4 ms·

If companies insist on always taking the easy way out, they continue to introduce a significant amount of risk. This, each company needs to take some amount of

If companies insist on always taking the easy way out, they continue to introduce a significant amount of risk. This, each company needs to take some amount of responsibility for the stack that they use. A company that I worked for, sponsored upstream maintainers, sometimes for implementing specific functionality, sometimes without any specific goal. If more companies did this for their open source stacks, open source development would be much better funded. Of course, it will always be hard to detect very sophisticated attacks from actors that can play the long game. But if maintenance is not just a hobby, PRs can receive more attention, and if it's not an added workload besides a day job, there is less churn/burn-out which can be used for malicious actors to take over a project.

bradley13 3y ago
"...each company needs to take some amount of responsibility for the stack that they use. A company that I worked for, sponsored upstream maintainers, sometimes for implementing specific functionality, sometimes without any specific goal. If more companies did this for their open source stacks, open source development would be much better funded." Agreed, 100%. And yet: In a comment on Slashdot one guy said that his company had "thousands" of machines running Linux, and he was "proud" to have never paid a penny for it. I called him a parasite: open-source brings an immense value to his company, and he should support it. My comment got a lot of hate, which I just don't understand. Sure, OSS licenses say you can do whatever you want. However, there is surely some ethical obligation to support something that your entire business depends on?
- Salgat 3y ago
  It sounds to me like that person was at least helping to legitimize and popularize the software they use. Open source needs users just as bad as it needs contributors to be successful. Linux would have died if it never had large scale adoption by "parasites".
  - throwup238 3y ago
    “We’ll pay you in exposure”
    - ChrisMarshallNY 3y ago
      There's a T-shirt for that: https://dribbble.com/shots/2672066-Exposure-Bucks https://dribbble.com/shots/2672066-Exposure-Bucks
    - Salgat 3y ago
      Most open source contributors aren't doing it to be paid; if there isn't enough demand or support they simply stop working on it and that's it. Usually once a project is big enough then there's enough demand from users that big companies start donating both money and employee time towards a project (AWS for example had dedicated employees contributing to Redis, and Linux as a foundation is supported by countless companies). The emphasis is on the money going towards supporting the project to keep it sustained, not maximizing profit.
      - dspillett 3y ago
        > Usually once a project is big enough then there's enough demand from users that big companies start donating both money and employee time towards a project I don't agree with “usually” there, I think it is an exception rather than the rule. Where it happens, it tends to be higher profile, top-level, visible, projects that get this treatment from the commercial bodies that rely on them. The smaller projects that they might depend upon are likely to stay less visible, less thanked, and unsupported by those using them (directly or indirectly). What has happened with xzutils is a very good example of this and the potential dangers the situation poses. I don't know how we should address this. It certainly isn't the responsibility of people like Collin to address, unless of course they want to take on that responsibility. > if there isn't enough demand or support they simply stop working on it and that's it Sometimes even if there is enough demand they stop, as is their right, when other priorities come up in their life (or they simply lose interest). A “community” using their stuff does not, and should not, automatically make them beholden to that community.
- lifeisstillgood 3y ago
  I have been paid to write FOSS, I have paid others to do so, I have dragged cheques out of major banks to sponsor conferences. And yet I still do not know of a convincing way to get money from where it sits to the pockets of all the devs working on the stack, let alone in a fair manner, let alone in a way to allow the vibrant and high quality development processes that exist (ie “the government pays developers” will almost certainly be a dead hand on development) Honestly the problem feels Like it is capitalism itself … which is weird.
  - baq 3y ago
    It is. You don’t spend money if you don’t have to unless you are motivated by something that isn’t ‘more money‘. E.g. taxes or charity (which let’s face it is usually taxes). Thus if the license says ‘you don’t have to pay money to use this, nor do you have to do anything at all’ it’s no wonder it gets used for nothing in return. Stallman was obviously right with the GPL keeping the source free instead of end users.
  - vladms 3y ago
    Why do you mention capitalism and not economy in general ? Any resource allocation exercise is "complex" and "hard". Probably there is a better way but I expect any progress to be slow. The open source movement started in the 80's and it took a long time to become (a bit more) mainstream.
    - hhshhhhjjjd 3y ago
      Because they are one and the same?
    - hagbard_c 3y ago
      I have asked that question many times [1] when confronted with this type of muhhh capitalism remark and have yet to receive a valid response. I suspect it is the result of the ideological lopsided makeup of educational institutions which churn out the message that capitalism bad, ${my_ideology} good where ${my_ideology} tends to stand for one on the left side of the political spectrum. This does not provide students with the means to actually defend their position, only with the correct slogans to use - a rather shallow base for a political conviction. Of course HN is not the place to discuss politics so in some way it is probably for the best that these questions remain unanswered. It would be better still for those muhhh capitalism - and for that matter muhhh whatever-ism - remarks to remain unwritten since they are not supposed to be discussed here anyway. [1] e.g. https://news.ycombinator.com/item?id=39866101 https://news.ycombinator.com/item?id=39866101
- matwood 3y ago
  I have found the loudest complainers almost always end up the ones who are not paying.
  - technofiend 3y ago
    OpenBSD's famously crusty owner along with his leads short-circuit this sort of entitlement by asking "If you have a complaint, where's your commit to fix it?"
    - NovemberWhiskey 3y ago
      Honestly, I loathe that attitude. Maybe OpenBSD has such a limited audience that the overlap between "people who discover problems" and "people who can fix problems" is perfect, but generally it's not.
      - Salgat 3y ago
        To add, there's a massive difference between legitimate criticism and ungrateful entitlement. Complaints, even bad ones, are a crucial part of the feedback loop. If 99% of users say "this is terrible" with no elaboration, sure it doesn't tell you much, but it sure as shit means that there is probably something wrong that needs to be fixed.
        dspillett 3y ago
        Or it could mean that the 99%, or a large part thereof, have chosen the wrong tool for their task, which is a problem for them to fix not the tool's maker.
        Salgat 3y ago
        Could mean a lot of things, could mean nothing at all.
      - ChrisMarshallNY 3y ago
        Well, there's a drawback to that attitude, in the realm of "unintended consequences." I wrote a little article about that: https://littlegreenviper.com/miscellany/problems-and-solutions/ https://littlegreenviper.com/miscellany/problems-and-solutio...
ChrisMarshallNY 3y ago
Well, you could have a "board," that reviews and rates software. Kind of like financial rating companies. There could be a lot of variables to the rating, like the size of the team, the language, the testing methodology, etc. The board would need to be supported by end-users, and big steps would need to be taken to ensure true independence. It would have to be carefully done, though, and likely immensely unpopular with the HN crowd.
- tonyarkles 3y ago
  While I’m not specifically opposed to this, you have to be careful about the edge cases and how they end up being rated. SQLite is a great example for the variables you started with: > Size of team 3, with no outside contributions accepted into the core. > The language C Those two, presumably, would end up being heavily weighted towards having a low score. > Testing methodology Here they’d probably get some points back based on their ~10:1 test lines vs code ratio.
  - red-iron-pine 3y ago
    i think you have it backwards. giant teams == big risks, esp. if there isn`t strict and formal processes to eval the new contributors 3 people are easy to evaluate, have been on the project forever, and presumably know what they`re doing. C shouldn`t be a problem per se -- again, it`s been around a lot, and while it makes it easy to bork pointers, it`s not a meme language that we don`t know much about
  - ChrisMarshallNY 3y ago
    C is what Linux and Git are written in. Just because the kidz doan' like it, does not mean it's bad. 1 is the loneliest number (have to be an old fart to get that), but big teams can be a problem (Camel is a horse designed by committee). I'd say the experience and track record of the principals are a big factor (see "Linux" and "Git").
- shrimp_emoji 3y ago
  You could have a "Foundation" funded by corporate stakeholders. It doesn't even have to have a scope as broad as all open source software; it could be a "Linux Foundation". Google and Amazon and Netflix and whomever else uses Linux would be members of this Foundation on some kind of tiered plan, and their membership fees would go to maintaining critical, Linux-adjacent software.
acdha 3y ago
> This, each company needs to take some amount of responsibility for the stack that they use. A company that I worked for, sponsored upstream maintainers, sometimes for implementing specific functionality, sometimes without any specific goal. If more companies did this for their open source stacks, open source development would be much better funded. This is good but I don’t think it’s enough to cover stuff like this which is deep in the stack and probably doesn’t have enough demand to warrant the trouble of direct funding (thinking of how many organizations make it easier to buy a $50k support contract than a $50 open source donation). I’ve been wondering if you could get companies to pay to something like the Linux Foundation, Apache, etc. for a general maintainer group tasked with basically taking something like Debian’s popcon and going down the list of things which aren’t well-established projects to pick up maintenance work.
plg94 3y ago
One of the problems with the "money solution" in this case is that xz is a very small, relatively stable software. Sure things like the linux kernel, firefox, gnome or openssh could use huge donations to fund multiple developer day jobs for years. But xz is small, it doesn't need to add a lot of new features constantly. It does need maintenance, but probably only like a couple hours each month – surely not enough to warrant a full-time day job. So what does the dev do to spend the other 90% of his time (and earn the other 90% of the money)? Some people don't like juggling multiple jobs (very stressy), some corporate jobs don't allow it, plus you've done nothing to reduce the Bus-factor (ideally any vital library should have 2,3,… people working on it, but who can take of just 5% of his day job to devote to open source maintenance?)

bradley13 3y ago

"...each company needs to take some amount of responsibility for the stack that they use. A company that I worked for, sponsored upstream maintainers, sometimes for implementing specific functionality, sometimes without any specific goal. If more companies did this for their open source stacks, open source development would be much better funded." Agreed, 100%. And yet: In a comment on Slashdot one guy said that his company had "thousands" of machines running Linux, and he was "proud" to have never paid a penny for it. I called him a parasite: open-source brings an immense value to his company, and he should support it. My comment got a lot of hate, which I just don't understand. Sure, OSS licenses say you can do whatever you want. However, there is surely some ethical obligation to support something that your entire business depends on?

Salgat 3y ago
It sounds to me like that person was at least helping to legitimize and popularize the software they use. Open source needs users just as bad as it needs contributors to be successful. Linux would have died if it never had large scale adoption by "parasites".
- throwup238 3y ago
  “We’ll pay you in exposure”
  - ChrisMarshallNY 3y ago
    There's a T-shirt for that: https://dribbble.com/shots/2672066-Exposure-Bucks https://dribbble.com/shots/2672066-Exposure-Bucks
  - Salgat 3y ago
    Most open source contributors aren't doing it to be paid; if there isn't enough demand or support they simply stop working on it and that's it. Usually once a project is big enough then there's enough demand from users that big companies start donating both money and employee time towards a project (AWS for example had dedicated employees contributing to Redis, and Linux as a foundation is supported by countless companies). The emphasis is on the money going towards supporting the project to keep it sustained, not maximizing profit.
    - dspillett 3y ago
      > Usually once a project is big enough then there's enough demand from users that big companies start donating both money and employee time towards a project I don't agree with “usually” there, I think it is an exception rather than the rule. Where it happens, it tends to be higher profile, top-level, visible, projects that get this treatment from the commercial bodies that rely on them. The smaller projects that they might depend upon are likely to stay less visible, less thanked, and unsupported by those using them (directly or indirectly). What has happened with xzutils is a very good example of this and the potential dangers the situation poses. I don't know how we should address this. It certainly isn't the responsibility of people like Collin to address, unless of course they want to take on that responsibility. > if there isn't enough demand or support they simply stop working on it and that's it Sometimes even if there is enough demand they stop, as is their right, when other priorities come up in their life (or they simply lose interest). A “community” using their stuff does not, and should not, automatically make them beholden to that community.
lifeisstillgood 3y ago
I have been paid to write FOSS, I have paid others to do so, I have dragged cheques out of major banks to sponsor conferences. And yet I still do not know of a convincing way to get money from where it sits to the pockets of all the devs working on the stack, let alone in a fair manner, let alone in a way to allow the vibrant and high quality development processes that exist (ie “the government pays developers” will almost certainly be a dead hand on development) Honestly the problem feels Like it is capitalism itself … which is weird.
- baq 3y ago
  It is. You don’t spend money if you don’t have to unless you are motivated by something that isn’t ‘more money‘. E.g. taxes or charity (which let’s face it is usually taxes). Thus if the license says ‘you don’t have to pay money to use this, nor do you have to do anything at all’ it’s no wonder it gets used for nothing in return. Stallman was obviously right with the GPL keeping the source free instead of end users.
- vladms 3y ago
  Why do you mention capitalism and not economy in general ? Any resource allocation exercise is "complex" and "hard". Probably there is a better way but I expect any progress to be slow. The open source movement started in the 80's and it took a long time to become (a bit more) mainstream.
  - hhshhhhjjjd 3y ago
    Because they are one and the same?
  - hagbard_c 3y ago
    I have asked that question many times [1] when confronted with this type of muhhh capitalism remark and have yet to receive a valid response. I suspect it is the result of the ideological lopsided makeup of educational institutions which churn out the message that capitalism bad, ${my_ideology} good where ${my_ideology} tends to stand for one on the left side of the political spectrum. This does not provide students with the means to actually defend their position, only with the correct slogans to use - a rather shallow base for a political conviction. Of course HN is not the place to discuss politics so in some way it is probably for the best that these questions remain unanswered. It would be better still for those muhhh capitalism - and for that matter muhhh whatever-ism - remarks to remain unwritten since they are not supposed to be discussed here anyway. [1] e.g. https://news.ycombinator.com/item?id=39866101 https://news.ycombinator.com/item?id=39866101
matwood 3y ago
I have found the loudest complainers almost always end up the ones who are not paying.
- technofiend 3y ago
  OpenBSD's famously crusty owner along with his leads short-circuit this sort of entitlement by asking "If you have a complaint, where's your commit to fix it?"
  - NovemberWhiskey 3y ago
    Honestly, I loathe that attitude. Maybe OpenBSD has such a limited audience that the overlap between "people who discover problems" and "people who can fix problems" is perfect, but generally it's not.
    - Salgat 3y ago
      To add, there's a massive difference between legitimate criticism and ungrateful entitlement. Complaints, even bad ones, are a crucial part of the feedback loop. If 99% of users say "this is terrible" with no elaboration, sure it doesn't tell you much, but it sure as shit means that there is probably something wrong that needs to be fixed.
      - dspillett 3y ago
        Or it could mean that the 99%, or a large part thereof, have chosen the wrong tool for their task, which is a problem for them to fix not the tool's maker.
        Salgat 3y ago
        Could mean a lot of things, could mean nothing at all.
    - ChrisMarshallNY 3y ago
      Well, there's a drawback to that attitude, in the realm of "unintended consequences." I wrote a little article about that: https://littlegreenviper.com/miscellany/problems-and-solutions/ https://littlegreenviper.com/miscellany/problems-and-solutio...

ChrisMarshallNY 3y ago

Well, you could have a "board," that reviews and rates software. Kind of like financial rating companies. There could be a lot of variables to the rating, like the size of the team, the language, the testing methodology, etc. The board would need to be supported by end-users, and big steps would need to be taken to ensure true independence. It would have to be carefully done, though, and likely immensely unpopular with the HN crowd.

tonyarkles 3y ago
While I’m not specifically opposed to this, you have to be careful about the edge cases and how they end up being rated. SQLite is a great example for the variables you started with: > Size of team 3, with no outside contributions accepted into the core. > The language C Those two, presumably, would end up being heavily weighted towards having a low score. > Testing methodology Here they’d probably get some points back based on their ~10:1 test lines vs code ratio.
- red-iron-pine 3y ago
  i think you have it backwards. giant teams == big risks, esp. if there isn`t strict and formal processes to eval the new contributors 3 people are easy to evaluate, have been on the project forever, and presumably know what they`re doing. C shouldn`t be a problem per se -- again, it`s been around a lot, and while it makes it easy to bork pointers, it`s not a meme language that we don`t know much about
- ChrisMarshallNY 3y ago
  C is what Linux and Git are written in. Just because the kidz doan' like it, does not mean it's bad. 1 is the loneliest number (have to be an old fart to get that), but big teams can be a problem (Camel is a horse designed by committee). I'd say the experience and track record of the principals are a big factor (see "Linux" and "Git").
shrimp_emoji 3y ago
You could have a "Foundation" funded by corporate stakeholders. It doesn't even have to have a scope as broad as all open source software; it could be a "Linux Foundation". Google and Amazon and Netflix and whomever else uses Linux would be members of this Foundation on some kind of tiered plan, and their membership fees would go to maintaining critical, Linux-adjacent software.

acdha 3y ago

> This, each company needs to take some amount of responsibility for the stack that they use. A company that I worked for, sponsored upstream maintainers, sometimes for implementing specific functionality, sometimes without any specific goal. If more companies did this for their open source stacks, open source development would be much better funded. This is good but I don’t think it’s enough to cover stuff like this which is deep in the stack and probably doesn’t have enough demand to warrant the trouble of direct funding (thinking of how many organizations make it easier to buy a $50k support contract than a $50 open source donation). I’ve been wondering if you could get companies to pay to something like the Linux Foundation, Apache, etc. for a general maintainer group tasked with basically taking something like Debian’s popcon and going down the list of things which aren’t well-established projects to pick up maintenance work.

plg94 3y ago

One of the problems with the "money solution" in this case is that xz is a very small, relatively stable software. Sure things like the linux kernel, firefox, gnome or openssh could use huge donations to fund multiple developer day jobs for years. But xz is small, it doesn't need to add a lot of new features constantly. It does need maintenance, but probably only like a couple hours each month – surely not enough to warrant a full-time day job. So what does the dev do to spend the other 90% of his time (and earn the other 90% of the money)? Some people don't like juggling multiple jobs (very stressy), some corporate jobs don't allow it, plus you've done nothing to reduce the Bus-factor (ideally any vital library should have 2,3,… people working on it, but who can take of just 5% of his day job to devote to open source maintenance?)