5 ms·

On the one side: Yes, truer words have never been spoken. You want a new feature added? Want to talk about how the project should change directions? Want to imp

• trealira 2y ago
  > When you provide software that is widely used and that people rely on, you automatically created a community where fixing bugs is an obligation. Your software has become a corner stone in other people’s software stack/life and so those people and their issues with your software have become your problem, too. If you want it or not. Maybe you believe they have a moral obligation, but under the most popular open source licenses, they have no legal obligation to fix bugs or be held responsible for the damages caused by their bugs, regardless of whether people rely on their software for critical software. From the MIT license: THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. From the GPL license: 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. If you rely on open source software, you do so at your own risk, as the authors have no obligations to those who use the software they made, and it's written out explicitly all the time; people just skip past it.
• flohofwoe 2y ago
  Well, never use a dependency that you couldn't write or maintain yourself. It's really quite simple. As soon as you use a dependency, you take ownership of that code within your project. If you need changes made that the dependency owner isn't willing to do then fork the dependency. If you can't do that, don't use that dependency. The actual advantage of open source is that you actually have access to the code, create a fork and maintain it yourself if things go south.
  • Grimeton 2y ago
    Depencies within the project didn't refer to third party libraries, but to the knowledge how changes in function A or structure B affect the rest of the software. Changes to code can seem to have zero side effects and three months down the line it turns out that those changes caused huge security issues. And btw: If using open source software is only an option when I know all the languages needed to write all the stuff myself, then the whole thing just lost its meaning.
    • yawaramin 2y ago
      No, it didn't. Open source software doesn't mean that someone else provides free support for all the software (by knowing all the languages needed to write it). It means that you can choose any vendor you want to provide the software to you. Open source has never been about getting software for free, it has always been about preventing vendor lock-in.
    • kelnos 2y ago
      I think you're presenting false dichotomy. You seem to think that the only options are two extremes, either: a) open source developers are obligated to provide their users with fixes to any bugs they run into, or b) open source developers will never ever do anything for their users, so anyone who uses open source needs to be competent at maintaining and modifying all the open source software they use. I hope you don't truly believe that, and assuming you don't, I hope you aren't arguing this way in bad faith. Because neither of those things are true. Open source developers will often want to fix bugs in their software, and add new features that people find useful. A user need not assume they'll have to take ownership of everything they use and maintain it themselves. But an open source user has no right to demand anything from the developers. Sometimes the user will have to do their own work if they're having a problem, because sometimes those problems won't get addressed (either ever, or on a time scale that the user needs). And anyone who makes use of open source software should go into it with that understanding. I've done that myself: I've adopted open source libraries at work (and for personal projects), have found issues with them, fixed the issues, and sent PRs to the maintainers (and maintained and used my own forks until those PRs were merged and new releases made). On occasion when bugs I've found seemed like they'd require too much deep understanding of the code, I've filed issues and provided as much information as I could to help the maintainer reproduce the issues. Sometimes those bugs got fixed, and that's great. But sometimes they didn't. That's frustrating, to be sure, but those maintainers had no obligation to me. From there, I had three options: a) dive in and take the time to learn the software well enough so I could fix the bugs myself, b) live with the bugs being present and decide that that will be ok, or c) drop that software and find or write something else that met my needs. And all that above is what you sign up for if you decide to depend on someone else's open source work. If you don't like that, then you have two choices: a) write everything that you need yourself, or b) pay someone else for their work. That's it. You have no right to demand anything from any open source developer. For any project that I maintain... anyone who comes in believing I'm obligated to do whatever unpaid work they want from me immediately gets banned from whatever communication channel they're using to make those demands.
• pdonis 2y ago
  > When you provide software that is widely used and that people rely on, you automatically created a community where fixing bugs is an obligation. No, you don't. Some open source producers might choose to take on that extra burden, but giving your software away for free cannot automatically create such a burden, no matter how many people use it. The only recourse you have as a user if you don't like that deal is to not use the software. You don't have the right to demand more free work from someone who already provided you with free work.
  • ozim 2y ago
    How often it is that someone just gives software for free? I mean usually you have to promote software and by promoting you create an obligation - no one is going to use it if you drop some piece of code on GH and in reader you will write „I don’t care about it take it or leave it”. You have to actively promote and show that you care to create „widely used software”. Promoting by showing that you care creates the obligation. Of course obligation is not entitling people to tell you what to do - but to keep level of decency like fixing glaring security flaws.
    • pdonis 2y ago
      > Promoting by showing that you care creates the obligation. Promoting by promising to fulfill a particular obligation creates the obligation. I'm not sure "showing that you care" is specific enough. In any case, you are shifting your ground. Before you said that just making the software available and having enough people use it creates an obligation. Now you are saying that "promoting" it does. When "promoting" is properly unpacked, you will end up agreeing with my position: either the software author has made an explicit promise to provide support, or they haven't. If they have, they have an obligation; if not, they don't.
    • swatcoder 2y ago
      First, most users are indeed finding open source software by searching around by keyword and assessing top hits on their own. Most developers don't have a sense of how to promote their project effectively if they wanted to. Marketing of any sort only plays a role in the most high profile projects, many of which are commercially sponsored. Second, even where a developer puts some legwork into letting the world know what they've shared, that effort is within the context of the project's license terms which almost universally make it explicit and clear that they profer no such obligation. Tweeting "I made this thing, check it out!" does not soemhow absolve the user from reading the license on that thing and understanding that no promises are made.
• yawaramin 2y ago
  You are completely wrong, and this really couldn't get any simpler. Just look at the license of the software you are using. You agreed to this license when you used the software. It says something similar to: > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. It's not even as if this was buried under mountains of legalese. OSS licenses are usually quite simple. You have absolutely no excuse for not understanding that the software provider has zero obligation to you. All you had to do was read a few paragraphs.
• lolinder 2y ago
  > When you provide software that is widely used and that people rely on, you automatically created a community where fixing bugs is an obligation. What you're saying here is that "give them an inch and they'll take a mile" is not just a description of an unfortunate reality, it's a moral imperative. Give them an inch and they have a right to that mile. Do you not see how totally destructive this moral framework is? If giving away free work instantly entitles anyone who benefits from that free work to an arbitrary amount of additional free work, the only rational move for a would-be contributor is not to play the game at all. Is that really the world you want to live in?
• kelnos 2y ago
  > On the other side: No. When you provide software that is widely used and that people rely on, you automatically created a community where fixing bugs is an obligation. Your software has become a corner stone in other people’s software stack/life and so those people and their issues with your software have become your problem, too. If you want it or not. No, absolutely not. What I write and release comes with no warranty, and no guarantees that any of it is fit for purpose. If people want to use it and find it useful, that's great. If they don't, that's fine too. If they use it and have problems, I'm happy to receive bug reports, but I don't work for them, and have no obligation to them. I will work on bugs and improvements because I want to, because it's fun, and because I care about my work. But when it's not fun or I don't care, I may not work on it, and that's 100% my prerogative. > Not everybody knows the language needed to fix a bug and not everybody understands the dependencies within a project to being able to fix a bug. That's tough luck, then. Let's reframe a bit. Let's say you've decided to pay Oracle for their proprietary database. And then you find a bug in it. What are you entitled to? At best, I'd say you're entitled to a refund. Oracle actually has no obligation to fix that bug for you. But Oracle likely will want to fix that bug, because they maybe want to keep you as a customer, and develop and maintain a reputation that their software is worth the money people pay for it. Certainly some open source developers often have reputations they want to maintain. And sometimes doing the grunt work to do thankless jobs and fix annoying bugs and add features they don't care about... well, sometimes that's necessary to maintain the reputation they want to maintain. And that's fine, if that's the choice they've made. But it's also fine if someone just wants to build stuff for fun, share it with others, and continue only doing things with it that they find fun. You might look down on people like that, or be frustrated with them, or choose not to use their software, but you are not entitled to any work out of them, and they are not obligated to provide you with anything at all.
• swatcoder 2y ago
  > Not everybody knows the language needed to fix a bug and not everybody understands the dependencies within a project to being able to fix a bug. As noted in VERY LARGE PRINT at the top of almost every open source license for the last thirty years or so, the person taking the free stuff is responsible for whatever happens when they do. That's why it's free! If you can support it yourself, great. If you can't, then you might need to hire someone to do so. If those options don't appeal to you, then you should probably buy an alternative that does not explicitly tell you that you're on your own. Open source software exists so that the community of reasonable, responsible people can share work with each other without being caught in a rats nest of finger pointing, liability, and defensive practices like hiding source code or preventing alteration. It is a two-sided contract, and the user's side of the contract is very explicitly to take responsiblity for what they choose to do with what they take.
• kragen 2y ago
  > When you provide software that is widely used and that people rely on, you automatically created a community where fixing bugs is an obligation. if you measure the solubilities of some salts and publish them, and your data is widely used and people rely on it, do you therefore have an obligation to repeat your experiments to make them more precise and correct erroneous measurements, and to extend them to more salts? i think not; i do think you have some ethical obligations, but they are limited to admitting that you were wrong, and not taking credit for others' work if the users of your work start talking to each other and helping each other, they might become a community, but that still doesn't impose an obligation on you to do more work for them. to my way of thinking, you're the person in that situation with the least ethical obligations
• wiseowise 2y ago
  > On the other side: No. When you provide software that is widely used and that people rely on, you automatically created a community where fixing bugs is an obligation. Your software has become a corner stone in other people’s software stack/life and so those people and their issues with your software have become your problem, too. If you want it or not. No, just no.