4 ms·

now that I am fine with, but i still think this is nutty overall. there's nothing wrong with anon contributions to software.

ChrisMarshallNY 3y ago
It all depends on the final use of the software. I think that anyone that includes anyone else’s work, is responsible to do due diligence on the library/module/code they import. That applies to free or paid software/work. Some companies I have known, have refused to use any free work; even when donated (I tried donating, once). Instead, they insist on paying a small sum (in the US, a single dollar is customary), and having a legally-binding contract. Having the supplier sign a contract may suffice for “due diligence,” as it puts the supplier “on the hook” for the quality of their work. It could also absolve the supplier, and place the burden on the consumer. In any case, I don’t have any “right” to just fart out some junk, and expect it to become crucial infrastructure. If I want my work to be used at that level -whether paid, or not-, then it’s incumbent on me to test, document, and support that work. I have written systems that have become infrastructure; both as paid work, and for free. This is something I have some experience in.
- w4ffl35 3y ago
  I mentioned this in an above comment - here is a repo that I use in two of my apps that I compile with pyinstaller and distribute: https://github.com/Capsize-Games/aihandler/blob/master/setup.py https://github.com/Capsize-Games/aihandler/blob/master/setup... There are hundreds if not thousands of developers who have contributed to those libraries and the dependencies of those libraries. Are you saying that you feel it is up to someone (myself or some service) to track down and verify the identity of each of these developers, and that I shouldn't use these libraries or distribute them until that happens?
  - ChrisMarshallNY 3y ago
    Like I said, if I use someone else’s stuff in my work, it’s my responsibility to assure myself, and anyone upstream, of the veracity of that work. That’s the theory behind efforts like ISO-9000, but I find them pretty “top-heavy.” A good example might be Linux. There are thousands of contributors, but Linux is backed by one of the best (and harshest) developers on Earth. He puts his personal stamp on it, and has trained a bunch of others to be equally insistent on Quality. Git is the same (I believe that you may find some "relation" to Linux). In fact, Git has probably had a bigger impact on the world than Linux, and he put that out in ten days, as a side project. The deal is, that he is used to developing software to be used as infrastructure, and that takes some serious Discipline. That kind of Discipline is actually fairly rare, these days. If someone has it, you can rely on almost anything they do. The quality of the guarantor is an important component of almost any working relationship. Standards bodies try to avoid that, but I'm not confident it works. The one thing that I remember from working in ISO-9000 environments, was myriad ways to work around the requirements. They end up actually causing more problems than they solve. There's really no way to avoid the need for personal and institutional Integrity.

ChrisMarshallNY 3y ago

It all depends on the final use of the software. I think that anyone that includes anyone else’s work, is responsible to do due diligence on the library/module/code they import. That applies to free or paid software/work. Some companies I have known, have refused to use any free work; even when donated (I tried donating, once). Instead, they insist on paying a small sum (in the US, a single dollar is customary), and having a legally-binding contract. Having the supplier sign a contract may suffice for “due diligence,” as it puts the supplier “on the hook” for the quality of their work. It could also absolve the supplier, and place the burden on the consumer. In any case, I don’t have any “right” to just fart out some junk, and expect it to become crucial infrastructure. If I want my work to be used at that level -whether paid, or not-, then it’s incumbent on me to test, document, and support that work. I have written systems that have become infrastructure; both as paid work, and for free. This is something I have some experience in.

w4ffl35 3y ago
I mentioned this in an above comment - here is a repo that I use in two of my apps that I compile with pyinstaller and distribute: https://github.com/Capsize-Games/aihandler/blob/master/setup.py https://github.com/Capsize-Games/aihandler/blob/master/setup... There are hundreds if not thousands of developers who have contributed to those libraries and the dependencies of those libraries. Are you saying that you feel it is up to someone (myself or some service) to track down and verify the identity of each of these developers, and that I shouldn't use these libraries or distribute them until that happens?
- ChrisMarshallNY 3y ago
  Like I said, if I use someone else’s stuff in my work, it’s my responsibility to assure myself, and anyone upstream, of the veracity of that work. That’s the theory behind efforts like ISO-9000, but I find them pretty “top-heavy.” A good example might be Linux. There are thousands of contributors, but Linux is backed by one of the best (and harshest) developers on Earth. He puts his personal stamp on it, and has trained a bunch of others to be equally insistent on Quality. Git is the same (I believe that you may find some "relation" to Linux). In fact, Git has probably had a bigger impact on the world than Linux, and he put that out in ten days, as a side project. The deal is, that he is used to developing software to be used as infrastructure, and that takes some serious Discipline. That kind of Discipline is actually fairly rare, these days. If someone has it, you can rely on almost anything they do. The quality of the guarantor is an important component of almost any working relationship. Standards bodies try to avoid that, but I'm not confident it works. The one thing that I remember from working in ISO-9000 environments, was myriad ways to work around the requirements. They end up actually causing more problems than they solve. There's really no way to avoid the need for personal and institutional Integrity.