use? You can dual-license to avoid comercial exploitation. Why then set an expectation on how much should be donated for complete open source projects?
- gnramires 4y ago
  Well, I think it depends on the project itself. If they are asking for money, then they probably need money! See: https://liberapay.org https://liberapay.org (and also patreon.com has a number of projects) The idea is that people that can give would give, and those that can't won't. And who can give can also choose how much they think the project is valuable and how much maintenance it needs. Hopefully that would be covering the needs of the developers at a fair salary. It would be nice if open source projects were more transparent about this as well: "I need X/month to reach a fair salary and good maintenance, and could expand, hire devs and add functionality for Y/month." (milestones in patreon partially fulfill that role). The problem is when there are others that rely on the work as well. How much should each give, such that the system would be fair? From a theoretical perspective, I think the money should be always coming from the source with the lowest marginal counterfactual return. That is, the organizations who have funds going to investors and other orgs with the lowest ROI should instead divert those funds to [something else], where [something else] is OSS in this case, until an equilibrium is reached and everywhere is operating at equal and optimal ROI. In practice things are not so easy. And this analysis (and financial analysis) tends to only value economic ROI, where we should be thinking of social ROI as well as environmental ROI. But to give a rule of thumb, for now, I think it would be reasonable to pay (a) if it is less than a % of the (internal) project cost: a % of the budget of the OSS project, depending on how valuable it is internally (say, 50% if their budget is low, or just 1% if their budget is high); (b) a % of the (internal) project cost otherwise (e.g. at most 5% of project cost). Ideally there would be some kind of system or framework to streamline this sort of evaluation and allocation to the devs. I actually think a whole complementary economic system (i.e. enhancing capitalism or socialism) should be developed around this idea. We should be paying whomever is providing value to society, according to their needs to provide this value (and also give them a good life of course! -- and provide a reward/incentive to do valuable things, even ones that don't currently have an incentive). So some kind of organizations, that could be tied to companies or governments too, would be responsible for evaluating on a reasonably objective basis which projects need money and then allocating it (sort of as an outsourcing of the resource allocation job to specialized entities). But meanwhile individual and voluntary giving is basically that without outsourcing. I try to do this personally through Effective Altruism (which is essentially just that: give effectively) and giving what I can to Open Source and other impactful causes.
eptcyka 4y ago
Spotify doesn't pay silicon valley wages in Sweden.
UntrimmedDisk 4y ago
Spotify did an episode of their Development podcast that touched on this recently. I thought it was quite interesting. https://open.spotify.com/episode/0erUH7oqqbW5HDUjcnK6cb?si=qO3_PyW-TimP9royOzrdXQ https://open.spotify.com/episode/0erUH7oqqbW5HDUjcnK6cb?si=q...

robertlagrant 4y ago

Tidelift exists. I don't know why it's not more widely used.

hobofan 4y ago
Because it is and has always been intransparent about earnings structure (e.g. what percentage of money of a Tidelift subscription is paid out to maintainers), and thus has never achieved critical mass among maintainers. It also seems like they have mostly pivoted away towards software supply-chain analytics.

beernet 4y ago

Oh well, if you want money you shouldn't opt for open source in the first place...

wiseowise 4y ago
That’s not the point.
H8crilA 4y ago
Yes of course, but there's value in this approach for everyone. Look at Linux for example, there's a real benefit for various orgs in creating and funding a foundation to further the kernel project. It's not that I think these libraries should get something like a fair market value for their product, just a rather small (for a multibillion corp) donation plan. It's worth it for the PR / virtue signalling alone.
- VLM 4y ago
  Donations can be very expensive to a large company. The labor cost is often huge. If you don't prevent fraud at the $500 level you'll have two problems: Lots of repeated fraud at the $500 level, and people trying to get away with fraud at the $5000, $50000, all the way up to FTX levels of fraud. So you need multiple people in different depts to agree to fund something while other people watch over to make sure the people being funded are not the spouses or shell companies of the approvers. Meanwhile there's paperwork costs to make sure the donation paperwork gets to accounting so accounting gets their tax deduction. At a "really big company" the labor cost of paying an invoice might be $2000. Now does the average programmer get more than $2K of annual value out of urllib3, given the alternatives (which could involve up to architecting around needing it?) Before you laugh and say "no way" to the $2K figure, imagine spending half of an hour long team meeting of ten software devs getting paid $100/hr but overhead etc costs the company $150/hr for them to attend that meeting, that's $750 of labor costs just to have the dev team possibly agree to support urllib3. Then its got to go up the chain to someone with signing approval, someone has to chase the paperwork to make sure it happens, frankly $2K is on the very low side of the cost of getting an invoice paid. Commercial non-free software is "put up with" where its not that some rando piece of required software costs $50 thus the cost of the company including labor and overhead is $2050 and they're happy to pay it, its more similar to if you don't dot all the Is and cross all the Ts that software will cost $10M in some crazy lawsuit, and $2050 is cheaper than $10M, so they pay up or they'll get a huge lawsuit or more likely someone will get fired after the audit, and I'd rather pay $2050 for something worth $50 if it prevents me from getting fired and better yet its not my $2050. But nobody never got fired for not paying for urllib3, so nobody's paying urllib3. Companies will pay for support and I could see a large company paying $10K/yr for a written guarantee if a dev at that company runs into a use problem or bug with urllib3 then an actual dev from the project will help them up to twenty hours per year or similar, even if no one asks for help. In contrast feel good donations are very expensive so they don't happen often, so trying to run a business off feel good donations doesn't work too well..
  - dotancohen 4y ago
    Could this be outsourced? I could create a tool - or a suite of tools - to parse e.g. a Python, PHP, Javascript (Node), Java, or other codebase and determine the dependencies. Hell, the requirements.txt file would probably be enough. Maybe I'll manually see how they use Linux, Firefox, LibreOffice, Anki, Inkscape, etc too. The company then cuts me - a reputable business that distributes funds fairly to open source projects - a check and I divvy it up, keep n% for myself, and distribute it to the projects and to the FSF. With enough clients some open source projects could see significant funds increases, and the companies would be alleviated of responsibility and worry. I could even issue "badges" to significant donors.
jmbwell 4y ago
(See what I mean?)
- H8crilA 4y ago
  One internet complainer doesn't decide anything :)
chlorion 4y ago
Yeah open source is all about working for free for other people and not about anything else. We can read the story of why RMS came up with the idea of copyleft and it boils down to "I wanted to work for free for other people" and definitely not anything else.

SethMLarson 4y ago

I think it's less to do with a small number of companies making big donations like this, it'd be much nicer to have many organizations making even small contributions based on usage/complexity of the project. This is what Tidelift is trying to do, the biggest barrier to more projects getting the amount of funding that we do from them is the number of businesses wanting that sort of relationship with their open source dependencies. The amount we receive from Tidelift is not typical for most projects since we're a medium complexity project that is a part of almost every Python project dependency list.

jmbwell 4y ago

> Surely some MBA people can turn this around. Surely some MBA people are the ones driving currently, so you're probably not wrong, but you and I might share different outlooks on anything turning around. I believe we're expected to be grateful that there was any donation at all.

thn-gap 4y ago

That's still $20k above what they have to pay for the right of usage of the library. What donation amount above would you consider reasonable? Or how would you budget Spotify's donation accross all open source projects that they use? You can dual-license to avoid comercial exploitation. Why then set an expectation on how much should be donated for complete open source projects?

gnramires 4y ago
Well, I think it depends on the project itself. If they are asking for money, then they probably need money! See: https://liberapay.org https://liberapay.org (and also patreon.com has a number of projects) The idea is that people that can give would give, and those that can't won't. And who can give can also choose how much they think the project is valuable and how much maintenance it needs. Hopefully that would be covering the needs of the developers at a fair salary. It would be nice if open source projects were more transparent about this as well: "I need X/month to reach a fair salary and good maintenance, and could expand, hire devs and add functionality for Y/month." (milestones in patreon partially fulfill that role). The problem is when there are others that rely on the work as well. How much should each give, such that the system would be fair? From a theoretical perspective, I think the money should be always coming from the source with the lowest marginal counterfactual return. That is, the organizations who have funds going to investors and other orgs with the lowest ROI should instead divert those funds to [something else], where [something else] is OSS in this case, until an equilibrium is reached and everywhere is operating at equal and optimal ROI. In practice things are not so easy. And this analysis (and financial analysis) tends to only value economic ROI, where we should be thinking of social ROI as well as environmental ROI. But to give a rule of thumb, for now, I think it would be reasonable to pay (a) if it is less than a % of the (internal) project cost: a % of the budget of the OSS project, depending on how valuable it is internally (say, 50% if their budget is low, or just 1% if their budget is high); (b) a % of the (internal) project cost otherwise (e.g. at most 5% of project cost). Ideally there would be some kind of system or framework to streamline this sort of evaluation and allocation to the devs. I actually think a whole complementary economic system (i.e. enhancing capitalism or socialism) should be developed around this idea. We should be paying whomever is providing value to society, according to their needs to provide this value (and also give them a good life of course! -- and provide a reward/incentive to do valuable things, even ones that don't currently have an incentive). So some kind of organizations, that could be tied to companies or governments too, would be responsible for evaluating on a reasonably objective basis which projects need money and then allocating it (sort of as an outsourcing of the resource allocation job to specialized entities). But meanwhile individual and voluntary giving is basically that without outsourcing. I try to do this personally through Effective Altruism (which is essentially just that: give effectively) and giving what I can to Open Source and other impactful causes.

eptcyka 4y ago

Spotify doesn't pay silicon valley wages in Sweden.

UntrimmedDisk 4y ago

Spotify did an episode of their Development podcast that touched on this recently. I thought it was quite interesting. https://open.spotify.com/episode/0erUH7oqqbW5HDUjcnK6cb?si=qO3_PyW-TimP9royOzrdXQ https://open.spotify.com/episode/0erUH7oqqbW5HDUjcnK6cb?si=q...