4 ms·

It baffles me how such an important package that so many Linux servers use every day is unmaintained by the original author due to insufficient funds. Something

It baffles me how such an important package that so many Linux servers use every day is unmaintained by the original author due to insufficient funds. Something gotta change in OSS. I think one solution could be in licenses that force companies/business of certain sizes to pay maintenance fees. One idea from the top of my head.

nicce 3y ago
> I think one solution could be in licenses that force companies/business of certain sizes to pay maintenance fees. One idea from the top of my head. Yet people have huge opposition for those licenses. The big scream of "not free anymore" starts and the entity gets cancelled.
- rubymamis 3y ago
  I think focusing on big organizations (e.g. above certain revenue/profit should help). There must be some sweet spot, after all, the organizations that rely on it should want it to be maintained as well.
  - chii 3y ago
    tragedy of the commons. If someone else can pay to maintain it, but you get the benefits, then it's the obvious strategy to use. And also, there's zero evidence that proprietary software won't have these backdoors. In fact, you can't even check them for it!
    - rubymamis 3y ago
      That's why I think such OSS packages should use licenses that force large companies to pay (moderate) fees for maintenance. I assume such sums of money won't even tickle them. Imagine 10 large companies, each pay $1000 a month for critical packages they use. For each developer, that's $10,000 they can either use to quit their current job or hire another person to share the burden. We need to normalize this.
      - chuckadams 3y ago
        You may as well just slap a "no commercial use" restriction on it. It takes months to go through procurement at the average big company, and still would if the package cost $1. Developers at these companies will find something else without the friction.
        rubymamis 3y ago
        Maybe we need a platform to make this easier?
        nicce 3y ago
        There is already GitHub Sponsors, for example. What we need to change from that?
        rubymamis 3y ago
        I’m not an expert on this. if it ticks all the legal and other issues big companies need to deal with in a frictionless manner, then that’s good. If not, maybe a different solution is needed.
      - bdd8f1df777b 3y ago
        You are conflating convenience with necessity. Currently large companies also use xz simply because it is configured to be the default in many distributions. If it charges them money, they will just move to zstd, brottoli, gzip or 7z. The first two are backed by large companies themselves who will not adopt these kind of licenses ever.
- matheusmoreira 3y ago
  Not really. Just make your software AGPLv3. It's literally the most free license GNU and the FSF have ever come up with. It ensures your freedom so hard the corporations cannot tolerate it. Now you have leverage. If the corporations want it so bad, they can have it. They just gotta ask for permission to use it under different terms. Then they gotta pay for it. https://www.gnu.org/philosophy/selling-exceptions.html https://www.gnu.org/philosophy/selling-exceptions.html All you have to do is not MIT or BSD license the software. When you do that, you're essentially transferring your intellectual property to the corporations at zero cost. Can't think of a bigger wealth transfer in history. From well meaning individual programmers and straight to the billionaires. The BSD style openness only makes sense in a world without intellectual property. Until the day copyright is abolished, it's either AGPLv3 or all rights reserved. Nothing else makes sense.
  - krick 3y ago
    The problem is, there will be almost zero packages that (very few) "corporations want so bad". The only exception might be cloud providers, that want to host your mildly-popular open-source message queue, but, again, if you are Amazon, you'll soon just re-implement that message queue, drop the "original" one, and after a couple of years your mildly-popular project will become not popular at all.
    - matheusmoreira 3y ago
      In that case we'll simply end up exactly where we started. There's a twist though. This time around we're not being taken for fools and exploited. Better to have a completely irrelevant forgotten project than a massively popular one that makes us zero dollars while CEOs make billions off of it. This post always comes to mind every time this topic comes up: https://web.archive.org/web/20120620103603/http://zedshaw.com/essays/why_i_gpl.html https://web.archive.org/web/20120620103603/http://zedshaw.co... > I want people to appreciate the work I’ve done and the value of what I’ve made. > Not pass on by waving “sucker” as they drive their fancy cars.
      - nicce 3y ago
concordDance 3y ago
> It baffles me how such an important package that so many Linux servers use every day is unmaintained by the original author due to insufficient funds. Is it actually insufficient funds or is it burnout?
- rubymamis 3y ago
  I'm not sure. I know from working on OSS projects personally that insufficient funds can easily lead to burnout as well. You gotta find other sources of revenue while STILL maintaining your OSS project.
- dingnuts 3y ago
  same thing; if you have money you can hire people to spread the burden
- junon 3y ago
  In the case of XZ it was more akin to burnout based on the literature around the time Jia Tan was instated.
anticristi 3y ago
The proposed EU Cyber resilience Act positions itself to be a solution. To put it simply, vendors are responsible for vulnerabilities throughout the lifetime of their products, whether that is a firewall or a toaster. Thus, the vendors are incentives to keep OSS secure, whether that means paying maintainers, commissioning code audits or hiring FTEs to contribute.
halJordan 3y ago
There's a difference between important and necessary. The package is necessary not important.
grumpyprole 3y ago
It baffles me why something as complex as xz is apparently needed. The code for bzip2 is tiny and would need a small fraction of one person to maintain.

nicce 3y ago

> I think one solution could be in licenses that force companies/business of certain sizes to pay maintenance fees. One idea from the top of my head. Yet people have huge opposition for those licenses. The big scream of "not free anymore" starts and the entity gets cancelled.

rubymamis 3y ago
I think focusing on big organizations (e.g. above certain revenue/profit should help). There must be some sweet spot, after all, the organizations that rely on it should want it to be maintained as well.
- chii 3y ago
  tragedy of the commons. If someone else can pay to maintain it, but you get the benefits, then it's the obvious strategy to use. And also, there's zero evidence that proprietary software won't have these backdoors. In fact, you can't even check them for it!
  - rubymamis 3y ago
    That's why I think such OSS packages should use licenses that force large companies to pay (moderate) fees for maintenance. I assume such sums of money won't even tickle them. Imagine 10 large companies, each pay $1000 a month for critical packages they use. For each developer, that's $10,000 they can either use to quit their current job or hire another person to share the burden. We need to normalize this.
    - chuckadams 3y ago
      You may as well just slap a "no commercial use" restriction on it. It takes months to go through procurement at the average big company, and still would if the package cost $1. Developers at these companies will find something else without the friction.
      - rubymamis 3y ago
        Maybe we need a platform to make this easier?
        nicce 3y ago
        There is already GitHub Sponsors, for example. What we need to change from that?
        rubymamis 3y ago
        I’m not an expert on this. if it ticks all the legal and other issues big companies need to deal with in a frictionless manner, then that’s good. If not, maybe a different solution is needed.
    - bdd8f1df777b 3y ago
      You are conflating convenience with necessity. Currently large companies also use xz simply because it is configured to be the default in many distributions. If it charges them money, they will just move to zstd, brottoli, gzip or 7z. The first two are backed by large companies themselves who will not adopt these kind of licenses ever.
matheusmoreira 3y ago
Not really. Just make your software AGPLv3. It's literally the most free license GNU and the FSF have ever come up with. It ensures your freedom so hard the corporations cannot tolerate it. Now you have leverage. If the corporations want it so bad, they can have it. They just gotta ask for permission to use it under different terms. Then they gotta pay for it. https://www.gnu.org/philosophy/selling-exceptions.html https://www.gnu.org/philosophy/selling-exceptions.html All you have to do is not MIT or BSD license the software. When you do that, you're essentially transferring your intellectual property to the corporations at zero cost. Can't think of a bigger wealth transfer in history. From well meaning individual programmers and straight to the billionaires. The BSD style openness only makes sense in a world without intellectual property. Until the day copyright is abolished, it's either AGPLv3 or all rights reserved. Nothing else makes sense.
- krick 3y ago
  The problem is, there will be almost zero packages that (very few) "corporations want so bad". The only exception might be cloud providers, that want to host your mildly-popular open-source message queue, but, again, if you are Amazon, you'll soon just re-implement that message queue, drop the "original" one, and after a couple of years your mildly-popular project will become not popular at all.
  - matheusmoreira 3y ago
    In that case we'll simply end up exactly where we started. There's a twist though. This time around we're not being taken for fools and exploited. Better to have a completely irrelevant forgotten project than a massively popular one that makes us zero dollars while CEOs make billions off of it. This post always comes to mind every time this topic comes up: https://web.archive.org/web/20120620103603/http://zedshaw.com/essays/why_i_gpl.html https://web.archive.org/web/20120620103603/http://zedshaw.co... > I want people to appreciate the work I’ve done and the value of what I’ve made. > Not pass on by waving “sucker” as they drive their fancy cars.
    - nicce 3y ago

concordDance 3y ago

> It baffles me how such an important package that so many Linux servers use every day is unmaintained by the original author due to insufficient funds. Is it actually insufficient funds or is it burnout?

rubymamis 3y ago
I'm not sure. I know from working on OSS projects personally that insufficient funds can easily lead to burnout as well. You gotta find other sources of revenue while STILL maintaining your OSS project.
dingnuts 3y ago
same thing; if you have money you can hire people to spread the burden
junon 3y ago
In the case of XZ it was more akin to burnout based on the literature around the time Jia Tan was instated.

anticristi 3y ago

The proposed EU Cyber resilience Act positions itself to be a solution. To put it simply, vendors are responsible for vulnerabilities throughout the lifetime of their products, whether that is a firewall or a toaster. Thus, the vendors are incentives to keep OSS secure, whether that means paying maintainers, commissioning code audits or hiring FTEs to contribute.

halJordan 3y ago

There's a difference between important and necessary. The package is necessary not important.

grumpyprole 3y ago

It baffles me why something as complex as xz is apparently needed. The code for bzip2 is tiny and would need a small fraction of one person to maintain.