3 ms·

> Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are. Simple: there is no business

> Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are. Simple: there is no business model. Open Source is not a business. It is a philosophy and hobby, where people help each other and give away their labor with no expectation of a return. (Some youngsters that have grown up in the social media age have developed a kind of entitlement complex where they focus more on the popularity of their contribution than its utility; they may be developing it just to see a lot of stars on a GitHub page. But largely it's a community driven by people who just needed some code to exist and then released it for free when it worked) (Some businesses do release code with an open source license and even accept some contributions from the public, but largely they are doing so for various business reasons and the project is more a reflection of the business than the needs of a community. Since those projects are financed and organized by the business, they tend to end when the business abandons them; whereas a grassroots community project is often just maintained by a new stranger on the internet if the old maintainer gives it up)

andyfleming 3y ago
I'm not sure whether or not there's an issue of entitlement, but there's certainly incentives to develop a popular package (even if superficially). One big one is career development. For people early in their career, it's something they can proactively invest in, as where they can't magically materialize years of experience overnight.
Dalewyn 3y ago
There is definitely an argument to be made that open source should be viewed and treated as a business model, particularly if there are financial costs involved which must be paid one way or another. Dogma and fervor don't pay the bills.
alkonaut 3y ago
Still, high profile projects should be able to raise this type of money with ease. If they would say “Would match our ‘donation’ and donate $10 each year that we put in $1k in labor to this project?” that sounds like some commercial users would accept. But the first problem with medium scale OSS like this is that it’s no one’s hobby to manage projects or beg for money. It’s also a problem that OSS contribution/sponsorship isn’t normalized in corporations. I could much easier get permission to buy a $5k piece of software than donate $5 to an OSS project that powers out largest project and has been maintained for 10 years by a single person.
- TeMPOraL 3y ago
  But why should they raise this money? The unspoken assumption here is that code signing is a good thing. I question this assumption, particularly with how this works today. Microsoft, the cert issuers, and other companies involved in this are trying to create a reality in which software must always be attached to a specific legal entity, and then that entity must be vetted through the "corporate web of trust". That $629 (per year?) isn't paying to access/license a feature. It's a membership fee in that "corporate web of trust". It's a nice way to disempower users and individual developers, while effectively commercializing the entire Open Source space. "Want to have your open source project to have any users (on proprietary OS-es)? You need to start a company and sign a contract with one of our approved business friends."
  - alkonaut 3y ago
    As the comments on the issue suggests, $629 is not the minimum price tag. It can be much cheaper without being more complicated. But I agree Microsoft could probably make it easier and cheaper but I can’t see why they would want that given they want to drive apps to stores and not self publishing. They want the bad method of publishing to have bad ergonomics. A letsencrypt style signing process would be possible and would let people base the trust on the ownership of company.com instead of a regular cert. And for most use cases this seems good enough.
    - TeMPOraL 3y ago
      > A letsencrypt style signing process would be possible and would let people base the trust on the ownership of company.com instead of a regular cert. And for most use cases this seems good enough. Except it seems that's not what they want at all. LetsEncrypt works because we've worked out it's sufficient for purposes of HTTPS to attest that "you" own the domain company.com, which is verified by making you do something that can be done only when "you" are in control of what company.com DNS points at. The nature of "you" is immaterial, out of scope - only demonstrating control over a domain matters. This lends itself to automation. What they want to do with code signing is to pin the code to a specific legal entity. That's crossing from data integrity/provenance straight to KYC/legal space - for users to be allowed to run your code, you must become an entity that can be easily served a lawsuit should the need arise. You can't automate that, for the same reason you can't automate renewing your national ID/passport or automate starting a company.

andyfleming 3y ago

I'm not sure whether or not there's an issue of entitlement, but there's certainly incentives to develop a popular package (even if superficially). One big one is career development. For people early in their career, it's something they can proactively invest in, as where they can't magically materialize years of experience overnight.

Dalewyn 3y ago

There is definitely an argument to be made that open source should be viewed and treated as a business model, particularly if there are financial costs involved which must be paid one way or another. Dogma and fervor don't pay the bills.

alkonaut 3y ago

Still, high profile projects should be able to raise this type of money with ease. If they would say “Would match our ‘donation’ and donate $10 each year that we put in $1k in labor to this project?” that sounds like some commercial users would accept. But the first problem with medium scale OSS like this is that it’s no one’s hobby to manage projects or beg for money. It’s also a problem that OSS contribution/sponsorship isn’t normalized in corporations. I could much easier get permission to buy a $5k piece of software than donate $5 to an OSS project that powers out largest project and has been maintained for 10 years by a single person.

TeMPOraL 3y ago
But why should they raise this money? The unspoken assumption here is that code signing is a good thing. I question this assumption, particularly with how this works today. Microsoft, the cert issuers, and other companies involved in this are trying to create a reality in which software must always be attached to a specific legal entity, and then that entity must be vetted through the "corporate web of trust". That $629 (per year?) isn't paying to access/license a feature. It's a membership fee in that "corporate web of trust". It's a nice way to disempower users and individual developers, while effectively commercializing the entire Open Source space. "Want to have your open source project to have any users (on proprietary OS-es)? You need to start a company and sign a contract with one of our approved business friends."
- alkonaut 3y ago
  As the comments on the issue suggests, $629 is not the minimum price tag. It can be much cheaper without being more complicated. But I agree Microsoft could probably make it easier and cheaper but I can’t see why they would want that given they want to drive apps to stores and not self publishing. They want the bad method of publishing to have bad ergonomics. A letsencrypt style signing process would be possible and would let people base the trust on the ownership of company.com instead of a regular cert. And for most use cases this seems good enough.
  - TeMPOraL 3y ago
    > A letsencrypt style signing process would be possible and would let people base the trust on the ownership of company.com instead of a regular cert. And for most use cases this seems good enough. Except it seems that's not what they want at all. LetsEncrypt works because we've worked out it's sufficient for purposes of HTTPS to attest that "you" own the domain company.com, which is verified by making you do something that can be done only when "you" are in control of what company.com DNS points at. The nature of "you" is immaterial, out of scope - only demonstrating control over a domain matters. This lends itself to automation. What they want to do with code signing is to pin the code to a specific legal entity. That's crossing from data integrity/provenance straight to KYC/legal space - for users to be allowed to run your code, you must become an entity that can be easily served a lawsuit should the need arise. You can't automate that, for the same reason you can't automate renewing your national ID/passport or automate starting a company.