3 ms·

I could have been much worse, but was identified last minute. Debian, Ubuntu and Fedora had the code only in their testing channels, and overall only .deb or .r

I could have been much worse, but was identified last minute. Debian, Ubuntu and Fedora had the code only in their testing channels, and overall only .deb or .rpm based distros with systemd have been affected (see https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78b... ). We have to make sure open source maintainers are not underpaid, and stop the madness of global commons exploitation.

rubymamis 3y ago
From a different comment of mine: > It baffles me how such an important package that so many Linux servers use every day is unmaintained by the original author due to insufficient funds. Something gotta change in OSS. I think one solution could be in licenses that force companies/business of certain sizes to pay maintenance fees. One idea from the top of my head.
- aeim 3y ago
  and governments
  - aborsy 3y ago
    and users, who could pay a monthly fee to GitHub that will distribute among maintainers. The donation system doesn’t work well. There ought to be streams of input funds.
    - iJohnDoe 3y ago
      This is a great idea and Github should look into this. Not easy to implement (which maintainers qualify for funds, etc) but should be looked into.
- deleted 3y ago
  [deleted]
- appplication 3y ago
  The problem is once you change the license and start charging, someone forks it and just offers a less funded, but free version of essentially the same, and the ecosystem fractures. See Redis, Terraform for recent examples. Not exactly the same, but in this context it’s funny how much ire they have drawn when really the root of it is “how do we ensure continuing to develop this software is financially supported by users”.
- __blockcipher__ 3y ago
  > I think one solution could be in licenses that force companies/business of certain sizes to pay maintenance fees. One idea from the top of my head. This just doesn't work. Fully open source software (as opposed to source available) is so much more useful than the alternative that there's always going to be an OSS fork for any sufficiently useful project. AFAICT Elasticsearch and Redis have not really "won" by their respective license changes but rather have just fragmented their own market and sown the eventual seeds of their destruction.

rubymamis 3y ago

From a different comment of mine: > It baffles me how such an important package that so many Linux servers use every day is unmaintained by the original author due to insufficient funds. Something gotta change in OSS. I think one solution could be in licenses that force companies/business of certain sizes to pay maintenance fees. One idea from the top of my head.

aeim 3y ago
and governments
- aborsy 3y ago
  and users, who could pay a monthly fee to GitHub that will distribute among maintainers. The donation system doesn’t work well. There ought to be streams of input funds.
  - iJohnDoe 3y ago
    This is a great idea and Github should look into this. Not easy to implement (which maintainers qualify for funds, etc) but should be looked into.
deleted 3y ago
[deleted]
appplication 3y ago
The problem is once you change the license and start charging, someone forks it and just offers a less funded, but free version of essentially the same, and the ecosystem fractures. See Redis, Terraform for recent examples. Not exactly the same, but in this context it’s funny how much ire they have drawn when really the root of it is “how do we ensure continuing to develop this software is financially supported by users”.
__blockcipher__ 3y ago
> I think one solution could be in licenses that force companies/business of certain sizes to pay maintenance fees. One idea from the top of my head. This just doesn't work. Fully open source software (as opposed to source available) is so much more useful than the alternative that there's always going to be an OSS fork for any sufficiently useful project. AFAICT Elasticsearch and Redis have not really "won" by their respective license changes but rather have just fragmented their own market and sown the eventual seeds of their destruction.