8 ms·

I am not a supplier (2022)

121 points by MaysonL 3y ago

susam 3y ago
About a decade or so ago, I found the way free and open source software was used in commercial projects seemed to better align with the warranty disclaimers of the open source licenses. For example, I remember in a C++ project I worked on back then, every single dependency was committed along with the project. Today this practice is known by the term "vendoring". And, yes, there was no supplier. To illustrate my point, let us consider the case of Net-SNMP which was one of the projects I had direct experience with back then. We had the entire source code of Net-SNMP checked into our own project repository. From that point on, it was our responsibility to understand/maintain/update/upgrade/patch/customise the code (at least the parts that we relied on). When something didn't work the way it was supposed to, it was one of the employer's developers responsibility to figure out how to make it work. If needed, sometimes we would even engage with the community around the project in their IRC channels or mailing lists, to figure out how to solve our problems and sometimes such engagement might even end up benefitting both the community and us. But at no point there was the notion of a supplier or "they" or "them". It was always "we". We decided to take this gift called Net-SNMP. We decided to use it develop our software. So it was now our responsibility to keep it in good shape. After all, the employer's developers were getting paid for it. Now I know in today's world of software engineering, it is no longer possible to tend to every single dependency that is pulled into a project. There are thousands and thousands of them in every project. The way software engineering is done today is vastly different from how it was done a decade or two ago. There has been a Cambrian explosion of programming languages, open source software, frameworks, ecosystems, etc. It is impractical to assume the ownership of the thousands of dependencies that get pulled into every project and I think this is why the notion of "they" or the mythical "supplier" implicitly creeps in. While this rising complexity has resulted in increased speed and agility of software development, we have lost the simplicity and clear sense of ownership of code we rely on, which I believe was more prevalent a decade or so ago.
- ChrisMarshallNY 3y ago
  Thanks for that. It is pretty much the way that I look at things. It was also the way that the company that I worked for, did things. They would never have blindly relied on some outside supply chain. In some cases, we were only given opaque binaries to add (licensing/contract stuff), but we checked that binary into CM, and it was part of our product. Testing, calibration, accountability, etc., was all on us. If the vendor software failed, it was our failure, and we were Responsible for fixing it (which may have consisted of frantic calls to the vendor). We also did not add any free software. Indeed, we actually paid a company beaucoup bucks, to scan our software, and let us know of any unlicensed software. It was really important to establish full provenance of every line of code in our products. We had good lawyers.
  - vsnf 3y ago
    > We also did not add any free software What does this really mean? Did you use some paid language/compiler ala Borland? Did you write all your own libraries? Without huge resources, like an intelligence agency or multinational, I don’t see how it’s possible to not use any free software. Unless these stories take place 30 years ago or something.
    - dartos 3y ago
      I’m working somewhere now where we’re building everything above the network transport layer from scratch. We just built an in memory IPC and rpc protocol on top of UDP. You can just do that. It’s not as easy to use as grpc+protobuf. Probably not as fast, almost certainly not as correct, but you can do it.
      - couchand 3y ago
        More half-broken solutions is not the answer...
      - 01HNNWZ0MV43FF 3y ago
        If it's not as fast or correct... Why?
fmajid 3y ago
Let's be very clear: when a commercial outfit uses open-source software, the "supplier" is the person who imported the project, not the original author.
pards 3y ago
> You are not buying from a supplier, you are a raccoon digging through dumpsters for free code. That implies that the FOSS code is garbage which we all know it is not. > I am more than happy to become a supplier[...] which means you are going to have to start to pay me. I'd love to see large enterprises contribute _something_ to FOSS. In many cases, they forbid their staff from contributing code and they certainly don't contribute in any way financially. It's astounding, really, that much of our financial system relies on FOSS libraries like OpenSSL, Spring, and Apache and yet they do little to ensure its ongoing health.
- WJW 3y ago
  I don't think that is astounding at all. Most companies have been contributing nothing for decades and all the work gets done anyway!!! Every once in a while some FOSS maintainer quits and writes an angry blog post, but in aggregate all these projects seem to keep ticking along just fine. If one projects dies or starts charging money, several other sprout up that don't; the recent Redis kerfuffle is a prime example.
- falcor84 3y ago
  > That implies that the FOSS code is garbage which we all know it is not. That's not quite how I read it. FOSS in general (e.g. public github as a whole) is a "pile" of projects widely ranging in quality, most relatively poor. It's up to all of us to use our "raccoon noses" to find the treasures or "diamonds in the rough".
  - Dalewyn 3y ago
    To add to this, the raccoon is looking for free-as-in-beer food. What do most people (including businesses) want? Free-as-in-beer software, because nobody wants to pay out unless they get an invoice in the mail. What does FOSS provide? Free-as-in-beer open source software.
    - pavel_lishin 3y ago
      What's more, if the raccoon is particularly savvy - or let's say, he's a human dumpster diver looking for one-day-past-expiration bread - he's aware that some stores will pour bleach onto their food products. He knows the risks, and it's kind of silly to suggest that the store throwing out the bread owes it to the raccoon to provide it on a fine dining platter.
renewiltord 3y ago
Okay, we're going to call it Provenance Chain. There. Solved.
layer8 3y ago
(2022)
lifeisstillgood 3y ago
Vendoring is the right attitude even if it is not the solution. Each company should know exactly its dependancies (ie S-BOM), and if there is a problem, they should look to produce their own patch and release that. Now this second part is … a little naive, but it’s quite feasible for that to become a middle ground industry. The big distributions are fine but as a thought experiment imagine a group of ISVs focused on say python web services. They can provide an immutable nix-like definition of a simplified stack, keep a treadmill of updates and security patches, probably as binaries. I think there is unlikely to be a way such “focused distros” will ever give up warranties so perhaps we are not making progress. However until we live in a global socialist utopia, we need to find some way of making the “raccoon in the dumpster” get paid.
- layer8 3y ago
  Linux distributions like Debian (stable) are in principle such vetted dependencies that only receive security updates and are otherwise stable for a number of years. It’s a good model, and would make sense to commercialize more generally. Of course, still no one would want to take liability.
michalc 3y ago
> If you use this, I owe you nothing. Sure the legalese states I owe nothing, but if I’ve shared the code, written some documentation, and encouraged others to use it as I have on a few projects… … I feel as though I do owe something. I feel like I’ve made a sort of social contract to provide a bit of support on what I’ve, er, “supplied”. Not really sure why.
- 01HNNWZ0MV43FF 3y ago
  The same happens in literature. Frankly I feel like George r. R. Martin slightly owes his readers an ending, since some of the appeal of long stories is that they promise payoffs towards the end. With software I actually understand it less. I don't do "cargo add" and then think "just imagine how good chapter 2 will be!"
  - gorjusborg 3y ago
    I have always thought the attitude that a creator 'owes' a sequel to fans as extreme entitlement on the part of those fans. So I think the analogy is good, but I disagree that the creator ever owes anything to ones benefitting from their initial work.
    - 01HNNWZ0MV43FF 3y ago
      I'm saying people probably don't download software expecting for the next version to make it worthwhile, but they often read books on an implied promise that the story threads will eventually be all tied up. Objectively, yes, it's entitlement. All you can really do is avoid pop culture entirely and not start a series until the author is done writing, I guess
- ozim 3y ago
  I would say "I owe you nothing" should be directed at companies that would like to push maintainers to do fixes because they need them. I believe that maintainer by participating in FOSS getting followers/contributors owes to the community good stewardship so maintenance and at least keeping security fixes and nasty bugs prioritized. If someone doesn't want the burden then no need to publish stuff or publish it and actively discourage the use, but usually people publish and try to build a community, but when one has built a community, it comes with responsibilities as well.
dhx 3y ago
For fun, let's assume you are a supplier, whatever that means. Let's say you are Autodesk, and you've been told you need to create a SBOM for AutoCAD in CycloneDX. You have to complete "manufacturer", "supplier", "publisher" and "author" fields, which the standard makes no attempt to disambiguate for you. Which corporate entities do you list against each field? ADSK IRELAND LIMITED (IE), ADSK NORWAY AS (NO), ADSK NORWAY HOLDINGS AS (NO), AUTODESK AB (NO), AUTODESK AMERICAS LLC (US), AUTODESK ASIA PTE LTD (SG), AUTODESK ASIA PTE LTD (MY), etc (there are pages of options) Do you need to list the specialty consulting firm that was engaged by a small subsidiary office in whatever country for 20 weeks to implement a file import function for a third party file format? If yes, which part of their Double Irish with a Dutch Sandwich corporate structure do you list? Also for fun, let's assume you're an American company that buys copyright ownership and complete rights of proprietary software originally developed by an Irish company. You immediately re-release the software with a new loading screen logo, "About" dialog, etc changed to your brand name, and a new SBOM is released. Which part of your Double Irish with a Dutch Sandwich corporate structure do you list as "manufacturer", "supplier", "publisher" and "author" fields? Which part of the Irish company (or whatever complex corporate structure may exist) do you list in any of these fields, if any get listed at all? If you did list the Irish company, after 5 years when most code has been rewritten but only a few small bits and pieces remain, does this change whether you mention the Irish company that worked on the software 5 years ago?
deleted 3y ago
[deleted]
BlarfMcFlarf 3y ago
People get upset that someone “broke” their dependency. But with FOSS, that’s impossible, since you still have the code you relied on, right? What they did is release a new piece of code, called a new “version”, and you made some bad assumptions that are not just founded in any contract, but are actively rejected by the contract (“software is provided as is” clause).
CRConrad 3y ago
2024 (kind of) follow-up: https://www.softwaremaxims.com/blog/open-source-hobbyists-turf https://www.softwaremaxims.com/blog/open-source-hobbyists-tu... https://news.ycombinator.com/item?id=39910558 https://news.ycombinator.com/item?id=39910558

121 points by MaysonL 3y ago

About a decade or so ago, I found the way free and open source software was used in commercial projects seemed to better align with the warranty disclaimers of the open source licenses. For example, I remember in a C++ project I worked on back then, every single dependency was committed along with the project. Today this practice is known by the term "vendoring". And, yes, there was no supplier. To illustrate my point, let us consider the case of Net-SNMP which was one of the projects I had direct experience with back then. We had the entire source code of Net-SNMP checked into our own project repository. From that point on, it was our responsibility to understand/maintain/update/upgrade/patch/customise the code (at least the parts that we relied on). When something didn't work the way it was supposed to, it was one of the employer's developers responsibility to figure out how to make it work. If needed, sometimes we would even engage with the community around the project in their IRC channels or mailing lists, to figure out how to solve our problems and sometimes such engagement might even end up benefitting both the community and us. But at no point there was the notion of a supplier or "they" or "them". It was always "we". We decided to take this gift called Net-SNMP. We decided to use it develop our software. So it was now our responsibility to keep it in good shape. After all, the employer's developers were getting paid for it. Now I know in today's world of software engineering, it is no longer possible to tend to every single dependency that is pulled into a project. There are thousands and thousands of them in every project. The way software engineering is done today is vastly different from how it was done a decade or two ago. There has been a Cambrian explosion of programming languages, open source software, frameworks, ecosystems, etc. It is impractical to assume the ownership of the thousands of dependencies that get pulled into every project and I think this is why the notion of "they" or the mythical "supplier" implicitly creeps in. While this rising complexity has resulted in increased speed and agility of software development, we have lost the simplicity and clear sense of ownership of code we rely on, which I believe was more prevalent a decade or so ago.

ChrisMarshallNY 3y ago
Thanks for that. It is pretty much the way that I look at things. It was also the way that the company that I worked for, did things. They would never have blindly relied on some outside supply chain. In some cases, we were only given opaque binaries to add (licensing/contract stuff), but we checked that binary into CM, and it was part of our product. Testing, calibration, accountability, etc., was all on us. If the vendor software failed, it was our failure, and we were Responsible for fixing it (which may have consisted of frantic calls to the vendor). We also did not add any free software. Indeed, we actually paid a company beaucoup bucks, to scan our software, and let us know of any unlicensed software. It was really important to establish full provenance of every line of code in our products. We had good lawyers.
- vsnf 3y ago
  > We also did not add any free software What does this really mean? Did you use some paid language/compiler ala Borland? Did you write all your own libraries? Without huge resources, like an intelligence agency or multinational, I don’t see how it’s possible to not use any free software. Unless these stories take place 30 years ago or something.
  - dartos 3y ago
    I’m working somewhere now where we’re building everything above the network transport layer from scratch. We just built an in memory IPC and rpc protocol on top of UDP. You can just do that. It’s not as easy to use as grpc+protobuf. Probably not as fast, almost certainly not as correct, but you can do it.
    - couchand 3y ago
      More half-broken solutions is not the answer...
    - 01HNNWZ0MV43FF 3y ago
      If it's not as fast or correct... Why?

fmajid 3y ago

Let's be very clear: when a commercial outfit uses open-source software, the "supplier" is the person who imported the project, not the original author.

pards 3y ago

> You are not buying from a supplier, you are a raccoon digging through dumpsters for free code. That implies that the FOSS code is garbage which we all know it is not. > I am more than happy to become a supplier[...] which means you are going to have to start to pay me. I'd love to see large enterprises contribute _something_ to FOSS. In many cases, they forbid their staff from contributing code and they certainly don't contribute in any way financially. It's astounding, really, that much of our financial system relies on FOSS libraries like OpenSSL, Spring, and Apache and yet they do little to ensure its ongoing health.

WJW 3y ago
I don't think that is astounding at all. Most companies have been contributing nothing for decades and all the work gets done anyway!!! Every once in a while some FOSS maintainer quits and writes an angry blog post, but in aggregate all these projects seem to keep ticking along just fine. If one projects dies or starts charging money, several other sprout up that don't; the recent Redis kerfuffle is a prime example.
falcor84 3y ago
> That implies that the FOSS code is garbage which we all know it is not. That's not quite how I read it. FOSS in general (e.g. public github as a whole) is a "pile" of projects widely ranging in quality, most relatively poor. It's up to all of us to use our "raccoon noses" to find the treasures or "diamonds in the rough".
- Dalewyn 3y ago
  To add to this, the raccoon is looking for free-as-in-beer food. What do most people (including businesses) want? Free-as-in-beer software, because nobody wants to pay out unless they get an invoice in the mail. What does FOSS provide? Free-as-in-beer open source software.
  - pavel_lishin 3y ago
    What's more, if the raccoon is particularly savvy - or let's say, he's a human dumpster diver looking for one-day-past-expiration bread - he's aware that some stores will pour bleach onto their food products. He knows the risks, and it's kind of silly to suggest that the store throwing out the bread owes it to the raccoon to provide it on a fine dining platter.

renewiltord 3y ago

Okay, we're going to call it Provenance Chain. There. Solved.

layer8 3y ago

(2022)

lifeisstillgood 3y ago

Vendoring is the right attitude even if it is not the solution. Each company should know exactly its dependancies (ie S-BOM), and if there is a problem, they should look to produce their own patch and release that. Now this second part is … a little naive, but it’s quite feasible for that to become a middle ground industry. The big distributions are fine but as a thought experiment imagine a group of ISVs focused on say python web services. They can provide an immutable nix-like definition of a simplified stack, keep a treadmill of updates and security patches, probably as binaries. I think there is unlikely to be a way such “focused distros” will ever give up warranties so perhaps we are not making progress. However until we live in a global socialist utopia, we need to find some way of making the “raccoon in the dumpster” get paid.

layer8 3y ago
Linux distributions like Debian (stable) are in principle such vetted dependencies that only receive security updates and are otherwise stable for a number of years. It’s a good model, and would make sense to commercialize more generally. Of course, still no one would want to take liability.

michalc 3y ago

> If you use this, I owe you nothing. Sure the legalese states I owe nothing, but if I’ve shared the code, written some documentation, and encouraged others to use it as I have on a few projects… … I feel as though I do owe something. I feel like I’ve made a sort of social contract to provide a bit of support on what I’ve, er, “supplied”. Not really sure why.

01HNNWZ0MV43FF 3y ago
The same happens in literature. Frankly I feel like George r. R. Martin slightly owes his readers an ending, since some of the appeal of long stories is that they promise payoffs towards the end. With software I actually understand it less. I don't do "cargo add" and then think "just imagine how good chapter 2 will be!"
- gorjusborg 3y ago
  I have always thought the attitude that a creator 'owes' a sequel to fans as extreme entitlement on the part of those fans. So I think the analogy is good, but I disagree that the creator ever owes anything to ones benefitting from their initial work.
  - 01HNNWZ0MV43FF 3y ago
    I'm saying people probably don't download software expecting for the next version to make it worthwhile, but they often read books on an implied promise that the story threads will eventually be all tied up. Objectively, yes, it's entitlement. All you can really do is avoid pop culture entirely and not start a series until the author is done writing, I guess
ozim 3y ago
I would say "I owe you nothing" should be directed at companies that would like to push maintainers to do fixes because they need them. I believe that maintainer by participating in FOSS getting followers/contributors owes to the community good stewardship so maintenance and at least keeping security fixes and nasty bugs prioritized. If someone doesn't want the burden then no need to publish stuff or publish it and actively discourage the use, but usually people publish and try to build a community, but when one has built a community, it comes with responsibilities as well.

dhx 3y ago

For fun, let's assume you are a supplier, whatever that means. Let's say you are Autodesk, and you've been told you need to create a SBOM for AutoCAD in CycloneDX. You have to complete "manufacturer", "supplier", "publisher" and "author" fields, which the standard makes no attempt to disambiguate for you. Which corporate entities do you list against each field? ADSK IRELAND LIMITED (IE), ADSK NORWAY AS (NO), ADSK NORWAY HOLDINGS AS (NO), AUTODESK AB (NO), AUTODESK AMERICAS LLC (US), AUTODESK ASIA PTE LTD (SG), AUTODESK ASIA PTE LTD (MY), etc (there are pages of options) Do you need to list the specialty consulting firm that was engaged by a small subsidiary office in whatever country for 20 weeks to implement a file import function for a third party file format? If yes, which part of their Double Irish with a Dutch Sandwich corporate structure do you list? Also for fun, let's assume you're an American company that buys copyright ownership and complete rights of proprietary software originally developed by an Irish company. You immediately re-release the software with a new loading screen logo, "About" dialog, etc changed to your brand name, and a new SBOM is released. Which part of your Double Irish with a Dutch Sandwich corporate structure do you list as "manufacturer", "supplier", "publisher" and "author" fields? Which part of the Irish company (or whatever complex corporate structure may exist) do you list in any of these fields, if any get listed at all? If you did list the Irish company, after 5 years when most code has been rewritten but only a few small bits and pieces remain, does this change whether you mention the Irish company that worked on the software 5 years ago?

deleted 3y ago

[deleted]

BlarfMcFlarf 3y ago

People get upset that someone “broke” their dependency. But with FOSS, that’s impossible, since you still have the code you relied on, right? What they did is release a new piece of code, called a new “version”, and you made some bad assumptions that are not just founded in any contract, but are actively rejected by the contract (“software is provided as is” clause).

CRConrad 3y ago

2024 (kind of) follow-up: https://www.softwaremaxims.com/blog/open-source-hobbyists-turf https://www.softwaremaxims.com/blog/open-source-hobbyists-tu... https://news.ycombinator.com/item?id=39910558 https://news.ycombinator.com/item?id=39910558