5 ms·

I dont't think this would be a problem for FOSS. If I release an unsafe or not code compliant kitchen/house/etc. blueprint (and don't make claims to the contrar

by V__ 3y ago

I dont't think this would be a problem for FOSS. If I release an unsafe or not code compliant kitchen/house/etc. blueprint (and don't make claims to the contrary) nothing would happen to me. If I sell them the situation might be different. I think the same would apply to FOSS.

insanitybit 3y ago
Unless code somehow stops being speech, I see no way that this could impact FOSS (in the US).
ThrowawayR2 3y ago
All that that strategy would mean is that the costs of security auditing would fall onto the business using the FOSS code. It will start looking very attractive to instead buy code from an established software vendor who will provide some level of liability guarantees and assistance in auditing rather than going it alone with FOSS and in-house or external auditing.
- hiatus 3y ago
  The costs of security auditing already fall onto the businesses using FOSS code, though. A business just blindly incorporating code without static analysis, vulnerability checks, etc is not exercising due care.
- TeMPOraL 3y ago
  So basically, it would work like in every other industry? FOSS, for all the good it does, it also did break the economics of software. How much of the current problems with adtech, surveillance capitalism and VC funding stems from FOSS making it impossible to simply sell software components like products?
  - wbl 3y ago
    None of it. Emacs didn't kill word or Wang or WordPerfect. OS vendors still make money despite Linux and FreeBSD. The GIMP didn't kill Adobe. And if you want to sell proprietary libraries your market is going to be limited because OSs will distribute them and it will be hard to keep up when customers are fixing their own problems. What killed the shrink-wrapped market was first piracy and secondly the way people use their computers change. Then add on the easy sharing that e.g. Google docs enables and it's all over but the shouting. The SAAS model also has the benefit of aligning value delivery with outlays temporally. No more wait a year before shipping: instead get quick iteration with an ongoing revenue stream. You can recover from missteps in a way that the old model could not.
    - TeMPOraL 3y ago
      > Emacs didn't kill word or Wang or WordPerfect. Not sure how to respond to that. Emacs is around, the latter two I believe not, but approximately nobody is using them anyway. And I say that as someone who lives in Emacs. > OS vendors still make money despite Linux and FreeBSD. Apple makes money on hardware. Microsoft makes money on cloud, and has been desperately trying to turn Windows into a subscription service for a while now. They even non-humorously said exactly this in some message in (IIRC) installer or update screen - I remember Windows 10 telling me "Windows is a service" as if that was a good thing. > The GIMP didn't kill Adobe. No, but again, GIMP and Krita are used by approximately no one, meanwhile Adobe switched to a quite abusive subscription model. > And if you want to sell proprietary libraries your market is going to be limited because OSs will distribute them and it will be hard to keep up when customers are fixing their own problems. I don't see how. Think about the 100 (or 10 000, if you're doing webdev) dependencies your product uses. Most of those could be a licensed product, creating a cottage industry of small vendors making a living from developing specialized libraries. This thing is real in some areas, e.g. industrial software, where there are e.g. protocols that are too complex and boring for Open Source community to care about supporting in full. But it's something impossible in general, because popularity of open source simply prevents this kind of market from forming. Now, to be clear: I don't have a strong opinion on whether this is good or bad. Still trying to fully understand that one. But what I know for sure is that open source is a huge disruption to how the market would've worked otherwise. > What killed the shrink-wrapped market was first piracy I'm not convinced about that. Maybe video games had a problem, but money in software in general was in B2B, not B2C, and there the piracy was effectively mitigated by the legal system. In fact, both Microsoft and Adobe used piracy as opportunity because of that - kids would grow up using pirated copies of professional software, and then as adults, their companies and their employers would have to buy the properly licensed versions of that same software, because that's the only thing anyone has experience in using. > The SAAS model also has the benefit of aligning value delivery with outlays temporally. No more wait a year before shipping: instead get quick iteration with an ongoing revenue stream. You can recover from missteps in a way that the old model could not. SaaS has some benefits, but they tend to be single-sided, unless the customer and the vendor are comparable in power, which usually isn't the case. So while e.g. IBM or Microsoft can force Google or Adobe to behave, my small business will be taken advantage of by large SaaS vendors.
  - barrysteve 3y ago
    Oh my gosh. It's not FOSS that kills software, it's ctrl-c and ctrl-v. Computers always allowed you to copy code for free and any new concept that took six months to be made up, can be duplicated for free in one second. The real problem is that you have to ship code that can be disassembled and read by another human being, to sell software. This fact annihlates any incentive and control an author-of-software has over their conceptual labor. What we need is a method to sell a binary (and source-code) that are completely free of human-perceivable information AND authorized against a purchase server. Identify the code author or not, both are fine, what matters is the conceptual labor is protected. That's it. We do that and it becomes viable to do hard mental work for a long time, and take risks on bold moves. Make the concept work and sell the baked end result without giving away the recipe. Every other industry keeps the means of production to themselves. But for some awful reason, programmers are expected/required to ship the means of production, the understanding of the code and the concepts of the code AND be ready to answer anything, in a relationship with the purchaser. The balance of effort between software developers and the benefit everyone else gets from them, is completely messed up.
    - TeMPOraL 3y ago
      > What we need is a method to sell a binary (and source-code) that are completely free of human-perceivable information AND authorized against a purchase server. That sounds impossible in principle, not without taking away ownership of the machine from the user. I guess TPM + homomorphic encryption might allow this one day, but that doesn't feel like a win for society. > But for some awful reason, programmers are expected/required to ship the means of production Pedantic, perhaps, but I wouldn't classify code as "means of production". Dev tools and supporting tooling, maybe, which no one is required to ship. I sort of agree with you're saying overall - you're pointing out the fundamental issue, open source is just something enabled by it. I focused on open source because, arguably, this reality of "messed up balance" was still manageable through the legal system, and it's the FLOSS becoming a cultural phenomenon in the industry that broke this.
- coliveira 3y ago
  And this is how it should be. Vendors need to be responsible for what they deliver, if it is FOSS or not.
  - gilcot 3y ago
    When you give a piece of cake, that doesn't make you a cake vendor, do you?
    - yawaramin 3y ago
      You misunderstood. In the scenario you replied to, you give a piece of cake, to someone who then sold it to someone else. They are the vendor, not you.
      - gilcot 3y ago
        So we agree :)
        yawaramin 3y ago
        That was a piece of cake.
- IshKebab 3y ago
  That could be a good thing - FOSS projects could sell liability protection to fund development.
  - delfinom 3y ago
    They won't, because they'll need to find an insurer willing to underwrite it. Good luck getting liability and omissions coverage without an established business entity or licensure. Insurers themselves want to know you are following the law rather than fly by night operations.
deleted 3y ago
[deleted]

by V__ 3y ago

insanitybit 3y ago

Unless code somehow stops being speech, I see no way that this could impact FOSS (in the US).

ThrowawayR2 3y ago

All that that strategy would mean is that the costs of security auditing would fall onto the business using the FOSS code. It will start looking very attractive to instead buy code from an established software vendor who will provide some level of liability guarantees and assistance in auditing rather than going it alone with FOSS and in-house or external auditing.

hiatus 3y ago
The costs of security auditing already fall onto the businesses using FOSS code, though. A business just blindly incorporating code without static analysis, vulnerability checks, etc is not exercising due care.
TeMPOraL 3y ago
So basically, it would work like in every other industry? FOSS, for all the good it does, it also did break the economics of software. How much of the current problems with adtech, surveillance capitalism and VC funding stems from FOSS making it impossible to simply sell software components like products?
- wbl 3y ago
  None of it. Emacs didn't kill word or Wang or WordPerfect. OS vendors still make money despite Linux and FreeBSD. The GIMP didn't kill Adobe. And if you want to sell proprietary libraries your market is going to be limited because OSs will distribute them and it will be hard to keep up when customers are fixing their own problems. What killed the shrink-wrapped market was first piracy and secondly the way people use their computers change. Then add on the easy sharing that e.g. Google docs enables and it's all over but the shouting. The SAAS model also has the benefit of aligning value delivery with outlays temporally. No more wait a year before shipping: instead get quick iteration with an ongoing revenue stream. You can recover from missteps in a way that the old model could not.
  - TeMPOraL 3y ago
    > Emacs didn't kill word or Wang or WordPerfect. Not sure how to respond to that. Emacs is around, the latter two I believe not, but approximately nobody is using them anyway. And I say that as someone who lives in Emacs. > OS vendors still make money despite Linux and FreeBSD. Apple makes money on hardware. Microsoft makes money on cloud, and has been desperately trying to turn Windows into a subscription service for a while now. They even non-humorously said exactly this in some message in (IIRC) installer or update screen - I remember Windows 10 telling me "Windows is a service" as if that was a good thing. > The GIMP didn't kill Adobe. No, but again, GIMP and Krita are used by approximately no one, meanwhile Adobe switched to a quite abusive subscription model. > And if you want to sell proprietary libraries your market is going to be limited because OSs will distribute them and it will be hard to keep up when customers are fixing their own problems. I don't see how. Think about the 100 (or 10 000, if you're doing webdev) dependencies your product uses. Most of those could be a licensed product, creating a cottage industry of small vendors making a living from developing specialized libraries. This thing is real in some areas, e.g. industrial software, where there are e.g. protocols that are too complex and boring for Open Source community to care about supporting in full. But it's something impossible in general, because popularity of open source simply prevents this kind of market from forming. Now, to be clear: I don't have a strong opinion on whether this is good or bad. Still trying to fully understand that one. But what I know for sure is that open source is a huge disruption to how the market would've worked otherwise. > What killed the shrink-wrapped market was first piracy I'm not convinced about that. Maybe video games had a problem, but money in software in general was in B2B, not B2C, and there the piracy was effectively mitigated by the legal system. In fact, both Microsoft and Adobe used piracy as opportunity because of that - kids would grow up using pirated copies of professional software, and then as adults, their companies and their employers would have to buy the properly licensed versions of that same software, because that's the only thing anyone has experience in using. > The SAAS model also has the benefit of aligning value delivery with outlays temporally. No more wait a year before shipping: instead get quick iteration with an ongoing revenue stream. You can recover from missteps in a way that the old model could not. SaaS has some benefits, but they tend to be single-sided, unless the customer and the vendor are comparable in power, which usually isn't the case. So while e.g. IBM or Microsoft can force Google or Adobe to behave, my small business will be taken advantage of by large SaaS vendors.
- barrysteve 3y ago
  Oh my gosh. It's not FOSS that kills software, it's ctrl-c and ctrl-v. Computers always allowed you to copy code for free and any new concept that took six months to be made up, can be duplicated for free in one second. The real problem is that you have to ship code that can be disassembled and read by another human being, to sell software. This fact annihlates any incentive and control an author-of-software has over their conceptual labor. What we need is a method to sell a binary (and source-code) that are completely free of human-perceivable information AND authorized against a purchase server. Identify the code author or not, both are fine, what matters is the conceptual labor is protected. That's it. We do that and it becomes viable to do hard mental work for a long time, and take risks on bold moves. Make the concept work and sell the baked end result without giving away the recipe. Every other industry keeps the means of production to themselves. But for some awful reason, programmers are expected/required to ship the means of production, the understanding of the code and the concepts of the code AND be ready to answer anything, in a relationship with the purchaser. The balance of effort between software developers and the benefit everyone else gets from them, is completely messed up.
  - TeMPOraL 3y ago
    > What we need is a method to sell a binary (and source-code) that are completely free of human-perceivable information AND authorized against a purchase server. That sounds impossible in principle, not without taking away ownership of the machine from the user. I guess TPM + homomorphic encryption might allow this one day, but that doesn't feel like a win for society. > But for some awful reason, programmers are expected/required to ship the means of production Pedantic, perhaps, but I wouldn't classify code as "means of production". Dev tools and supporting tooling, maybe, which no one is required to ship. I sort of agree with you're saying overall - you're pointing out the fundamental issue, open source is just something enabled by it. I focused on open source because, arguably, this reality of "messed up balance" was still manageable through the legal system, and it's the FLOSS becoming a cultural phenomenon in the industry that broke this.
coliveira 3y ago
And this is how it should be. Vendors need to be responsible for what they deliver, if it is FOSS or not.
- gilcot 3y ago
  When you give a piece of cake, that doesn't make you a cake vendor, do you?
  - yawaramin 3y ago
    You misunderstood. In the scenario you replied to, you give a piece of cake, to someone who then sold it to someone else. They are the vendor, not you.
    - gilcot 3y ago
      So we agree :)
      - yawaramin 3y ago
        That was a piece of cake.
IshKebab 3y ago
That could be a good thing - FOSS projects could sell liability protection to fund development.
- delfinom 3y ago
  They won't, because they'll need to find an insurer willing to underwrite it. Good luck getting liability and omissions coverage without an established business entity or licensure. Insurers themselves want to know you are following the law rather than fly by night operations.

deleted 3y ago

[deleted]