10 ms·

Sponsor the open source projects you depend on

358 points by LorenDB 4y ago

Ycros 4y ago
This feels like it should be a charity or a non-profit entity.
- armini 4y ago
  There's already a lot of foundations that haven't been able to scale the process of paying thousands of developers due to tax & employment issues across the globe. We think creating the right commercial incentives would have a better chance but we might also be wrong. Time will tell...
bombolo 4y ago
Why use this instead of liberapay.com?
EvgeniyZh 4y ago
For this to work well, they need to get more devs on board (and more language support I guess). Currently none of my top-10 projects are there
angelgonzales 4y ago
I’d love too but I dislike using payment processors as middlemen for online transactions! I see you’re using Stripe which is one of the worst processors because they opaquely block all sorts of transactions. It would be great to use a system like this to promote and fund open source projects and fuel cottage industry without having to include megacorporations. Make a mail cash option for people who don’t want to show their papers to a payment processor!
- armini 4y ago
  thanks for the feedback & you raise a valid point, we'd love to look at additional payment options :)
  - ly3xqhl8g9 4y ago
    Thought about this in a conceptual way some years ago [1] and the best option seems to be to let the developers decide how they want to be paid, i.e. have a `thanks.dev` file in the tree of the package with JSON-like data, e.g. "payment": "iban", "data": "IBANCODE"` or "payment": "link", "data": "https://..." or "payment": "cryptoCoin", "data": "0xb3..." and so forth. Of course, the problem is there are many different ways of giving thanks, so a protocol is required, that's the hard part actually in this space, standardization. [1] https://github.com/ly3xqhl8g9/delicense https://github.com/ly3xqhl8g9/delicense
    - buro9 4y ago
      The best case is that this works. The worst case here is a lot of fraud for the people who shared their details.
      - ly3xqhl8g9 4y ago
        Why would there be fraud? The IBAN/payment link/crypto wallet/etc. is only one way: anyone can deposit, only one can withdraw. Everyone knows the IBAN for donating to Greenpeace, but only one can sue them [1]. As for the file itself, not being changed by a third party, the distributing program can check hashes of current payment method vs. previous and notify accordingly. [1] https://www.greenpeace.org.uk/news/succession-greg-sue-greenpeace-inheritance https://www.greenpeace.org.uk/news/succession-greg-sue-green...
        buro9 4y ago
        https://www.theguardian.com/money/2008/jan/07/personalfinancenews.scamsandfraud https://www.theguardian.com/money/2008/jan/07/personalfinanc... these things are still possible, you don't even have to know as much detail as this person gave out
        ly3xqhl8g9 4y ago
        Funny, but that seems more of a mistake on the bank side, and given that the article is from 2008, I am not surprised. Lots of things went wrong in 2008 on the banks side. Nevertheless, in principle, having a public IBAN is harmless.
- matheusmoreira 4y ago
  > Make a mail cash option for people who don’t want to show their papers to a payment processor! Consider using Monero for such a purpose. I've gotten paid in Monero. It pretty much just works.
muppetman 4y ago
At first I thought "Oh another Patreon/Open Collective" but actually this is kinda neat in how it works. Slightly offtopic, but every month when my Patreon donations get processed Patreon sends me this STUPID email with "Tweet your receipt!" Honestly, it's so pathetic. It's like giving food to a homeless person while filming it so I can post it on Twitter. Yes I realise it's an option and I don't have to (nor do I) click it.
- armini 4y ago
  thanks for taking the time to study how thanks.dev works & taking the time to write about it. Here's a recent article that was also published about how we're different https://www.theregister.com/2023/04/07/thanksdev_open_source_funding/ https://www.theregister.com/2023/04/07/thanksdev_open_source...
throwaway888abc 4y ago
Love this! Hope it will take off. "Webpack receives close to $200k in funding per year via OpenCollective but its direct dependencies receive minuscule amounts of funding, and there are 80+ of them." ♥
- armini 4y ago
  thanks for the support, let's hope we find the source code for open source success! :)
- mongol 4y ago
  First emoji I have seen on HN. I thought it was not possible to use.
  - deleted 4y ago
    [deleted]
  - 4ggr0 4y ago
    That's probably because it's an ASCII symbol[0] ♥ Emojis are Unicode, not ASCII (I think, not an expert myself). We should also be able to use arrows ⇒, the trademark symbol ™, whatever this is ∴, or maybe this ℜ. But we can test it, maybe HN supports Unicode Emojis but nobody is using them... EDIT: I was listing some Unicode Emojis here, but you were correct, they were removed after posting. At least the ASCII symbols show up :) [0]https://www.ascii-code.com/html-symbol https://www.ascii-code.com/html-symbol
hardwaresofton 4y ago
We're trying to do this @ NimbusWS, but the corporate way. Excuse the crappy looking site (been busy trying to actually deliver all the shit on that page), but I believe that F/OSS can be sustainable: https://nimbusws.com/#sustainability https://nimbusws.com/#sustainability All it takes is contributing a small % of revenue back. I'm not decided that 10%-30% will be the final # (can a business give that much and still compete?), but then also some of me feels that it should actually flip at some point (30% for nimbus, 70% for F/OSS project) if most of the value is actually the F/OSS project (i.e. the project is so high quality that all we do is mostly run it and upgrade it happily). Right now only the Redis service is available (object storage is coming soon (tm)), but kick the tires: https://nimbusws.com/app https://nimbusws.com/app (register @ the bottom!) One thing we haven't figured out is how to pay library authors. dunno what to do, but early idea is some % contribution and letting people calculate allotment (ex. 5% of your 20% revenue donation must go to libs, but you pick which libs you depend on get the most).
- myself248 4y ago
  Much admiration for your stance on giving back. Much confusion that this domain isn't for the Nimbus weather station. Ah, the cloud! Is there anything it can't do?
  - hardwaresofton 4y ago
    > Much admiration for your stance on giving back. Thanks for the kind words -- I do have to make it real, and make sustainable profit first before my aims mean anything, but at least I think I'm pointing in the right direction. > Much confusion that this domain isn't for the Nimbus weather station. > Ah, the cloud! Is there anything it can't do? Well looks like there might be a name change in the future... That might be a legitimate confusion point. TIL of the nimbus weather station: https://www.rainbird.com/golf/nimbusii https://www.rainbird.com/golf/nimbusii It's like a Bloomberg Terminal for weather...?
- eastbound 4y ago
  Concerning soending, open-source contributors are not employees. They do contribute to business, but wouldn’t do what you need if you needed it, like fixing vulnerabilities. There should be the same difference as between standard on-the-shelf products and custom products made for the industry, that fit a particular purpose.
ianlevesque 4y ago
I really want someone to succeed at this and I like the approach but you need to run not walk to making it usable without private source code access. That’s a non-starter.
- armini 4y ago
  Absolutely fair point & this is something we're working on to open source. If you'd like to join the community feel free to join our discord https://discord.gg/fQGqvQdWxq https://discord.gg/fQGqvQdWxq For context sponsorships & donations have tax implications in different geographic & implications for our community. We're working to get better clarity on these points with our beta users.
bee_rider 4y ago
So it looks like the idea is it goes through your GitHub dependencies, and splits your donation up among them. That’s a pretty neat idea. I wonder if it would be possible or even desirable to try and get some automatic measure of “how much” you depend on a given project, to weigh the split. Probably that would be really difficult to capture. Anyway the current idea is already pretty cool.
- dtolnay 4y ago
  Not automatic, but it already supports a measure of "how much" you depend on a project: boosting. You can boost dependencies up or down by up to a factor of 20 (e^3). The formula is explained in https://thanks.dev/static/how https://thanks.dev/static/how.
- jamietanna 4y ago
  I've been working on this idea (https://www.jvt.me/posts/2022/06/01/idea-supply-chain-monetisation/ https://www.jvt.me/posts/2022/06/01/idea-supply-chain-moneti...) recently as part of https://dmd.tanna.dev https://dmd.tanna.dev where you can get a meaningful idea of how much your projects use different dependencies, such that you'd be able to feed in a more meaningful weighting of "how much I use that dependency"
  - bee_rider 4y ago
    Regarding the post generally, using the problem of “how should I re-distribute my donations” to help solve the problem of “am I actually willing to be part of your software supply chain or am I just a hobbyist project, good luck using my code” seems like a nice way of hitting two birds with one stone.
holistio 4y ago
This finally feels like a solution to a problem we all knew we had.
- armini 4y ago
  thanks for the validation, it means a lot to us.
withinrafael 4y ago
Neat idea. Would it be useful to let folks analyze a repository without signing up? I'm thinking a user may want to scan a large repository and get a report (top X sponsor-enabled dependencies). This might be useful data to present during funding discussions.
- armini 4y ago
  I'm more than happy to help, just connect with me on https://discord.gg/fQGqvQdWxq https://discord.gg/fQGqvQdWxq we're currently doing this for a few presentations. It just depends on the ecosystem that specific org is managed under.
quickthrower2 4y ago
Nice idea. Like a personalized vanguard index for open source donations. If this takes off people will be inventivized to make lots of small dependencies that are likely to be needed in tier 1 (or tier 2). The trick will be to find a bug in a first dep of webpack for example, fork it and fix some bugs there then convince webpack to switch to you. Algorithmic decisions can be gamed. I suggest instead the app lists the deps, and you choose how much to give each one.
- armini 4y ago
  You're absolutely right. When you login you can actually see a list of dependencies & make your own adjustments. While thanks.dev makes a recommendation based on what's analysed, sponsors are able to boost or exclude beyond our recommendations. It's not perfect & has a lot of room to improve but we hope it's a good starting point :)
- qwerki 4y ago
  Thanks quickthrower2! Re gaming the system you're totally right. Although slightly unintuitive, we've also heard the opposite from maintainers. That they'll be motivated to remove the silly one line packages from their dependency trees due to the imbalance of value they provide vs extract. We also prune self dependencies, circular dependencies and a few other cases to keep things level. Hopefully we'll be at a stage to open source our codebase soon and can better leverage community feedback in this space :)
djaouen 4y ago
This is a great idea! Now I can finally pick a contribution level and have it automatically donate to my favorite projects. Thanks for building this!
- qwerki 4y ago
  Thanks for your kind words and trying it out @djaouen! Please don't hesitate to ping me if you need anything (email in profile).
koito17 4y ago
Genius idea. I try to donate to open source software I've used for long time, especially if I cannot contribute any code back. This site seems to automate the process of finding out which dependencies of your software are accepting donations. Unfortunately, I cannot use this right now, because Maven dependencies can't seem to be found, and neither can Cargo dependencies. I decided to test it with an app that uses a mix of ClojureScript and Rust. There is a shadow-cljs.edn file at the root level of the folder, but those dependencies are not picked up. Neither are stuff in a package-lock.json. There is a Cargo.lock file in a subfolder, but that does not seem to be scanned either. However, I am able to verify there exist dependencies, in each of these files, that are actively seeking for funding and use GitHub sponsors.
- qwerki 4y ago
  Hi Koito17 Thanks for trying it out! Are you able to ping me your github handle so I can get to the bottom of it (email in profile). Alternatively, for multi-project repos you can add a thanks.yaml file to the root of the repo with a `maxDepth: 2` value inside it. Unfortunately, deep scanning the entire repo looking for files would be prohibitive due to GH rate limiting hence this approach. Please keep me posted. I'm also available on Discord if you need anything.
  - koito17 4y ago
    Hi. First of all, thanks for the quick response, and more importantly, working on this cool idea! I see on the website that CLJS isn't supported; that's fine. But the NPM dependencies not being detected does intrigue me. I'm going to follow up with you on Discord if that's fine
    - qwerki 4y ago
      ♥
dewey 4y ago
It's still early for GitHub's Sponsor feature but I'm a bit surprised this is not part of it already. - They already understand what kind of code base it is and already do dependency scanning for security issues - They have payment details - They have the "verified" payment method of a person / project (If sponsoring is enabled)
- armini 4y ago
  I can't say much about Github but I can say that we're working to open source our project ;)
- asb 4y ago
  It looks like they are developing features in this general direction https://github.blog/changelog/2023-04-04-export-your-sponsorable-dependencies-and-sponsor-many-in-one-checkout/ https://github.blog/changelog/2023-04-04-export-your-sponsor...
  - dewey 4y ago
    Ah, I missed that blog post. Seems like only a matter of time until this is fully integrated.
Sephr 4y ago
The UI imposes a 5% minimum (and 15% default) value for "Tip thanks.dev" under "How much would you like to donate each month?" on https://thanks.dev/settings https://thanks.dev/settings This implementation is clearly for-profit. I want to directly tip open source projects using a system that doesn't involve other third parties taking a significant cut.
- armini 4y ago
  Absolutely appreciate & respect your perspective. We're passionate about making open source sustainable & understand that there can be multiple ways of achieving this goal. The more ways money is channeled to the community the better...
  - jeppester 4y ago
    I think it would be easier to defend taking a cut if the cut was calculated in the same way as for the dependencies, e.g. next.dev being automatically added to the list.
    - jeppester 4y ago
      Obviously I meant to write thanks.dev
- pharmakom 4y ago
  Maybe 5% is the wrong number, but how do you expect the lights to stay on?
  - coldtea 4y ago
    They could give the ability to sponsor their own service with donations in the exact same way they do it for third party FOSS projects.
    - robertlagrant 4y ago
      They're trying to solve the problem, not add to it.
tra3 4y ago
How do I convince the management that it's worth spending a fraction of what 1 developer costs to give back to OSS?
- paulddraper 4y ago
  How do I convince you? ;)
- noisy_boy 4y ago
  Make it as organized/structured as possible. Go through the social initiatives arm of the firm, if they are big enough to have one. To them "our social responsibility initiatives" or "open source community contributions" sounds better and webpage-worthy than "we pay project X, Y and Z" (even though that is basically what it boils down to). On the other hand, for a smaller firm, this might probably be just a one-to-one talk/convincing an executive. If you can't convince one, try another. If you can't convince any, take it as a flag with the color of your choosing.
- armini 4y ago
  I'd love to help you build out that business case & open source it. Let me know if you're interested https://discord.gg/fQGqvQdWxq https://discord.gg/fQGqvQdWxq We're also started sharing interviews with maintainers who talk about the people aspect of what this funding means to them https://www.youtube.com/@thanks_dev https://www.youtube.com/@thanks_dev
- pabs3 4y ago
  Tell them it is risk management; funding OSS ensures that projects you depend on will exist as OSS into the future and hopefully have less bugs and security problems. For example: https://anonymoushash.vmbrasseur.com/2022/10/27/open-source-relicensing-business-risk https://anonymoushash.vmbrasseur.com/2022/10/27/open-source-...
TrueCarry 4y ago
I've thought about exact same thing for a long time. Except instead of just analyzing dependency list, create plugin for vscode/npm/etc and analyze how much each dependency is really used by you. Great that somebody finally built tool like that, good luck!
animesh 4y ago
I just started using GitHub Sponsor for some repos. How is this different?
- qwerki 4y ago
  Hi Animesh! The biggest difference would be that TD answers both "who should I sponsor AND how much?". It continually calculates the weight of each dependency in your codebase and distributes your monthly budget accordingly. The next biggest difference is that it distributes micro-payments up to 3 levels deep into the dependency tree. We've noticed majority of people sponsor the top of mind projects, but the deep nested dependencies don't get any love. This automated approach should fix that. Don't hesitate to ping me if you have any other questions please (email in profile).
  - animesh 4y ago
    Thank you for the clarification. I will consider it in a near future.
paulddraper 4y ago
Plot twist: This was the endgame of all those 1000s of trivial npm packages.
- toastal 4y ago
  Why Array.isArray() when you can require("isarray").isArray()? (Node.js 0.10.0, Fx 4.0) deep-equal has 43 packages (& 17m weekly downloads) that are mostly (is|has)-* packages or redundant wrappers like for-each and object-keys (https://npmgraph.js.org/?q=deep-equal https://npmgraph.js.org/?q=deep-equal) and you’ll find this package included in a lot of upstream libraries. Ask for a banana and get a gorilla and forest... Luckily many have moved to fast-deep-equal (0 dependencies), but there are a lot of other examples of this sort of thing.
nnurmanov 4y ago
I created openlist.dev, where developers could add small banners of products they love to their GitHub profiles and get paid if users click the banner. Looking for companies to become early users
test1-test1 4y ago
The dependencies(open source libraries) will figure out a way to game the system. I don't know how but maybe someone will try.
- armini 4y ago
  More money in the ecosystem will naturally create more competition but I’m sure the community will adapt & evolve accordingly. There’s no shortage of smart people in this space.
buro9 4y ago
I'm on the receiving end of donations from sourcegraph using this. It's around $10 per month from that single donation and is for the only Go HTML santizer, which you use when you have user generated / untrusted input that you need to display as HTML. https://github.com/microcosm-cc/bluemonday https://github.com/microcosm-cc/bluemonday For me the library has been good enough for my own use for a very very long time. I mostly neglect it unless there's some critical issue (which there hasn't been for a very long time — but clearly infosec world knows this lib exists as when I do make changes with crap commit messages I get emails asking what the implications are). I don't improve it at all as my time is better spent on my day job. I've often thought that there's room for improvement such as a DOM style sanitizer to validate HTML input rather than just a SAX style sanitizer, perhaps formatting of output in addition to sanitising input, transformation rules to allow a safe embedly type thing, etc. When I got the initial donation I was surprised, first ever bit of support for open source software I'd written (as this was not written on company dime). Even at $10 per month it is motivating enough to think someone values it. If it accrues into something significant then I may actually feel motivated to improve it rather than just support it. Interesting is that I'd regard this OSS lib as successful by usage as sourcegraph says 803 projects use it — but given that a fair number of those are things like Hugo which in turn have thousands of forks and many more thousands of instances of use, well it does appear that this sanitizer is to safe HTML in Go what https://xkcd.com/2347/ https://xkcd.com/2347/ illustrates. Originally it was written for my own use and it's now used by virtually everything in the Go world that makes a website. Perhaps people don't know this and libraries like it exists though? Perhaps they import some web framework and this came with it? Well, for that awareness thank you to thanks.dev Of the models I've seen so far for supporting individuals who create OSS code this one stands out by highlighting dependencies. Likely the solution is a blend of things... a commission type system for rare engineers and skills (i.e. https://words.filippo.io/pay-maintainers/ https://words.filippo.io/pay-maintainers/ ) and thanks.dev for the long-tail of those who have done things and you want to use it long-term. There are also companies who create OSS software, and if you value their work and don't want what they produce to go behind Enterprise differentiation then perhaps pay for their services too.
- armini 4y ago
  reading this comment made my day :) thanks for your contributions to open source, the least we could do is recognise & reward you for your work. What people often forget is the people aspect of open source. I've done countless interviews with open source maintainers & you are all just awesome https://www.youtube.com/@thanks_dev https://www.youtube.com/@thanks_dev it's a pleasure working with you & I love hearing your stories
aborsy 4y ago
I use like 50 different software heavily. Each of these has like tens of developers. I can donate to some and rotate each month, but how about the rest, and dependencies?
- armini 4y ago
  Good point, using thanks.dev you can adjust to scan multiple levels into the dependency tree. That ensures you can reach as many people as possible.
aborsy 4y ago
I use like 50 different software heavily. Each of these has like tens of developers. I can donate to some and rotate each month, but how about the rest, and dependencies? There is just so much software there that seems hopeless (although there are also billions of users).
- pabs3 4y ago
  IIRC the model of thanks.dev ensures that those dependencies get some money too.
- junon 4y ago
  That's actually how most of my donations on Thanks come from - being a dependency of something the person donates toward.
- qwerki 4y ago
  Our take on this is that funds should distribute across the dependency tree. We currently facilitate trickling your budget 3 levels deep. https://thanks.dev/static/how https://thanks.dev/static/how covers this in more detail.
  - robertlagrant 4y ago
    That seems like a pretty sensible way of doing things. I wonder: will people find a way to exploit it? E.g. create a simple but useful dependency that uses 100 sub-dependencies, all by the same author? Will larger, more self-contained dependencies lose out to small ones?
- jillesvangurp 4y ago
  Exactly. Many OSS developers work for free. Myself included (I develop some OSS software). And the way I try to be a good OSS citizen is by being constructive and supportive in various OSS communities I care about. You're not going to get my money. But you might get my time, attention, and skills. For free. The way the OSS communities works is not money but value creation. There are all sorts of value people get out of creating things for each other. People like the recognition and appreciation they get for their work, the satisfaction they get out of doing a thing, the interactions with others, etc. Plenty of ways to get value from creating stuff for others. And sometimes people actually get paid directly or indirectly to work on a thing. It's fine. I'm not against that. Just don't expect/demand me to pay for a thing. And I won't do so either. That simple promise is why OSS works. We both end up getting some value if we work together. And we might even get paid indirectly. For example I have a consulting career and I dabble in startups. So my motives are not entirely altruistic.
pabs3 4y ago
There are several similar services out there, some of them are listed in the patronage section of the FOSSjobs wiki: https://github.com/fossjobs/fossjobs/wiki/resources#patronage https://github.com/fossjobs/fossjobs/wiki/resources#patronag...
- armini 4y ago
  Thanks for sharing this link, there’s a lot of useful content in here for people interested in this space.
pabs3 4y ago
Would be interesting if you could use code coverage tests to weight your donations to dependencies.
- armini 4y ago
  Thanks for taking the time to share this idea. We have added it to our drawing board.
pabs3 4y ago
What are everyone's budgets (corporate or otherwise) for paying for open source work?
hvasilev 4y ago
You open source guys need to figure out a way to charge people for the value that you provide. You ran the experiment for a very long time and it looks like this "beggar" model really doesn't seem to be working for the vast majority of your projects. Take money, don't wait for people to give you money for the free value that you provide.
- antupis 4y ago
  I think paid feature requests/support is way to go.
- armini 4y ago
  I’m actually optimistic about the progress & shift in behaviour. There’s a few companies that are setting a clear example & leadership in this space like Sentry, sourcegraph & cash app who genuinely want to help improve the ecosystem.
- pabs3 4y ago
  I'm sure plenty of folks would be happy to send invoices to people that want them :)
- heipei 4y ago
  This 100%. I run a German limited company (GmbH) and I can't just send money somewhere without a proper invoice. I've even had issues with paid services (think VPN providers etc) that don't send out invoices, so then I'm stuck with an expense that I can't deduct as a business expense. Make sure you can issue correct invoices, and let potential customers know upfront!
Ndymium 4y ago
I love and support this idea very much. I had actually been thinking about this exact solution myself, but I'd personally want to stay clear of anything involving real money, so it's great that you're doing it. :) Just a note which probably isn't worth your time to act on, but using this service as a maintainer in Finland is illegal unless you can offer a geoblocking feature that can block any Finnish supporters from routing money to Finnish maintainers. This is due to our Money Collection Act which prohibits soliciting any donations except for very strict circumstances which aren't really applicable here. Might be worth a note on the page if you have extra time, since this is not know by many Finns that I've talked to.
- armini 4y ago
  Thanks for raising the issue. Is it okay for you to forward the funds to other people in the ecosystem?
  - Ndymium 4y ago
    Not sure if you're assuming that I am using the service with the wording "for you" or if it's a general question (I'm not a user). But if it's a general question, legally speaking, my best guess (not a lawyer) is that it would be perfectly legal to make a maintainer account to forward the funds to other projects, since you are not receiving anything. I guess you know if a feature like that is worth the trouble to implement.
    - armini 4y ago
      That’s good because maintainers who receive funds can forward it to others or even send it to an open collective. That helps keep the money circulating in the ecosystem.
progx 4y ago
You should order the people list, so that maintainer / repo owner come first.
- armini 4y ago
  Yeah good point. We should have it done soon.
villgax 4y ago
Governments should do this even on outsourced contracts
- armini 4y ago
  There’s a few initiatives being discussed already https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/ https://www.whitehouse.gov/briefing-room/presidential-action...
aboodman 4y ago
Awesome to see someone try and do this! I was kicking the idea around a few years ago but got sidetracked: https://github.com/tythe-protocol/tythe https://github.com/tythe-protocol/tythe.
- armini 4y ago
  wow! love the fact that you had also considered coinbase payment integration. really neat..
nicbou 4y ago
Donation income is risibly small. People will sign praise your work, tell you how much they depend on it, and how it changed their lives. Others will ask you tricky questions that really ought to be asked to a lawyer. ...and they still won't donate a cent. I get about 70 cents per thousand unique visitors. About one in every 14,000 visitors donate. Affiliate income is roughly 100 times that without trying. Let me put it differently: with the same traffic, donations barely cover my groceries, and affiliate income is a comfortable salary. I'm at peace with that. I make free things for a reason. It's just something to keep in mind when suggesting donations as a business model. Doubly so as an alternative to ads. Another tidbit: praise people who create the things you use. It feels so good to know that people use and love the fruits of your labour. I've become lavish in my praise after experience the effects of it.
- agrimonyhal 4y ago
  If many open projects are funded via ads, will Copilot tools crater open source revenues by reducing traffic to documentation?
  - nicbou 4y ago
    Most projects aren't funded at all.
- popey 4y ago
  Depends how you present it. The Ubuntu download page used to punch you in the face asking for donations. They also tried sliders, asking downloaders to choose how to spend the money they donated. These were super successful. People felt in control of how their money was spent. There was no way for them to check in on that, it was a trust process. But the net result was a lot of people donated a very significant amount of money. Similarly I understand (from an interview with the developer) that the eBook software Calibre gets a significant number of donations from users via the giant donate button in the toolbar. I do agree, having a "tip jar" option for donations is rarely as successful as the above methods though. Not diminishing your personal experience. Just saying it's possible to change the way things are done, and get more.
rekoil 4y ago
Is it possible to scan a repo without authorising your service access to my entire Github account?
- armini 4y ago
  Sure, send us a DM on our discord. We'd love to help.
Canada 4y ago
I see nothing but a blank page. Firefox and Chrome.
- armini 4y ago
  Sorry we had a slight outage due to HN traffic load but things are stable & back to normal.
jamietanna 4y ago
Folks may also be interested in checking out https://stackaid.us https://stackaid.us (previous discussion https://news.ycombinator.com/item?id=32837829 https://news.ycombinator.com/item?id=32837829) as a different platform doing similar work
- marginalia_nu 4y ago
  Seems to like this fan the flames of is-even[1] type spam dependencies even more . [1] https://www.npmjs.com/package/is-even?activeTab=code https://www.npmjs.com/package/is-even?activeTab=code
- nwellnhof 4y ago
  Tidelift also has a similar program: https://tidelift.com/about/lifter https://tidelift.com/about/lifter But dependency tracking is hard and all of these platforms only scratch the surface. For example, I've never seen a solution that detects C libraries used from other languages, let alone the dependencies of these libraries. Then there are build-time dependencies which are hard to detect. Here's an example of a complex dependency chain: redmine -> ruby-commonmarker -> libcmark -> re2c Wake me up if someone offers a solution that detects chains like that.
lars_francke 4y ago
In case you hadn't seen this yet, GitHub offers this service: https://github.com/sponsors/explore https://github.com/sponsors/explore (need to be logged in) I have no insight but I could imagine that GitHub are going to offer something similar based on that data at some point in the future. For us the "top" developers on that page are people with 150+ repos that we depend on that I have never head of before. It turns out that they are all tiny JavaScript libraries that we depend on in some repository that's not part of our real product. I'm happy to sponsor them as well but it'd be cents not euros per month compared to libraries that do the "heavy lifting" for us. At the moment we hand-pick things, also not ideal. All of that text to say: This is a hard problem, I have no idea how to solve it but I applaud you and everyone who's giving it a shot. A 5% flat fee is too much for me though, if it had a cap then it'd be different.
- armini 4y ago
  If you have the time, we’d love to connect with you on our discord & learn more about your experience. It’s a hard problem & that needs a strong open community. Given the recent PayPal incident, I don’t think GitHub should be the only solution.
  - lars_francke 4y ago
    I just joined. Not sure if I can offer much in terms of solutions, only problems :(
- robertlagrant 4y ago
  > A 5% flat fee is too much for me though, if it had a cap then it'd be different. It can't have a cap if payment gateway processing fees are percentage-based.
  - lars_francke 4y ago
    I do see your point but in this case _everyone_ pays the 5% even though the payout only happens once per project and the payment also only happens once per person donating. It might be that it is this expensive to run, I don't know. It just seems unfair to me that the platform would get 5% and "only" 95% are distributed to the projects. I do understand that everyone has a different definition of "fair" and I also don't know what I'd be willing to spend. It's something I'd need to think about.
theshrike79 4y ago
After Google shut down Google Reader I specifically went looking for an alternative I could pay money for and landed with Newsblur[0]. I've been a happy customer ever since. Pretty soon after that I moved over from Gmail to Fastmail[1], again it was a service that took my money so that I was the customer not the product being sold. [0] http://www.newsblur.com http://www.newsblur.com [1] https://fastmail.com/ https://fastmail.com/
- armini 4y ago
  Yeah a lot of people here question why we're charging a minimum 5% fee but fail to understand that we all need to make ends meet or else we will also be shut down in time.
aunty_helen 4y ago
I put 50$ in the pokey machine but it’s only paid it out to two projects? Some of the other projects which are missing out I already donate to. Any ideas?
- armini 4y ago
  Thanks for taking the time to register & donate. We’re looking into it now & we will send you a DM shortly.
- qwerki 4y ago
  Hi! Thanks for trying it out. I have reached out via email but just in case, looks like your account is configured for only first level dependencies. If you increase it to 3 levels it'll show much better results. You're also able to adjust the distribution of funds via boosting in the dependencies page. Please note the donation will be kept in PENDING state for 5 days to allow time for full dependency analysis, adjustments via boost and/or exclusions. In this time we'll be reaching out to the other projects in your dependency tree to onboard them. Please ping me if you need anything. Many thanks again!
  - aunty_helen 4y ago
    Ok thanks so much. I assumed first level dependencies were anything that would turn up in a requirements.txt so reduced it from the default. Thanks for building this and I'm looking forward to seeing how it develops. I will add my voice to the "allowing this service full access to my repos is uncomfortable" crowd, there's a couple of my clients that have stricter NDAs which has meant those repos have been excluded. But you'll figure that out when you do. Cheers and enjoy the product launch :)
djaouen 4y ago
Hopefully this is fixed soon, but now I just see a blank page when I go to the site. Is it this way for anybody else?
- armini 4y ago
  Sorry we had a slight outage but it should be working fine now.
noctis 4y ago
It might be a good idea to add auto splitting. I won't bother assigning each and every dependency an amount. Kinda like Xbox Game Pass or Setapp.
- armini 4y ago
  You're absolutely right. Some orgs have huge lists. We do suggest the split but it's rather subjective so we also provide the tools to let sponsors boots & exclude.
luckylion 4y ago
"Donation" is a somewhat tainted word, because it often has certain legal issues attached. Most maintainers aren't non-profits, so they don't take donations, they get income (and it'll get taxed). At the same time, "donating" something without it actually being a donation is complicated for businesses (e.g. github not invoicing me for sponsorships gets my tax consultants to make sad faces). I understand the idea, but giving it a better legal framework than "it's a donation. but not really" would definitely help.
- armini 4y ago
  I personally like to see companies sponsoring maintainers. We’re working to clarify that with the community is the terms have different value propositions & financial implications.
  - luckylion 4y ago
    "Sponsoring" is fine, but for business processes you need a paper trail where something gets invoiced somewhere. It doesn't matter for tiny amounts, but your accountant will want something to hand to the IRS if there's ever an audit. From what I understand, you're not 1:1 giving the money to some maintainer that's chosen but you'll distribute it according to code usage etc, so you won't be a payment provider, but it counts as revenue for you and you give the money to maintainers, right? Are you invoicing or do you go the github route?
sli 4y ago
A service that alleges to support open source projects and developers deciding to block VPN users sure seems like an interesting choice.
gehen88 4y ago
Is nobody concerned with the fact this tool scans your repository contents? This tool is mostly intended for use with private projects, not open source, so I would expect a LOT more scrutiny (and options) around security.
- armini 4y ago
  We are working to open source our project & we also have an api integration solution for those who prefer to only share their package files.
esclear 4y ago
One thing that I haven't seen addressed here or in the FAQ is: What happens to donations towards dependencies where the maintainer / organization / group of maintainers is not registered at thanks.dev? The FAQ has a section titled "What happens if I don’t claim my balance?", but I think this only applies to people registered at thanks.dev. I'm not even sure that thanks.dev would be able to reliably contact developers that / maintainers in all (most ?) situations.
- armini 4y ago
  great observation & questions, we will update that on our FAQ shortly. If users aren't registered then we can't verify who's project admin & no funds will be allocated to them from the sponsors pool. Only when an admin register then we can allocate funds.
  - esclear 4y ago
    Okay, to make my thought more explicit: If I decided to sponsor my project's dependencies with say 100 USD and none of the developers are registered with thanks.dev – which seems like a reasonable assumption, especially as thanks.dev appears to be a young project – I wonder what happens with the money. The money can't be allocated. Does thanks.dev just keep it? Is it "stored" until it can be allocated? And if this is the case: From the information on allocation it seems that all of the money will be distributed between all eligible developers (possibly 3 months after devs don't claim their balance)? If so, what if there is only one (transitive) dependency that is registered with thanks.dev?
toastal 4y ago
> You need to enable JavaScript to access thanks.dev. Not a great start for delivering me basic information on what this even is. Reminder that Microsoft GitHub and GitLab do not have a duopoly on decentralized (self-hostable) version control. Products like this feed into folks feeling compelled to join big, proprietary services.
deleted 4y ago
[deleted]
omneity 4y ago
The intention is laudable, but this kind of business model makes me think of all these NGOs appearing in the 90s/2000s purportedly to "help poor africans" [0,1]. While many have been (trying to) do their best, it's unfortunate that many got richer on the back of the people they were supposed to help. Sometimes with local accomplices who also benefit from the grift. I guess the main take away would be that transparency and accountability are paramount if you want to be part of such an ecosystem, especially as a middleman for money transactions. [0]: https://landportal.org/node/100425 https://landportal.org/node/100425 [1]: https://humanglemedia.com/the-dark-reality-of-corruption-lack-of-accountability-among-humanitarian-orgs-in-africa/ https://humanglemedia.com/the-dark-reality-of-corruption-lac...
deleted 4y ago
[deleted]
andrew_ 4y ago
I receive a very small amount of donations on this platform for my work. I have some projects out there that are used as a dependency by a few million people. Fwiw in just over six months I've received around $20 and haven't cached it out yet. I get email notices about a few cents here and there but haven't bothered to take the time to setup Stripe in order to withdraw.
kramerger 4y ago
Ahem... https://liberapay.com/ https://liberapay.com/ Platform owner are registered as devs, who you can tip like any other devs. Hence their "cut" is not taken automatically from every transaction
philistine 4y ago
I'm using Jekyll for my rinkidink website. Jekyll is the workhorse tool of Github. Github is owned by Microsoft, who's not hurting for cash, or so I've heard. What I'm saying is it depends.

358 points by LorenDB 4y ago

Ycros 4y ago

This feels like it should be a charity or a non-profit entity.

armini 4y ago
There's already a lot of foundations that haven't been able to scale the process of paying thousands of developers due to tax & employment issues across the globe. We think creating the right commercial incentives would have a better chance but we might also be wrong. Time will tell...

bombolo 4y ago

Why use this instead of liberapay.com?

EvgeniyZh 4y ago

For this to work well, they need to get more devs on board (and more language support I guess). Currently none of my top-10 projects are there

angelgonzales 4y ago

I’d love too but I dislike using payment processors as middlemen for online transactions! I see you’re using Stripe which is one of the worst processors because they opaquely block all sorts of transactions. It would be great to use a system like this to promote and fund open source projects and fuel cottage industry without having to include megacorporations. Make a mail cash option for people who don’t want to show their papers to a payment processor!

armini 4y ago
thanks for the feedback & you raise a valid point, we'd love to look at additional payment options :)
- ly3xqhl8g9 4y ago
  Thought about this in a conceptual way some years ago [1] and the best option seems to be to let the developers decide how they want to be paid, i.e. have a `thanks.dev` file in the tree of the package with JSON-like data, e.g. "payment": "iban", "data": "IBANCODE"` or "payment": "link", "data": "https://..." or "payment": "cryptoCoin", "data": "0xb3..." and so forth. Of course, the problem is there are many different ways of giving thanks, so a protocol is required, that's the hard part actually in this space, standardization. [1] https://github.com/ly3xqhl8g9/delicense https://github.com/ly3xqhl8g9/delicense
  - buro9 4y ago
    The best case is that this works. The worst case here is a lot of fraud for the people who shared their details.
    - ly3xqhl8g9 4y ago
      Why would there be fraud? The IBAN/payment link/crypto wallet/etc. is only one way: anyone can deposit, only one can withdraw. Everyone knows the IBAN for donating to Greenpeace, but only one can sue them [1]. As for the file itself, not being changed by a third party, the distributing program can check hashes of current payment method vs. previous and notify accordingly. [1] https://www.greenpeace.org.uk/news/succession-greg-sue-greenpeace-inheritance https://www.greenpeace.org.uk/news/succession-greg-sue-green...
      - buro9 4y ago
        https://www.theguardian.com/money/2008/jan/07/personalfinancenews.scamsandfraud https://www.theguardian.com/money/2008/jan/07/personalfinanc... these things are still possible, you don't even have to know as much detail as this person gave out
        ly3xqhl8g9 4y ago
        Funny, but that seems more of a mistake on the bank side, and given that the article is from 2008, I am not surprised. Lots of things went wrong in 2008 on the banks side. Nevertheless, in principle, having a public IBAN is harmless.
matheusmoreira 4y ago
> Make a mail cash option for people who don’t want to show their papers to a payment processor! Consider using Monero for such a purpose. I've gotten paid in Monero. It pretty much just works.

muppetman 4y ago

At first I thought "Oh another Patreon/Open Collective" but actually this is kinda neat in how it works. Slightly offtopic, but every month when my Patreon donations get processed Patreon sends me this STUPID email with "Tweet your receipt!" Honestly, it's so pathetic. It's like giving food to a homeless person while filming it so I can post it on Twitter. Yes I realise it's an option and I don't have to (nor do I) click it.

armini 4y ago
thanks for taking the time to study how thanks.dev works & taking the time to write about it. Here's a recent article that was also published about how we're different https://www.theregister.com/2023/04/07/thanksdev_open_source_funding/ https://www.theregister.com/2023/04/07/thanksdev_open_source...

throwaway888abc 4y ago

Love this! Hope it will take off. "Webpack receives close to $200k in funding per year via OpenCollective but its direct dependencies receive minuscule amounts of funding, and there are 80+ of them." ♥

armini 4y ago
thanks for the support, let's hope we find the source code for open source success! :)
mongol 4y ago
First emoji I have seen on HN. I thought it was not possible to use.
- deleted 4y ago
  [deleted]
- 4ggr0 4y ago
  That's probably because it's an ASCII symbol[0] ♥ Emojis are Unicode, not ASCII (I think, not an expert myself). We should also be able to use arrows ⇒, the trademark symbol ™, whatever this is ∴, or maybe this ℜ. But we can test it, maybe HN supports Unicode Emojis but nobody is using them... EDIT: I was listing some Unicode Emojis here, but you were correct, they were removed after posting. At least the ASCII symbols show up :) [0]https://www.ascii-code.com/html-symbol https://www.ascii-code.com/html-symbol

hardwaresofton 4y ago

We're trying to do this @ NimbusWS, but the corporate way. Excuse the crappy looking site (been busy trying to actually deliver all the shit on that page), but I believe that F/OSS can be sustainable: https://nimbusws.com/#sustainability https://nimbusws.com/#sustainability All it takes is contributing a small % of revenue back. I'm not decided that 10%-30% will be the final # (can a business give that much and still compete?), but then also some of me feels that it should actually flip at some point (30% for nimbus, 70% for F/OSS project) if most of the value is actually the F/OSS project (i.e. the project is so high quality that all we do is mostly run it and upgrade it happily). Right now only the Redis service is available (object storage is coming soon (tm)), but kick the tires: https://nimbusws.com/app https://nimbusws.com/app (register @ the bottom!) One thing we haven't figured out is how to pay library authors. dunno what to do, but early idea is some % contribution and letting people calculate allotment (ex. 5% of your 20% revenue donation must go to libs, but you pick which libs you depend on get the most).

myself248 4y ago
Much admiration for your stance on giving back. Much confusion that this domain isn't for the Nimbus weather station. Ah, the cloud! Is there anything it can't do?
- hardwaresofton 4y ago
  > Much admiration for your stance on giving back. Thanks for the kind words -- I do have to make it real, and make sustainable profit first before my aims mean anything, but at least I think I'm pointing in the right direction. > Much confusion that this domain isn't for the Nimbus weather station. > Ah, the cloud! Is there anything it can't do? Well looks like there might be a name change in the future... That might be a legitimate confusion point. TIL of the nimbus weather station: https://www.rainbird.com/golf/nimbusii https://www.rainbird.com/golf/nimbusii It's like a Bloomberg Terminal for weather...?
eastbound 4y ago
Concerning soending, open-source contributors are not employees. They do contribute to business, but wouldn’t do what you need if you needed it, like fixing vulnerabilities. There should be the same difference as between standard on-the-shelf products and custom products made for the industry, that fit a particular purpose.

ianlevesque 4y ago

I really want someone to succeed at this and I like the approach but you need to run not walk to making it usable without private source code access. That’s a non-starter.

armini 4y ago
Absolutely fair point & this is something we're working on to open source. If you'd like to join the community feel free to join our discord https://discord.gg/fQGqvQdWxq https://discord.gg/fQGqvQdWxq For context sponsorships & donations have tax implications in different geographic & implications for our community. We're working to get better clarity on these points with our beta users.

bee_rider 4y ago

So it looks like the idea is it goes through your GitHub dependencies, and splits your donation up among them. That’s a pretty neat idea. I wonder if it would be possible or even desirable to try and get some automatic measure of “how much” you depend on a given project, to weigh the split. Probably that would be really difficult to capture. Anyway the current idea is already pretty cool.

dtolnay 4y ago
Not automatic, but it already supports a measure of "how much" you depend on a project: boosting. You can boost dependencies up or down by up to a factor of 20 (e^3). The formula is explained in https://thanks.dev/static/how https://thanks.dev/static/how.
jamietanna 4y ago
I've been working on this idea (https://www.jvt.me/posts/2022/06/01/idea-supply-chain-monetisation/ https://www.jvt.me/posts/2022/06/01/idea-supply-chain-moneti...) recently as part of https://dmd.tanna.dev https://dmd.tanna.dev where you can get a meaningful idea of how much your projects use different dependencies, such that you'd be able to feed in a more meaningful weighting of "how much I use that dependency"
- bee_rider 4y ago
  Regarding the post generally, using the problem of “how should I re-distribute my donations” to help solve the problem of “am I actually willing to be part of your software supply chain or am I just a hobbyist project, good luck using my code” seems like a nice way of hitting two birds with one stone.

holistio 4y ago

This finally feels like a solution to a problem we all knew we had.

armini 4y ago
thanks for the validation, it means a lot to us.

withinrafael 4y ago

Neat idea. Would it be useful to let folks analyze a repository without signing up? I'm thinking a user may want to scan a large repository and get a report (top X sponsor-enabled dependencies). This might be useful data to present during funding discussions.

armini 4y ago
I'm more than happy to help, just connect with me on https://discord.gg/fQGqvQdWxq https://discord.gg/fQGqvQdWxq we're currently doing this for a few presentations. It just depends on the ecosystem that specific org is managed under.

quickthrower2 4y ago

Nice idea. Like a personalized vanguard index for open source donations. If this takes off people will be inventivized to make lots of small dependencies that are likely to be needed in tier 1 (or tier 2). The trick will be to find a bug in a first dep of webpack for example, fork it and fix some bugs there then convince webpack to switch to you. Algorithmic decisions can be gamed. I suggest instead the app lists the deps, and you choose how much to give each one.

armini 4y ago
You're absolutely right. When you login you can actually see a list of dependencies & make your own adjustments. While thanks.dev makes a recommendation based on what's analysed, sponsors are able to boost or exclude beyond our recommendations. It's not perfect & has a lot of room to improve but we hope it's a good starting point :)
qwerki 4y ago
Thanks quickthrower2! Re gaming the system you're totally right. Although slightly unintuitive, we've also heard the opposite from maintainers. That they'll be motivated to remove the silly one line packages from their dependency trees due to the imbalance of value they provide vs extract. We also prune self dependencies, circular dependencies and a few other cases to keep things level. Hopefully we'll be at a stage to open source our codebase soon and can better leverage community feedback in this space :)

djaouen 4y ago

This is a great idea! Now I can finally pick a contribution level and have it automatically donate to my favorite projects. Thanks for building this!

qwerki 4y ago
Thanks for your kind words and trying it out @djaouen! Please don't hesitate to ping me if you need anything (email in profile).

koito17 4y ago

Genius idea. I try to donate to open source software I've used for long time, especially if I cannot contribute any code back. This site seems to automate the process of finding out which dependencies of your software are accepting donations. Unfortunately, I cannot use this right now, because Maven dependencies can't seem to be found, and neither can Cargo dependencies. I decided to test it with an app that uses a mix of ClojureScript and Rust. There is a shadow-cljs.edn file at the root level of the folder, but those dependencies are not picked up. Neither are stuff in a package-lock.json. There is a Cargo.lock file in a subfolder, but that does not seem to be scanned either. However, I am able to verify there exist dependencies, in each of these files, that are actively seeking for funding and use GitHub sponsors.

qwerki 4y ago
Hi Koito17 Thanks for trying it out! Are you able to ping me your github handle so I can get to the bottom of it (email in profile). Alternatively, for multi-project repos you can add a thanks.yaml file to the root of the repo with a `maxDepth: 2` value inside it. Unfortunately, deep scanning the entire repo looking for files would be prohibitive due to GH rate limiting hence this approach. Please keep me posted. I'm also available on Discord if you need anything.
- koito17 4y ago
  Hi. First of all, thanks for the quick response, and more importantly, working on this cool idea! I see on the website that CLJS isn't supported; that's fine. But the NPM dependencies not being detected does intrigue me. I'm going to follow up with you on Discord if that's fine
  - qwerki 4y ago
    ♥

dewey 4y ago

It's still early for GitHub's Sponsor feature but I'm a bit surprised this is not part of it already. - They already understand what kind of code base it is and already do dependency scanning for security issues - They have payment details - They have the "verified" payment method of a person / project (If sponsoring is enabled)

armini 4y ago
I can't say much about Github but I can say that we're working to open source our project ;)
asb 4y ago
It looks like they are developing features in this general direction https://github.blog/changelog/2023-04-04-export-your-sponsorable-dependencies-and-sponsor-many-in-one-checkout/ https://github.blog/changelog/2023-04-04-export-your-sponsor...
- dewey 4y ago
  Ah, I missed that blog post. Seems like only a matter of time until this is fully integrated.

Sephr 4y ago

The UI imposes a 5% minimum (and 15% default) value for "Tip thanks.dev" under "How much would you like to donate each month?" on https://thanks.dev/settings https://thanks.dev/settings This implementation is clearly for-profit. I want to directly tip open source projects using a system that doesn't involve other third parties taking a significant cut.

armini 4y ago
Absolutely appreciate & respect your perspective. We're passionate about making open source sustainable & understand that there can be multiple ways of achieving this goal. The more ways money is channeled to the community the better...
- jeppester 4y ago
  I think it would be easier to defend taking a cut if the cut was calculated in the same way as for the dependencies, e.g. next.dev being automatically added to the list.
  - jeppester 4y ago
    Obviously I meant to write thanks.dev
pharmakom 4y ago
Maybe 5% is the wrong number, but how do you expect the lights to stay on?
- coldtea 4y ago
  They could give the ability to sponsor their own service with donations in the exact same way they do it for third party FOSS projects.
  - robertlagrant 4y ago
    They're trying to solve the problem, not add to it.

tra3 4y ago

How do I convince the management that it's worth spending a fraction of what 1 developer costs to give back to OSS?

paulddraper 4y ago
How do I convince you? ;)
noisy_boy 4y ago
Make it as organized/structured as possible. Go through the social initiatives arm of the firm, if they are big enough to have one. To them "our social responsibility initiatives" or "open source community contributions" sounds better and webpage-worthy than "we pay project X, Y and Z" (even though that is basically what it boils down to). On the other hand, for a smaller firm, this might probably be just a one-to-one talk/convincing an executive. If you can't convince one, try another. If you can't convince any, take it as a flag with the color of your choosing.
armini 4y ago
I'd love to help you build out that business case & open source it. Let me know if you're interested https://discord.gg/fQGqvQdWxq https://discord.gg/fQGqvQdWxq We're also started sharing interviews with maintainers who talk about the people aspect of what this funding means to them https://www.youtube.com/@thanks_dev https://www.youtube.com/@thanks_dev
pabs3 4y ago
Tell them it is risk management; funding OSS ensures that projects you depend on will exist as OSS into the future and hopefully have less bugs and security problems. For example: https://anonymoushash.vmbrasseur.com/2022/10/27/open-source-relicensing-business-risk https://anonymoushash.vmbrasseur.com/2022/10/27/open-source-...

TrueCarry 4y ago

I've thought about exact same thing for a long time. Except instead of just analyzing dependency list, create plugin for vscode/npm/etc and analyze how much each dependency is really used by you. Great that somebody finally built tool like that, good luck!

animesh 4y ago

I just started using GitHub Sponsor for some repos. How is this different?

qwerki 4y ago
Hi Animesh! The biggest difference would be that TD answers both "who should I sponsor AND how much?". It continually calculates the weight of each dependency in your codebase and distributes your monthly budget accordingly. The next biggest difference is that it distributes micro-payments up to 3 levels deep into the dependency tree. We've noticed majority of people sponsor the top of mind projects, but the deep nested dependencies don't get any love. This automated approach should fix that. Don't hesitate to ping me if you have any other questions please (email in profile).
- animesh 4y ago
  Thank you for the clarification. I will consider it in a near future.

paulddraper 4y ago

Plot twist: This was the endgame of all those 1000s of trivial npm packages.

toastal 4y ago
Why Array.isArray() when you can require("isarray").isArray()? (Node.js 0.10.0, Fx 4.0) deep-equal has 43 packages (& 17m weekly downloads) that are mostly (is|has)-* packages or redundant wrappers like for-each and object-keys (https://npmgraph.js.org/?q=deep-equal https://npmgraph.js.org/?q=deep-equal) and you’ll find this package included in a lot of upstream libraries. Ask for a banana and get a gorilla and forest... Luckily many have moved to fast-deep-equal (0 dependencies), but there are a lot of other examples of this sort of thing.

nnurmanov 4y ago

I created openlist.dev, where developers could add small banners of products they love to their GitHub profiles and get paid if users click the banner. Looking for companies to become early users

test1-test1 4y ago

The dependencies(open source libraries) will figure out a way to game the system. I don't know how but maybe someone will try.

armini 4y ago
More money in the ecosystem will naturally create more competition but I’m sure the community will adapt & evolve accordingly. There’s no shortage of smart people in this space.

buro9 4y ago

I'm on the receiving end of donations from sourcegraph using this. It's around $10 per month from that single donation and is for the only Go HTML santizer, which you use when you have user generated / untrusted input that you need to display as HTML. https://github.com/microcosm-cc/bluemonday https://github.com/microcosm-cc/bluemonday For me the library has been good enough for my own use for a very very long time. I mostly neglect it unless there's some critical issue (which there hasn't been for a very long time — but clearly infosec world knows this lib exists as when I do make changes with crap commit messages I get emails asking what the implications are). I don't improve it at all as my time is better spent on my day job. I've often thought that there's room for improvement such as a DOM style sanitizer to validate HTML input rather than just a SAX style sanitizer, perhaps formatting of output in addition to sanitising input, transformation rules to allow a safe embedly type thing, etc. When I got the initial donation I was surprised, first ever bit of support for open source software I'd written (as this was not written on company dime). Even at $10 per month it is motivating enough to think someone values it. If it accrues into something significant then I may actually feel motivated to improve it rather than just support it. Interesting is that I'd regard this OSS lib as successful by usage as sourcegraph says 803 projects use it — but given that a fair number of those are things like Hugo which in turn have thousands of forks and many more thousands of instances of use, well it does appear that this sanitizer is to safe HTML in Go what https://xkcd.com/2347/ https://xkcd.com/2347/ illustrates. Originally it was written for my own use and it's now used by virtually everything in the Go world that makes a website. Perhaps people don't know this and libraries like it exists though? Perhaps they import some web framework and this came with it? Well, for that awareness thank you to thanks.dev Of the models I've seen so far for supporting individuals who create OSS code this one stands out by highlighting dependencies. Likely the solution is a blend of things... a commission type system for rare engineers and skills (i.e. https://words.filippo.io/pay-maintainers/ https://words.filippo.io/pay-maintainers/ ) and thanks.dev for the long-tail of those who have done things and you want to use it long-term. There are also companies who create OSS software, and if you value their work and don't want what they produce to go behind Enterprise differentiation then perhaps pay for their services too.

armini 4y ago
reading this comment made my day :) thanks for your contributions to open source, the least we could do is recognise & reward you for your work. What people often forget is the people aspect of open source. I've done countless interviews with open source maintainers & you are all just awesome https://www.youtube.com/@thanks_dev https://www.youtube.com/@thanks_dev it's a pleasure working with you & I love hearing your stories

aborsy 4y ago

I use like 50 different software heavily. Each of these has like tens of developers. I can donate to some and rotate each month, but how about the rest, and dependencies?

armini 4y ago
Good point, using thanks.dev you can adjust to scan multiple levels into the dependency tree. That ensures you can reach as many people as possible.

aborsy 4y ago

I use like 50 different software heavily. Each of these has like tens of developers. I can donate to some and rotate each month, but how about the rest, and dependencies? There is just so much software there that seems hopeless (although there are also billions of users).

pabs3 4y ago
IIRC the model of thanks.dev ensures that those dependencies get some money too.
junon 4y ago
That's actually how most of my donations on Thanks come from - being a dependency of something the person donates toward.
qwerki 4y ago
Our take on this is that funds should distribute across the dependency tree. We currently facilitate trickling your budget 3 levels deep. https://thanks.dev/static/how https://thanks.dev/static/how covers this in more detail.
- robertlagrant 4y ago
  That seems like a pretty sensible way of doing things. I wonder: will people find a way to exploit it? E.g. create a simple but useful dependency that uses 100 sub-dependencies, all by the same author? Will larger, more self-contained dependencies lose out to small ones?
jillesvangurp 4y ago
Exactly. Many OSS developers work for free. Myself included (I develop some OSS software). And the way I try to be a good OSS citizen is by being constructive and supportive in various OSS communities I care about. You're not going to get my money. But you might get my time, attention, and skills. For free. The way the OSS communities works is not money but value creation. There are all sorts of value people get out of creating things for each other. People like the recognition and appreciation they get for their work, the satisfaction they get out of doing a thing, the interactions with others, etc. Plenty of ways to get value from creating stuff for others. And sometimes people actually get paid directly or indirectly to work on a thing. It's fine. I'm not against that. Just don't expect/demand me to pay for a thing. And I won't do so either. That simple promise is why OSS works. We both end up getting some value if we work together. And we might even get paid indirectly. For example I have a consulting career and I dabble in startups. So my motives are not entirely altruistic.

pabs3 4y ago

There are several similar services out there, some of them are listed in the patronage section of the FOSSjobs wiki: https://github.com/fossjobs/fossjobs/wiki/resources#patronage https://github.com/fossjobs/fossjobs/wiki/resources#patronag...

armini 4y ago
Thanks for sharing this link, there’s a lot of useful content in here for people interested in this space.

pabs3 4y ago

Would be interesting if you could use code coverage tests to weight your donations to dependencies.

armini 4y ago
Thanks for taking the time to share this idea. We have added it to our drawing board.

pabs3 4y ago

What are everyone's budgets (corporate or otherwise) for paying for open source work?

hvasilev 4y ago

You open source guys need to figure out a way to charge people for the value that you provide. You ran the experiment for a very long time and it looks like this "beggar" model really doesn't seem to be working for the vast majority of your projects. Take money, don't wait for people to give you money for the free value that you provide.

antupis 4y ago
I think paid feature requests/support is way to go.
armini 4y ago
I’m actually optimistic about the progress & shift in behaviour. There’s a few companies that are setting a clear example & leadership in this space like Sentry, sourcegraph & cash app who genuinely want to help improve the ecosystem.
pabs3 4y ago
I'm sure plenty of folks would be happy to send invoices to people that want them :)
heipei 4y ago
This 100%. I run a German limited company (GmbH) and I can't just send money somewhere without a proper invoice. I've even had issues with paid services (think VPN providers etc) that don't send out invoices, so then I'm stuck with an expense that I can't deduct as a business expense. Make sure you can issue correct invoices, and let potential customers know upfront!

Ndymium 4y ago

I love and support this idea very much. I had actually been thinking about this exact solution myself, but I'd personally want to stay clear of anything involving real money, so it's great that you're doing it. :) Just a note which probably isn't worth your time to act on, but using this service as a maintainer in Finland is illegal unless you can offer a geoblocking feature that can block any Finnish supporters from routing money to Finnish maintainers. This is due to our Money Collection Act which prohibits soliciting any donations except for very strict circumstances which aren't really applicable here. Might be worth a note on the page if you have extra time, since this is not know by many Finns that I've talked to.

armini 4y ago
Thanks for raising the issue. Is it okay for you to forward the funds to other people in the ecosystem?
- Ndymium 4y ago
  Not sure if you're assuming that I am using the service with the wording "for you" or if it's a general question (I'm not a user). But if it's a general question, legally speaking, my best guess (not a lawyer) is that it would be perfectly legal to make a maintainer account to forward the funds to other projects, since you are not receiving anything. I guess you know if a feature like that is worth the trouble to implement.
  - armini 4y ago
    That’s good because maintainers who receive funds can forward it to others or even send it to an open collective. That helps keep the money circulating in the ecosystem.

progx 4y ago

You should order the people list, so that maintainer / repo owner come first.

armini 4y ago
Yeah good point. We should have it done soon.

villgax 4y ago

Governments should do this even on outsourced contracts

armini 4y ago
There’s a few initiatives being discussed already https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/ https://www.whitehouse.gov/briefing-room/presidential-action...

aboodman 4y ago

Awesome to see someone try and do this! I was kicking the idea around a few years ago but got sidetracked: https://github.com/tythe-protocol/tythe https://github.com/tythe-protocol/tythe.

armini 4y ago
wow! love the fact that you had also considered coinbase payment integration. really neat..

nicbou 4y ago

Donation income is risibly small. People will sign praise your work, tell you how much they depend on it, and how it changed their lives. Others will ask you tricky questions that really ought to be asked to a lawyer. ...and they still won't donate a cent. I get about 70 cents per thousand unique visitors. About one in every 14,000 visitors donate. Affiliate income is roughly 100 times that without trying. Let me put it differently: with the same traffic, donations barely cover my groceries, and affiliate income is a comfortable salary. I'm at peace with that. I make free things for a reason. It's just something to keep in mind when suggesting donations as a business model. Doubly so as an alternative to ads. Another tidbit: praise people who create the things you use. It feels so good to know that people use and love the fruits of your labour. I've become lavish in my praise after experience the effects of it.

agrimonyhal 4y ago
If many open projects are funded via ads, will Copilot tools crater open source revenues by reducing traffic to documentation?
- nicbou 4y ago
  Most projects aren't funded at all.
popey 4y ago
Depends how you present it. The Ubuntu download page used to punch you in the face asking for donations. They also tried sliders, asking downloaders to choose how to spend the money they donated. These were super successful. People felt in control of how their money was spent. There was no way for them to check in on that, it was a trust process. But the net result was a lot of people donated a very significant amount of money. Similarly I understand (from an interview with the developer) that the eBook software Calibre gets a significant number of donations from users via the giant donate button in the toolbar. I do agree, having a "tip jar" option for donations is rarely as successful as the above methods though. Not diminishing your personal experience. Just saying it's possible to change the way things are done, and get more.

rekoil 4y ago

Is it possible to scan a repo without authorising your service access to my entire Github account?

armini 4y ago
Sure, send us a DM on our discord. We'd love to help.

Canada 4y ago

I see nothing but a blank page. Firefox and Chrome.

armini 4y ago
Sorry we had a slight outage due to HN traffic load but things are stable & back to normal.

jamietanna 4y ago

Folks may also be interested in checking out https://stackaid.us https://stackaid.us (previous discussion https://news.ycombinator.com/item?id=32837829 https://news.ycombinator.com/item?id=32837829) as a different platform doing similar work

marginalia_nu 4y ago
Seems to like this fan the flames of is-even[1] type spam dependencies even more . [1] https://www.npmjs.com/package/is-even?activeTab=code https://www.npmjs.com/package/is-even?activeTab=code
nwellnhof 4y ago
Tidelift also has a similar program: https://tidelift.com/about/lifter https://tidelift.com/about/lifter But dependency tracking is hard and all of these platforms only scratch the surface. For example, I've never seen a solution that detects C libraries used from other languages, let alone the dependencies of these libraries. Then there are build-time dependencies which are hard to detect. Here's an example of a complex dependency chain: redmine -> ruby-commonmarker -> libcmark -> re2c Wake me up if someone offers a solution that detects chains like that.

lars_francke 4y ago

In case you hadn't seen this yet, GitHub offers this service: https://github.com/sponsors/explore https://github.com/sponsors/explore (need to be logged in) I have no insight but I could imagine that GitHub are going to offer something similar based on that data at some point in the future. For us the "top" developers on that page are people with 150+ repos that we depend on that I have never head of before. It turns out that they are all tiny JavaScript libraries that we depend on in some repository that's not part of our real product. I'm happy to sponsor them as well but it'd be cents not euros per month compared to libraries that do the "heavy lifting" for us. At the moment we hand-pick things, also not ideal. All of that text to say: This is a hard problem, I have no idea how to solve it but I applaud you and everyone who's giving it a shot. A 5% flat fee is too much for me though, if it had a cap then it'd be different.

armini 4y ago
If you have the time, we’d love to connect with you on our discord & learn more about your experience. It’s a hard problem & that needs a strong open community. Given the recent PayPal incident, I don’t think GitHub should be the only solution.
- lars_francke 4y ago
  I just joined. Not sure if I can offer much in terms of solutions, only problems :(
robertlagrant 4y ago
> A 5% flat fee is too much for me though, if it had a cap then it'd be different. It can't have a cap if payment gateway processing fees are percentage-based.
- lars_francke 4y ago
  I do see your point but in this case _everyone_ pays the 5% even though the payout only happens once per project and the payment also only happens once per person donating. It might be that it is this expensive to run, I don't know. It just seems unfair to me that the platform would get 5% and "only" 95% are distributed to the projects. I do understand that everyone has a different definition of "fair" and I also don't know what I'd be willing to spend. It's something I'd need to think about.

theshrike79 4y ago

After Google shut down Google Reader I specifically went looking for an alternative I could pay money for and landed with Newsblur[0]. I've been a happy customer ever since. Pretty soon after that I moved over from Gmail to Fastmail[1], again it was a service that took my money so that I was the customer not the product being sold. [0] http://www.newsblur.com http://www.newsblur.com [1] https://fastmail.com/ https://fastmail.com/

armini 4y ago
Yeah a lot of people here question why we're charging a minimum 5% fee but fail to understand that we all need to make ends meet or else we will also be shut down in time.

aunty_helen 4y ago

I put 50$ in the pokey machine but it’s only paid it out to two projects? Some of the other projects which are missing out I already donate to. Any ideas?

armini 4y ago
Thanks for taking the time to register & donate. We’re looking into it now & we will send you a DM shortly.
qwerki 4y ago
Hi! Thanks for trying it out. I have reached out via email but just in case, looks like your account is configured for only first level dependencies. If you increase it to 3 levels it'll show much better results. You're also able to adjust the distribution of funds via boosting in the dependencies page. Please note the donation will be kept in PENDING state for 5 days to allow time for full dependency analysis, adjustments via boost and/or exclusions. In this time we'll be reaching out to the other projects in your dependency tree to onboard them. Please ping me if you need anything. Many thanks again!
- aunty_helen 4y ago
  Ok thanks so much. I assumed first level dependencies were anything that would turn up in a requirements.txt so reduced it from the default. Thanks for building this and I'm looking forward to seeing how it develops. I will add my voice to the "allowing this service full access to my repos is uncomfortable" crowd, there's a couple of my clients that have stricter NDAs which has meant those repos have been excluded. But you'll figure that out when you do. Cheers and enjoy the product launch :)

djaouen 4y ago

Hopefully this is fixed soon, but now I just see a blank page when I go to the site. Is it this way for anybody else?

armini 4y ago
Sorry we had a slight outage but it should be working fine now.

noctis 4y ago

It might be a good idea to add auto splitting. I won't bother assigning each and every dependency an amount. Kinda like Xbox Game Pass or Setapp.

armini 4y ago
You're absolutely right. Some orgs have huge lists. We do suggest the split but it's rather subjective so we also provide the tools to let sponsors boots & exclude.

luckylion 4y ago

"Donation" is a somewhat tainted word, because it often has certain legal issues attached. Most maintainers aren't non-profits, so they don't take donations, they get income (and it'll get taxed). At the same time, "donating" something without it actually being a donation is complicated for businesses (e.g. github not invoicing me for sponsorships gets my tax consultants to make sad faces). I understand the idea, but giving it a better legal framework than "it's a donation. but not really" would definitely help.

armini 4y ago
I personally like to see companies sponsoring maintainers. We’re working to clarify that with the community is the terms have different value propositions & financial implications.
- luckylion 4y ago
  "Sponsoring" is fine, but for business processes you need a paper trail where something gets invoiced somewhere. It doesn't matter for tiny amounts, but your accountant will want something to hand to the IRS if there's ever an audit. From what I understand, you're not 1:1 giving the money to some maintainer that's chosen but you'll distribute it according to code usage etc, so you won't be a payment provider, but it counts as revenue for you and you give the money to maintainers, right? Are you invoicing or do you go the github route?

sli 4y ago

A service that alleges to support open source projects and developers deciding to block VPN users sure seems like an interesting choice.

gehen88 4y ago

Is nobody concerned with the fact this tool scans your repository contents? This tool is mostly intended for use with private projects, not open source, so I would expect a LOT more scrutiny (and options) around security.

armini 4y ago
We are working to open source our project & we also have an api integration solution for those who prefer to only share their package files.

esclear 4y ago

One thing that I haven't seen addressed here or in the FAQ is: What happens to donations towards dependencies where the maintainer / organization / group of maintainers is not registered at thanks.dev? The FAQ has a section titled "What happens if I don’t claim my balance?", but I think this only applies to people registered at thanks.dev. I'm not even sure that thanks.dev would be able to reliably contact developers that / maintainers in all (most ?) situations.

armini 4y ago
great observation & questions, we will update that on our FAQ shortly. If users aren't registered then we can't verify who's project admin & no funds will be allocated to them from the sponsors pool. Only when an admin register then we can allocate funds.
- esclear 4y ago
  Okay, to make my thought more explicit: If I decided to sponsor my project's dependencies with say 100 USD and none of the developers are registered with thanks.dev – which seems like a reasonable assumption, especially as thanks.dev appears to be a young project – I wonder what happens with the money. The money can't be allocated. Does thanks.dev just keep it? Is it "stored" until it can be allocated? And if this is the case: From the information on allocation it seems that all of the money will be distributed between all eligible developers (possibly 3 months after devs don't claim their balance)? If so, what if there is only one (transitive) dependency that is registered with thanks.dev?

toastal 4y ago

> You need to enable JavaScript to access thanks.dev. Not a great start for delivering me basic information on what this even is. Reminder that Microsoft GitHub and GitLab do not have a duopoly on decentralized (self-hostable) version control. Products like this feed into folks feeling compelled to join big, proprietary services.

deleted 4y ago

[deleted]

omneity 4y ago

The intention is laudable, but this kind of business model makes me think of all these NGOs appearing in the 90s/2000s purportedly to "help poor africans" [0,1]. While many have been (trying to) do their best, it's unfortunate that many got richer on the back of the people they were supposed to help. Sometimes with local accomplices who also benefit from the grift. I guess the main take away would be that transparency and accountability are paramount if you want to be part of such an ecosystem, especially as a middleman for money transactions. [0]: https://landportal.org/node/100425 https://landportal.org/node/100425 [1]: https://humanglemedia.com/the-dark-reality-of-corruption-lack-of-accountability-among-humanitarian-orgs-in-africa/ https://humanglemedia.com/the-dark-reality-of-corruption-lac...

deleted 4y ago

[deleted]

andrew_ 4y ago

I receive a very small amount of donations on this platform for my work. I have some projects out there that are used as a dependency by a few million people. Fwiw in just over six months I've received around $20 and haven't cached it out yet. I get email notices about a few cents here and there but haven't bothered to take the time to setup Stripe in order to withdraw.

kramerger 4y ago

Ahem... https://liberapay.com/ https://liberapay.com/ Platform owner are registered as devs, who you can tip like any other devs. Hence their "cut" is not taken automatically from every transaction

philistine 4y ago

I'm using Jekyll for my rinkidink website. Jekyll is the workhorse tool of Github. Github is owned by Microsoft, who's not hurting for cash, or so I've heard. What I'm saying is it depends.