36 ms·

Open source maintainers underpaid, swamped by security, and going gray

307 points by rntn 2y ago

_lvbh 2y ago
I think it’d be interesting to see what happens in a few decades if the population of open source maintainers continue to dwindle. Will companies step up to maintain libraries in a sort of cooperative manner? Will everything become closed source and bespoke? Now this probably won’t happen but it’s still interesting to think about.
- squigz 2y ago
  To answer the question of the future of open source, I think it's important to consider why open source has existed for so long. Is it a matter of cost to develop closed-source systems? Or is it about the quality and efficiency enabled by open source development?
  - binary_slinger 2y ago
    From my experience it’s about cost and efficiency. By cost I mean my cost to them for my time coding. Customers don’t factor in the hidden costs of open source. I preferred developing minimal-dependency software but my customers demand fast good-enough results. The only way to deliver that is to glue together open source dependencies.
    - a_bonobo 2y ago
      My experience is that the 0% interest on credit time for large companies enabled open source to thrive: open source maintainers were flush with cash and time. Large companies with ample cash let their staff do anything to keep them happy (and away from their competitors!), including allocated time for OSS contributions. Now that 0% interest has ended 'regular' people like me are not flush with cash. Any time I have I need to spend on activities that will bring in money. Why would I waste that on open source? (Another aspect is the McKinsey-ification of the work place in the last ~10 years or so. Managers are making decisions in tech now, not tech people. all my life I was told that OSS contributions will look great on my CV. So far nobody who has made a decision to hire me has had the background, interest, or knowledge to judge, or even care, for my OSS contributions.)
  - mike_hearn 2y ago
    It hasn't existed for so long! Jeez, kids these days. As a movement it's really only about 30 years old, and that in two separate phases: 1. The GPL/GNU period. The software is mostly called "free software-as-in-freedom". The community is small, volunteer driven, highly ideological and focused primarily on cloning UNIX for commodity PC hardware. Most developers aren't using this stuff at all and work with entirely commercial toolchains. 2. The Apache 2 period. The software is mostly called "open source". The community is huge, frequently driven by corporate donations, not particularly ideological anymore and focused on developer tools / libraries rather than operating systems and desktop apps. Developers now regularly incorporate open source libraries into their commercial programs. The transition was slow but I'd pick 2008-2010 as the crossing over point. Before that time if someone said they wrote open source software you'd make a weak assumption that they worked somehow on Linux related projects in their evenings/weekends. After that time you'd probably assume they were writing some library and had even odds it was their job. It's important to remember that 2008+ is ZIRP territory. Money was "free" for investors, so investment piled into a lot of stuff that often wasn't revenue generating because there was nowhere else for it to go. This era was also shaped by a historical aberration - a handful of hyper successful advertising companies whose founders were able to remain in control whilst still selling much of their stock thanks to dual voting classes. Modern developer's understanding of the open source ecosystem, along with their expectation that powerful tools are all free, is very much shaped by the combination of Fed policy and a handful of super rich patron companies that weren't under any pressure to return capital to shareholders. Thing is none of these factors (ideology, free money, stock with dual voting classes) is historically normal or arguably sustainable over the long run, whereas ordinary capitalism is. So we might well see a reversion to the mean where things like compilers, libraries, operating systems etc become commercial again as relatively high interest rates pull funds out of tech and the supply of Stallmanists devoted to the cause of desktop GNU/Linux continues to dwindle. The recent death of a man who reverse engineered a lot of networking hardware for Linux is an example of this - how many 25 year old hackers want to do that sort of thing any more? They're all writing JS frameworks that only work on AWS these days. If that does happen though it'll be quite slow. I think the industry would need a kind of Steam for libraries to emerge first, and it's pretty unclear what the next equilibrium phase looks like.
    - 2y ago
- pjmlp 2y ago
  As it became common during the last years, public domain and shareware return under other marketing names like open core.
- wedernoch 2y ago
  I think germany is already doing something great with the Sovereign Tech Fund [0]. The support(ed) a lot of OSS projects so far.[1] [0] https://www.sovereigntechfund.de https://www.sovereigntechfund.de [1] https://www.sovereigntechfund.de/tech https://www.sovereigntechfund.de/tech
  - account42 2y ago
    > https://www.sovereigntechfund.de/tech https://www.sovereigntechfund.de/tech Funding "American" GNOME instead of KDE? Weird choice.
    - wedernoch 2y ago
      It's not about subsidizing, but about support for projects they deem important. Gnome is just one of many projects. And they have to apply for funding. It's not simply given to some projects. I'm from germany and use Gnome. So supporting Gnome is a good thing from my point of view.
- lionkor 2y ago
  I wont stop doing open source work, and neither will anyone I know. We're all under 30. I think the next decades will be fine.
subjectsigma 2y ago
I’m a young(-ish) dev who used to care a lot about open source but never managed to break into a community. In recent years my view of the whole thing has soured a lot. There seems to be few compelling incentives to actually develop or participate in open-source software. Open source first felt to me like a way to give power back to ordinary people, and it still is, but it seems like those who get the most benefit from free labor are large corporations. Open source feels increasingly corporate and companies like Microsoft dominate and reap enormous benefits. I’ll work for Joe Neighbor for free but not Sataya Nadella. Open source was always political but in 2010 (around when I started getting into Linux) it felt like dumb arguments over things like programming languages or “the UNIX philosophy”. Now it feels like a vicious Red vs Blue culture war where not picking a side is just as bad as picking the other side. Contributing to open source is a thankless job and even if your project is really good, most people won’t care and the few that do might still treat you like crap. I’ve submitted a handful of pull requests and I’ve already run into the classic “Your patch works and provides a feature some people might like, but I don’t like it, go away.” I’ve donated plenty to organizations like Mozilla, Wikipedia, and GNOME. I then email them with my opinions on what they’re doing. In nearly every case not only am I ignored completely, I see those projects (Mozilla especially) continue to drift in a direction that I disagree with. So, I stopped donating. For me, the Linux kernel is probably one of the few big open source projects where 1) the project is technically interesting enough that I would learn a lot by contributing, 2) It seems like politics and infighting is kept under control, 3) it actually seems possible to get a patch in while having a 9-5, 4) I use the product myself every day and enjoy it, and 5) the technical direction feels positive in that it is getting regular features & bug fixes that I like
- pjmlp 2y ago
  As someone born in the 70s, I don't have high hopes for the Linux kernel after our generation is gone. It is hard to keep something rolling after the founders, that managed to steer a project under their ideals are no longer around to steer the boat into the right direction. Something else will eventually take Linux's place, in some form, it might even be a Linux based like Android, WebOS, ChromeOS.
  - 2y ago
phendrenad2 2y ago
Maybe open-source as the load-bearing infrastructure of the world will never be sustainable, and maybe that's okay. I think open-source is best when it's empowering people to modify and remix their software, and have free alternatives to expensive commercial programs. It seems like open-source has become so captured by corporate interests, that people's main motivation for contributing is to add it as a bullet-point on their resume.
- MichaelZuo 2y ago
  The beauty of open-source is that it doesn’t matter what people say, or do, or decide. The rate of new contributions may be dependant on these factors, but not for what’s already out there.
- squigz 2y ago
  It would probably be more sustainable if the companies that depend on 100s of FOSS OS'/libraries/applications/etc to generate billions of dollars in profit would contribute more significantly.
  - armini 2y ago
    Absolutely, There’s hope in initiatives like https://osspledge.com/ https://osspledge.com/ & https://thanks.dev https://thanks.dev
    - morningsam 2y ago
      Also https://polar.sh/ https://polar.sh/, which lets users of the project "vote with their wallets" on which issues should be prioritized. You can see it in action in Starlette's GitHub issues, e.g. https://github.com/encode/starlette/issues/649 https://github.com/encode/starlette/issues/649
  - fsckboy 2y ago
    [flagged]
    - 2y ago
vfclists 2y ago
Solution is to stop using languages low level like C except where it matters, and improve the UI capabilities of higher level like Lisp. Most of the problems in free software are rooted in the use of C and C++. When you are doing things for free you shouldn't be using slow, difficult tools.
- mystified5016 2y ago
  What on earth are you talking about? The problem is corporate interests thinking that 'open' means 'free labor' The choice of language has absolutely nothing to do with it. Not in the slightest. This cargo cult nonsense does not make you smart or cool. Try some critical thinking next time instead of regurgitating catch phrases you haven't even bothered to analyze.
  - vfclists 2y ago
    Most of the people burned out developing for Linux should focus on a cut down system developed for end users and small businesses in mind. You clearly haven't heard those jokes about C and C++ have you? You are talking about unpaid people using the wrong languages to do difficult things and that never works. http://harmful.cat-v.org/software/c++/I_did_it_for_you_all http://harmful.cat-v.org/software/c++/I_did_it_for_you_all https://xkcd.com/303/ https://xkcd.com/303/ The Unix Haters Handbook http://harmful.cat-v.org/software/c++/linus http://harmful.cat-v.org/software/c++/linus http://harmful.cat-v.org/software/c++/ http://harmful.cat-v.org/software/c++/ Not only that the industry ignores the foundations and principles of correct and sound programming in low level programming languages like C and C++ which makes things even worse. Going back to the start Linux did not start of with an intention to be an operating system developed for enterprise users. Commercial interests took it over and decided to go with it. The simple truth unpaid hobbyists and hackers should not be involved in the development enterprise operating systems. Windows NT was not developed by unpaid hackers. Why should that apply to Linux? Unix was developed by corporate employees, and it is only when the GNU project decided to replicate the toolsets it used that Linus decided to build a kernel of his own, after which corporations jumped on it because of the GPL. Those days are long gone and hobbyists and part timers shouldn't be really involved. It is OK to write and develop programs gain a sense of achievement and pride from them, but when the need to maintain it kicks in that is when it all starts to south.
zxilly 2y ago
The word underpaid seems too friendly. In the case of the open source developers I know, they don't get any money
- smashah 2y ago
  The conversation about OSS devs getting paid happens amongst the extremely small slice of OSS devs (probably less than 0.0001%) who have managed to get >$10pm out of it.
  - romanobro56 2y ago
    Nah that figure hella exaggerated and you know it
- xtracto 2y ago
  This for me yields a more general "generational" discussion: It seems to me that the current youth generation is less "giving" than previous ones. 70s , 80s and 90s where full of "sharing is caring" mantra. We had people like Stallman, a lot of "crackers" removing copy protection and people just sharing their stuff on an individual level (via edonkey, soulseek, imeem, etc). Same with software, I would never feel "underpaid" for software I release as open source. It's just some code I share, with some open license. If I keep building it, is because I enjoy it. But now, everyone is driven by monetization so much. Maybe it's the fact that it had gotten more difficult to make ends meet, and everyone is looking for a way ti squeeze a cent. I just miss those days.
  - unleaded 2y ago
    I would say the opposite happened but maybe it depends on how long you've been using Linux or been in those types of circles. Throughout the 90s and maybe until the late 2000s seemingly all free Windows software was released as shareware or otherwise closed source. Now open source utilities are a lot more common as people became more aware of open source, although there still remains some freeware that only makes money from donations where the authors still refuse to release the source for some reason (e.g. Nirsoft tools)
tracerbulletx 2y ago
Creating value doesn't automatically get you any money no matter how much value it is. You might get some by adjacency. Businesses capture and raid value.
- OutOfHere 2y ago
  Oh there is value in moving civilization forward. It creates value for everyone including oneself.
steelframe 2y ago
For the only significant upstream OSS contributions I've made I was being paid a pretty good tech salary to make them. The first major contribution happened because the organization I worked for was still in an incubation mode and wasn't on the hook to show any P&L results. The second and third major contributions happened because they shipped on a proprietary platform that was built on top of an OSS release, and the company didn't want to maintain those parts in the proprietary layer. After I left the first company they provided zero maintenance support for the major upstream feature, and I won't maintain it on an individual basis because life moves far too quickly for that. Occasionally I'll happen to run across exasperated posts along the lines of, "Help this is broken for me! Why is my patch being ignored? Is this even maintained any more??" Chances are you only care because the company you work for wants it done so they can make some money off a product they're building with it. Half an hour dealing with some random patch and/or bug report for an upstream thing I did 10 years ago is half an hour less I have to spend with my daughter before she leaves for college. Nope, fuck you and your bug report. No, you can't even pay me to fix it. I have a job, and it's already taking more of my limited time on this earth than I want it to take. The email address I used to submit those patches was deactivated when I left that company, and I ain't handing out my current one. For any minor contributions I made I had to convince the powers that be that there was no real IP or competitive value in maintaining the patch ourselves, and they after much hand-wringing and delay they finally let me push a few small patches up to the maintainers. In hindsight that ended up being more trouble than it was worth because I wouldn't have been the one needing to maintain that patch in the long run. I should have just submitted it to the company-internal repo and let the next guy deal with maintaining that patch. In spite of all that, my contributions are still there. They still provide tons of value to both individuals and to companies that mooch off of them. Somehow at some point someone somewhere steps up after enough time has passed to review and merge a patch or fix a bug. Or the bug report just withers and dies, and the world keeps turning.
limpbizkitfan 2y ago
I wish there was a better solution to this crisis. There should be a corporate tax on software companies solely to fund open source efforts or something of the like. Some open source projects have merged into one umbrella organization to better solicit sponsors but I don't think that will lead to anything fruitful, more so lead to a thing like Canonical where there's a profit motivation to the project
- account42 2y ago
  This is a wider problem than just software. We need to find a way for people to be able to afford doing things they want but don't profit them directly. Pure capitalism has too many bad incentives for enshittification of software, entertainment, food, and so much more.
FMecha 2y ago
Are there even unions for open source maintainers/contributors?
- sithadmin 2y ago
  Those unions would bargain with...whom, exactly?
  - euroderf 2y ago
    Companies that avoid the AGPL, but are open to suggestions ?
sirspacey 2y ago
[flagged]
- lionkor 2y ago
  No
rekabis 2y ago
As I have said before, here and elsewhere: I would love to work on open-source full time, but I exist in a capitalistic hellhole which employs violently coercive methods - the constant threat of homelessness, destitution, and even death - to ensure I remain “sufficiently profitable” to someone else who already has more wealth than I could ever spend in a dozen lifetimes. If UBI is ever implemented in Canada to an effective degree, you can bet both your left titties that I would be able to afford the time to contribute. But now? I’m just struggling to tread water.
vfclists 2y ago
Rewrite of https://news.ycombinator.com/item?id=41591692 https://news.ycombinator.com/item?id=41591692 To summarize the programming toolsets used in open source are not the kind that hobbyists and volunteers should be using, that is why I mentioned the use of Lisp and other higher level languages compared to C and C++. If you are going to write non-trivial programs and utilities in C and C++ then you should absolutely be paid for it. Most of the people burned out developing for Linux should focus on a cut down system developed for end users and small businesses in mind. You clearly haven't heard those jokes about C and C++ have you? You are talking about unpaid people using the wrong languages to do difficult things and that never works. http://harmful.cat-v.org/software/c++/I_did_it_for_you_all http://harmful.cat-v.org/software/c++/I_did_it_for_you_all https://xkcd.com/303/ https://xkcd.com/303/ The Unix Haters Handbook http://harmful.cat-v.org/software/c++/linus http://harmful.cat-v.org/software/c++/linus http://harmful.cat-v.org/software/c++/ http://harmful.cat-v.org/software/c++/ Not only that the industry ignores the foundations and principles of correct and sound programming in low level programming languages like C and C++ which makes things even worse. Going back to the start Linux did not start of with an intention to be an operating system developed for enterprise users. Commercial interests took it over and decided to go with it. The simple truth is unpaid hobbyists and hackers should not be involved in the development of enterprise operating systems. Windows NT was not developed by unpaid hackers. Why should that apply to Linux? Unix was developed by corporate employees, and it is only when the GNU project decided to replicate the toolsets it used that Linus decided to build a kernel of his own, after which corporations jumped on it because of the GPL. Those days are long gone and hobbyists and part timers shouldn't be really involved. It is OK to write and develop programs to gain a sense of achievement and pride from them, but when the need to maintain it kicks in that is when it all starts to south. Their involvement should on simple utilities for end users. That is what free software development which is not well remunerated should focus on. https://xkcd.com/2347/ https://xkcd.com/2347/
- account42 2y ago
  So besides not paying people you depend on you also want to tell them what programming languages to use?
PeterZaitsev 2y ago
There is so much self imposed hurt in Open Source. Many maintainers feel they owe something to their project community, even if they are rude, entitled, unhelpful bunch. It is self imposed though. In reality unless you have a Support agreement or similar, you do not really own folks anything. I wish more Open Source community players to stand up for their interest more strongly. In the end, whenever you like it or not, few are going to pay for what they can get for free, and it especially applies to large enterprises
- OutOfHere 2y ago
  [flagged]
  - lionkor 2y ago
    Thats the point though, and you're missing it: In FOSS, the maintainer doesnt owe you anything. It doesn't matter what the bug is. Most popular software licenses contain a clause about no warranty etc. for a reason. Maintainers owe you absolutely nothing for just using their software. Go pay them if you want them to work for you, and see if they want that.
    - atq2119 2y ago
      Correct. I think the one thing that is "owed", if that is even the right word, is that you don't knowingly put malicious software out there. But that's it.
    - OutOfHere 2y ago
      If a public software is very far off from working as advertised, effectively demonstrating bad faith, if its code is being hosted on a social hosting site, you can bet that I will complain about it to the site, and get everyone else to complain as well. If the software is no longer being developed and has been dead for years, then it's a different story, and the intent then is to move elsewhere. The license file is not an excuse using which to hide lies.
  - duckmysick 2y ago
anonfordays 2y ago
And openly attacked, derided, and pushed out by organized gangs of activists who will use your community like cannon fodder to virtue signal and push their ideology.
- gedy 2y ago
  PR: Add Code of Conduct
  - anonfordays 2y ago
    Exactly. CoCs are Trojan horses.
- _ugfj 2y ago
  [flagged]
  - gotoeleven 2y ago
    [flagged]
- deleted 2y ago
  [deleted]
smashah 2y ago
Also OSS maintainers bear the brunt for interoperability projects while the startups built on those same libraries get handsomely VC funded without ever contributing back. Any institutionally funded project should be forced to take a percentage of the raise and pay it to the OSS projects/dependencies (even the deep ones they dont see). thanks.dev is a good platform that does this well.
rockskon 2y ago
Feels a lot less joyful to be involved in open source than it used to be when there's just not as much of a culture of respect/"respect" or even the knowledge that you're making the world a better place for individuals. It's difficult for me to point to any one specific cause of this. I want to say the reduced control over your own computing environment, far greater propensity for litigation and control, and the reduced or eliminated means of using social media website APIs to curate your own online experience. Everything's feels so helpless and the primary reasons to solve these don't feel like they're technical in nature. They used to always feel technical in nature. I have to wonder how much of the problem space of individual empowerment is even left for technology to fix?
- rockskon 2y ago
  That all said.... There's a lot of comparatively wealthy engineers and programmers out there. Enough to fund a powerhouse of a lobbying force. But lobbying to change what is the question?
RcouF1uZ4gsC 2y ago
[flagged]
- lionkor 2y ago
  I don't think this applies for most software. I write code to solve a problem for myself, and then I open source it. I maintain it as long as I need it. Its sharing that does not cost me a cent to do.
fsndz 2y ago
Open source is one of the most thankless jobs. People who do it should still think about other ways to make money, or find a way to earn while contributing. It makes no sense to write amazing software, used by large corporations to generate billions, while you end up poor and bitter. No, it’s not fair, and no one should allow themselves to be taken advantage of in that way. Open source is a gift, but before giving to others, you should ensure you have enough for yourself.
- benfortuna 2y ago
  As an Open Source maintainer, I have always considered it something to do when I want to. If it becomes a burden or a chore, then I stop doing it, regardless of demands from users. I have no expectations of the users, and I expect the same from them.
  - fsndz 2y ago
    best mindset tbh
  - stavros 2y ago
    This is the only way OSS can be sustainable, I appreciate people who make OSS their (unpaid) job, but it can't be healthy for them.
- theosp 2y ago
  At JustDo we make our source code available for transparency and collaboration, we use a source-available license that ensures fair compensation for our work. This model allows us to maintain the benefits of open development while avoiding the pitfalls of unrestricted open-source licensing, ensuring we can sustainably develop and support our software. I developed this license https://justdo.com/source-available-license https://justdo.com/source-available-license , if someone wants to adopt it for their project, I'd love to provide its Latex form, just DM me. (With enough demand, I might Open Source the Source available license ;) )."
  - llm_trw 2y ago
DoreenMichele 2y ago
I don't know how we resolve this. Some things are excellent because open source allows an individual to make what they want without answering to a boss or whatever and then if it gets popular, it comes with responsibilities but probably little or no pay. As someone who did a lot of volunteer work, these issues resonate with me -- painfully so. That's probably my primary motive for reading such articles when I'm not really a programmer.
- bongodongobob 2y ago
  What's to resolve? You either do something for the love of it or you don't. There's nothing to solve, it is what it is. If you want to get paid for writing your software get a job, start a company. OSS is neither of those things.
  - DoreenMichele 2y ago
    I'm far from the only person who feels people should get paid for their work if they add value to the lives of others or this article wouldn't exist. Some people know how to add value and don't know how to turn that into an income and if they desperately need income and everybody wants their work but nobody pays them, it's extremely infuriating and crazy making.
    - bongodongobob 2y ago
      Then they should ask for it. "I give my software away for free and no one pays me for my work." Your argument makes no sense.
      - DoreenMichele 2y ago
        Some of them do ask for it. And it does little or nothing. I'm a writer and a blogger. Newspapers are dying. If you put ads on your site, people use ad blockers. People find ways around pay walls. Etc. Sometimes you can't somehow magically control the fact that people won't pay you.
bongodongobob 2y ago
Old open source maintainers think they are more important and replaceable than they really are. It's the same in any job or company. We are all very replaceable. Boomers thinking they hold the world together is typical and hilarious. Edit: At my current job I replaced a 65 year old retiree that the company thought was an irreplaceable lynchpin. I learned his job in 2 weeks.
- account42 2y ago
  Anyone who says they learned a long-term employee's job in two weeks is either full of shit or hopelessly naive.
swayvil 2y ago
There ain't no justice so don't expect any. Either join the filthy dogfight or not. I prefer to not.
lazyasciiart 2y ago
Hm, sounds the same as the concerns about the fields of teaching, nursing, eldercare and childcare. Interesting parallel.
journal 2y ago
It's the same reason why it's difficult for single men to find a partner. Life has become too individual. Didn't Rick Beato just talk about this... https://www.youtube.com/watch?v=h_DjmtR0Xls https://www.youtube.com/watch?v=h_DjmtR0Xls I have a project. I'm willing to spend time to help someone learn how to contribute, and in return they'll gain experience they can use to earn money elsewhere. How do you find those people? It's the sales. We have saturated our tolerance for advertising. We just assume everyone who approaches us wants to sell us something right away. When I started development on my accounting application, I decided to go around town and talk to businesses to figure out what features I should add. I had nothing to sell, I just wanted to talk to people about my own personal initiative. Never mind everyone on the internet screaming that an ERP system can't be done by a single person. No one wants to talk to me, no one cares. And you all know the best of us are introverts because we focus on the problem and not the sale. YCombinator: learn to do sales on your own, don't look for sales oriented co-founder. Seriously? Every day it's getting harder and harder to do sales. It's not even sales but social engineering. You hear words like "funnels" and "CPA". I reached out to my network, I know about 7 people capable of helping me. None had the drive to lift a finger cause they're all too comfortable with their day jobs. I don't blame them, I would be too if I was being paid $100k to change background color of buttons every two weeks. Yes, what I'm building is of commercial nature, but I have other interests too, like creating mesh network with ESP32 which to me has no commercial value and would be done purely for fun. I'm sure there's people with similar interest exist, but they're being kept guard by social media companies that work against collective initiative. Cause if they didn't, it would be too easy for people to find what they're looking for. I have interview on 24th. If I get the job the progress on my project stops. I'm 1/4 ways through to production, that's three more years of development. If I had few people to help me, we could complete it in six months and end up with jobs maintaining it. Like many people pointed out - time is precious, "you couldn't even pay me to do it", "I have a family". So you have to find people just at the right time who have overlapping free time. I've run out of money, gotta go back to work. Increment this counter if you gave up on open-source: 1
sureIy 2y ago
On a related note: the worst thing you can possibly do as an open source developer is to create a product for the general public to use. You hate tickets without repro? Enjoy the barrage of “help. Doent work”, “me too” and “HELLO IT’S BEEN 3 DAYS” messages.
- hypfer 2y ago
  I think the problem isn't it being open source but it being GitHub flavored open source. If you're building a product, you probably should not be having it on GitHub with issues enabled. There are very good reasons why the support processes of commercial entities that build products are the way they are. You do want a lot more friction and you do likely want to limit support to paying customers. GitHub-style public issue trackers are just a bad idea overall IMO. They only work if the "public" is only "public" because everyone _in theory_ could take part. In practice however, you only want to grant such unlimited write access to vetted individuals. This happened to happen automatically previously (because getting to the point where you even know where to open a ticket _was_ part of the vetting process), but with GitHub as the default for everyone and everything, it needs to be a conscious effort. If you think about it, it is completely insane how any random individual just has to press one button to publish whatever they want to a super prominent part of what is effectively your products/projects website. That simply shouldn't be a power random individuals have
  - antimemetics 2y ago
    You can restrict issue creation/comments etc to certain users if you don’t want to open it to the public. You can also use a separate repo: https://docs.github.com/en/repositories/creating-and-managing-repositories/creating-an-issues-only-repository https://docs.github.com/en/repositories/creating-and-managin... It’s a choice the maintainer has to make. To me this is mostly self inflicted pain…
    - hypfer 2y ago
      Yes and no. Sure, countermeasures exist, but the issue is that you first need to be aware of what exactly the problem is before you can take these countermeasures. The reality however is that people just hear "You should do GitHub" and then for some inexplicable reason slowly descend into feeling bad without any clear reason why. After all, they're following all the "best practices" laid out by people that clearly know what they're doing and surely have their best interest in mind.
kkfx 2y ago
There are few points: - there is no FLOSS culture in most people, so the classic model "I publish and maintain my code, others get it from free and give back their improvements equally for free" does not work anymore in most cases. Collaboration culture seems to be very diminished, some try be moral police, some simply do not care etc; - mere widespread lack of competence mixing, in the past with usenet newcomers and gurus was together, interact and share visions, doubts etc, make all people involved learn. Today with Reddit and co people are divided, gurus with gurus, newcomers with newcomers, these are Indian castes with extremely little "social mobility" and that's a large part of why the mean culture is collapsed and almost all new projects not only in FLOSS but in the whole society are failures; - lack of a good software base, modern software designed by commercial/managerial needs are CRAP, even the finest one, not because the code is crap, but because the environment is. An OS need to be a single application where anyone can automate their small bits at their competence level, this mode was killed because compartmentalizing anything means more products to sell, this is technically unsustainable and most modern people works in such environments and many young have no idea of the old mode and it's power, as a result good tools left behind, those who know them isolated, newcomers suffer from the lack of proper tooling and can't progress; - finally the "slavery flat line with a dot on top", meaning only few nowadays do things, the giants, others are essentially their slaves. Most companies have no iron, no operation in house, just sitting on the shoulders of giants, using their iron and operation through their interfaces/services. This means the social FLOSS ecosystem does not exists anymore. More and more people burned by this model try to go FLOSS, off the cloud etc, but they lack tools and competence and resurface from such disaster it's damn not easy since still the largest part of the world is in the barbaric land of the giants where even damn simple things are complicated because that's makes the money for someone.
hiAndrewQuinn 2y ago
I've long wondered why FOSS developers of successful software don't offer some kind of financial bounty for whistleblowers who reveal that a given legal entity is violating the terms of their license. Like, I release pretty much everything I create into the extended public domain (CC0/the Unlicense/0BSD), so I very intentionally have no dog in this race, but for those who make different choices for me regarding their public contributions, it just seems logical. Maybe it's just impossible to sue someone for violation of the GPL in a way which makes it easy to come out financially ahead, though.
- delusional 2y ago
  How would you pay for the bounty? It seems hard to argue that you sustained any damages in the violation, and that's usually the only thing you can ask for in a civil suit. Additionally, you just invented another thing for developers to maintain.
  - baq 2y ago
    Ah gotta love the percentage of gross revenue clause of the GPL in the violations section.
    - hiAndrewQuinn 2y ago
      Man, I actually went looking for that. I bet some of us here could've made a killing bringing violators to justice if such a thing existed.
  - hiAndrewQuinn 2y ago
    Yup, as hinted at in my comment. Seems tough. They could sue or try to settle out of court to get the company's own code to get licensed under the GPL, which seems like something they'd want as well. In that sense an open bounty is like putting a price tag on how much you really care, in terms of hours of your life you're willing to spend (indirectly) enforcing the rules you have set.
- jackdaniel 2y ago
franciscop 2y ago
Want to just briefly mention, since the article doesn't mention it at all, the blatant conflict of interests: > open source project maintainers are not being paid for their work, spend three times as much time on security than they did three years ago, and have become less trusting of contributors following the xz backdoor, according to open source package security firm Tidelift. > Tildelift: Reduce security risk from bad open source packages
- richbell 2y ago
  I don't think "conflict of interest" is the right term in this case.
zaraGaj 2y ago
There used to be a culture of respect for talent and work in OSS. That is gone in many projects. Python for example is now run by repressive bureaucrats who abuse the infrastructure to intimidate and coerce people. Those who do not obey are slandered, libeled and banned, so they have no recourse to defend themselves against the libel. Python is a great example how OSS can be stolen by a small dominant clique that is active on Twitter (now Mastodon) and markets themselves as leaders while having done very little actual work in the past 15 years. All of this is enabled by Python's propaganda arm, the PSF, which is filled to the brim with mediocre members, most of whom haven't done anything at all but who brag with @psf in their Mastodon and GitHub bios. It is all smoke and mirrors now.
arresin 2y ago
> [Linus] also said it's far too early to give up on Rust in the kernel as it's still early days. Did I miss something? This sounds like they’re thinking about giving up on rust. Edit: this from the lead working on it: > "I am retiring from the project," Filho declared. "After almost four years, I find myself lacking the energy and enthusiasm I once had to respond to some of the nontechnical nonsense, so it's best to leave it up to those who still have it in them." It truly is the most toxic community. I’m just glad I’m not to feel like the only seeing / be affected by it.
- account42 2y ago
  > It truly is the most toxic community. Which one? Rust? Coming to an existing project and expecting them to convert to your pet language is pretty toxic, yes.
ruuda 2y ago
There is a growing culture of microdependencies, where one project can depend on hundreds or thousands of libraries, combined with automated "vulnerability" tracking, which means projects are constantly receiving notifications about issues in libraries deep in the dependency tree, most of the time in a part of the library that is not even used by the top-level application. It's no surprise that "security" is eating up more and more time.
- pornel 2y ago
  And every CVSS score is 9.8, because it's designed to never underestimate potential risk, no matter how absurdly unlikely, rather than be realistic about the actual risk.
  - clwg 2y ago
    CVSS is not not really meant to measure risk, it primarily measures the severity of technical vulnerabilities. It should be used in conjunction with other factors such as system exposure and threat sources to determine the probability of exploitation. This should then be combined with impact and costing data to fully assess the risk. Regulatory requirements also need to be contextualized similarly. If they become burdensome, efforts should focus on reducing the exposure of your systems to those risks. That said, patch and configuration management should be second nature and performed continuously so that when a real issue arises, you're prepared and not worried about your environment falling over because you're unsure how it will respond to an update, or whether your backups will restore properly - which are risks as well. I saw more than a few organizations struggle with log4j because they only patched server systems when a vulnerability was publicly exposed, and a Metasploit exploit was available.
donatj 2y ago
> and have become less trusting of contributors following the xz backdoor That's almost certainly a good thing. Over the last decade plus of my using GitHub on three different occasions I have wandered into a project, submitted a pull request, and the author has simply given me full write access to the repo without my asking. I didn't want it. I didn't ask to be a maintainer of this project. People can be really weirdly not unconcerned about security.
keybored 2y ago
I don’t understand why this isn’t framed as an Economics problem? If a large group of people stop doing something that someone else depends on then that’s an Economic problem. No? I don’t mean in the narrow of sense of exchanging things for money. If society wants some undefined group of any kind of people to do something but they are not (or they are about to quit) then that’s a resource allocation problem of sorts. That’s the bare problem. This problem does not immediately prescribe a solution like paying someone in dollars and cents. That’s only one solution. Same if a country is having a fertility issue. The problem is sort of an economic one. But the answer doesn’t have to be paying would-be fathers and mothers. It could for example be to provide more free services that parents benefit from. Or it could mean reducing the hours in the “standard work week”. Or it could be to improve the pension of part-time workers (mothers are often part-time workers). Or it could be to more child-friendly urban planning. Or it could be to improve the public transportation and road infrastructure for households where the two partners work in different parts of the city/municipality/county. Are professional economists working on this problem? If not, why aren’t they? This seems like it should be their domain. Am I being totally naive here?
- HL33tibCe7 2y ago
  > Are professional economists working on this problem? If not, why aren’t they? Because right now the impacts aren’t particularly noticeable, even for people “in the know”, let alone professional economists who have never heard of the software supply chain
- poincaredisk 2y ago
  It's a global/international problem where each country efforts will improve the situation (OS ecosystem) for everyone equally. At this point it is clear that the humanity is terrible in solving problems like this (just see how climate change is going so far)
deleted 2y ago
[deleted]
qwertywert_ 2y ago
Open source maintainers get a kit of "clout" and respect, and they can use this experience to get high paying jobs at big companies. I know of a few people who clearly do this.
jazz9k 2y ago
If you want to get paid for software, open source isn't the answer. Charge for support or have commercial licenses in place.
mmooss 2y ago
> Small wonder then that the maintainer population is aging – not enough newcomers want the undercompensated, unappreciated job. Small wonder that some might not want to do that, but it doesn't explain why fewer people than previously would want that responsibility, especially if the population of developers has increased. My guess is that people are less interested in taking over other people's projects than in starting their own.
rldjbpin 2y ago
as an inexperienced, thankless issue-raiser in this world, i can give my 0.02 on this. a lot of open-source today seems like the charitable organizations of the world. the idea is to give selflessly, but a lot of it has become about lowkey entitlement, just because "nobody else is doing it" or will do it without our support. on the other hand, i do empathize with the double-edge nature of accessibility to open-source platforms. while using git can still be a daunting task, raising issues or "contributions" has become easier than making a ticket in most teams' Jira. again, you can choose to adapt to the platforms or just have a simple one that you control. i might raise well-thought out issues once in a while when it affects my work projects, but i will not even consider using the mailing list for a linux kernel issue. maybe that is a good way to get rid of the noise. i envy those who could generously give and also enjoy the process of just coding for its sake. those who don't do open-source with these ideas should not be asking for anything in return. we are not owed anything, no matter what good can come out of our work.

307 points by rntn 2y ago

I think it’d be interesting to see what happens in a few decades if the population of open source maintainers continue to dwindle. Will companies step up to maintain libraries in a sort of cooperative manner? Will everything become closed source and bespoke? Now this probably won’t happen but it’s still interesting to think about.

squigz 2y ago
To answer the question of the future of open source, I think it's important to consider why open source has existed for so long. Is it a matter of cost to develop closed-source systems? Or is it about the quality and efficiency enabled by open source development?
- binary_slinger 2y ago
  From my experience it’s about cost and efficiency. By cost I mean my cost to them for my time coding. Customers don’t factor in the hidden costs of open source. I preferred developing minimal-dependency software but my customers demand fast good-enough results. The only way to deliver that is to glue together open source dependencies.
  - a_bonobo 2y ago
    My experience is that the 0% interest on credit time for large companies enabled open source to thrive: open source maintainers were flush with cash and time. Large companies with ample cash let their staff do anything to keep them happy (and away from their competitors!), including allocated time for OSS contributions. Now that 0% interest has ended 'regular' people like me are not flush with cash. Any time I have I need to spend on activities that will bring in money. Why would I waste that on open source? (Another aspect is the McKinsey-ification of the work place in the last ~10 years or so. Managers are making decisions in tech now, not tech people. all my life I was told that OSS contributions will look great on my CV. So far nobody who has made a decision to hire me has had the background, interest, or knowledge to judge, or even care, for my OSS contributions.)
- mike_hearn 2y ago
  It hasn't existed for so long! Jeez, kids these days. As a movement it's really only about 30 years old, and that in two separate phases: 1. The GPL/GNU period. The software is mostly called "free software-as-in-freedom". The community is small, volunteer driven, highly ideological and focused primarily on cloning UNIX for commodity PC hardware. Most developers aren't using this stuff at all and work with entirely commercial toolchains. 2. The Apache 2 period. The software is mostly called "open source". The community is huge, frequently driven by corporate donations, not particularly ideological anymore and focused on developer tools / libraries rather than operating systems and desktop apps. Developers now regularly incorporate open source libraries into their commercial programs. The transition was slow but I'd pick 2008-2010 as the crossing over point. Before that time if someone said they wrote open source software you'd make a weak assumption that they worked somehow on Linux related projects in their evenings/weekends. After that time you'd probably assume they were writing some library and had even odds it was their job. It's important to remember that 2008+ is ZIRP territory. Money was "free" for investors, so investment piled into a lot of stuff that often wasn't revenue generating because there was nowhere else for it to go. This era was also shaped by a historical aberration - a handful of hyper successful advertising companies whose founders were able to remain in control whilst still selling much of their stock thanks to dual voting classes. Modern developer's understanding of the open source ecosystem, along with their expectation that powerful tools are all free, is very much shaped by the combination of Fed policy and a handful of super rich patron companies that weren't under any pressure to return capital to shareholders. Thing is none of these factors (ideology, free money, stock with dual voting classes) is historically normal or arguably sustainable over the long run, whereas ordinary capitalism is. So we might well see a reversion to the mean where things like compilers, libraries, operating systems etc become commercial again as relatively high interest rates pull funds out of tech and the supply of Stallmanists devoted to the cause of desktop GNU/Linux continues to dwindle. The recent death of a man who reverse engineered a lot of networking hardware for Linux is an example of this - how many 25 year old hackers want to do that sort of thing any more? They're all writing JS frameworks that only work on AWS these days. If that does happen though it'll be quite slow. I think the industry would need a kind of Steam for libraries to emerge first, and it's pretty unclear what the next equilibrium phase looks like.
  - 2y ago
pjmlp 2y ago
As it became common during the last years, public domain and shareware return under other marketing names like open core.
wedernoch 2y ago
I think germany is already doing something great with the Sovereign Tech Fund [0]. The support(ed) a lot of OSS projects so far.[1] [0] https://www.sovereigntechfund.de https://www.sovereigntechfund.de [1] https://www.sovereigntechfund.de/tech https://www.sovereigntechfund.de/tech
- account42 2y ago
  > https://www.sovereigntechfund.de/tech https://www.sovereigntechfund.de/tech Funding "American" GNOME instead of KDE? Weird choice.
  - wedernoch 2y ago
    It's not about subsidizing, but about support for projects they deem important. Gnome is just one of many projects. And they have to apply for funding. It's not simply given to some projects. I'm from germany and use Gnome. So supporting Gnome is a good thing from my point of view.
lionkor 2y ago
I wont stop doing open source work, and neither will anyone I know. We're all under 30. I think the next decades will be fine.

subjectsigma 2y ago

I’m a young(-ish) dev who used to care a lot about open source but never managed to break into a community. In recent years my view of the whole thing has soured a lot. There seems to be few compelling incentives to actually develop or participate in open-source software. Open source first felt to me like a way to give power back to ordinary people, and it still is, but it seems like those who get the most benefit from free labor are large corporations. Open source feels increasingly corporate and companies like Microsoft dominate and reap enormous benefits. I’ll work for Joe Neighbor for free but not Sataya Nadella. Open source was always political but in 2010 (around when I started getting into Linux) it felt like dumb arguments over things like programming languages or “the UNIX philosophy”. Now it feels like a vicious Red vs Blue culture war where not picking a side is just as bad as picking the other side. Contributing to open source is a thankless job and even if your project is really good, most people won’t care and the few that do might still treat you like crap. I’ve submitted a handful of pull requests and I’ve already run into the classic “Your patch works and provides a feature some people might like, but I don’t like it, go away.” I’ve donated plenty to organizations like Mozilla, Wikipedia, and GNOME. I then email them with my opinions on what they’re doing. In nearly every case not only am I ignored completely, I see those projects (Mozilla especially) continue to drift in a direction that I disagree with. So, I stopped donating. For me, the Linux kernel is probably one of the few big open source projects where 1) the project is technically interesting enough that I would learn a lot by contributing, 2) It seems like politics and infighting is kept under control, 3) it actually seems possible to get a patch in while having a 9-5, 4) I use the product myself every day and enjoy it, and 5) the technical direction feels positive in that it is getting regular features & bug fixes that I like

pjmlp 2y ago
As someone born in the 70s, I don't have high hopes for the Linux kernel after our generation is gone. It is hard to keep something rolling after the founders, that managed to steer a project under their ideals are no longer around to steer the boat into the right direction. Something else will eventually take Linux's place, in some form, it might even be a Linux based like Android, WebOS, ChromeOS.
- 2y ago

phendrenad2 2y ago

Maybe open-source as the load-bearing infrastructure of the world will never be sustainable, and maybe that's okay. I think open-source is best when it's empowering people to modify and remix their software, and have free alternatives to expensive commercial programs. It seems like open-source has become so captured by corporate interests, that people's main motivation for contributing is to add it as a bullet-point on their resume.

MichaelZuo 2y ago
The beauty of open-source is that it doesn’t matter what people say, or do, or decide. The rate of new contributions may be dependant on these factors, but not for what’s already out there.
squigz 2y ago
It would probably be more sustainable if the companies that depend on 100s of FOSS OS'/libraries/applications/etc to generate billions of dollars in profit would contribute more significantly.
- armini 2y ago
  Absolutely, There’s hope in initiatives like https://osspledge.com/ https://osspledge.com/ & https://thanks.dev https://thanks.dev
  - morningsam 2y ago
    Also https://polar.sh/ https://polar.sh/, which lets users of the project "vote with their wallets" on which issues should be prioritized. You can see it in action in Starlette's GitHub issues, e.g. https://github.com/encode/starlette/issues/649 https://github.com/encode/starlette/issues/649
- fsckboy 2y ago
  [flagged]
  - 2y ago

vfclists 2y ago

Solution is to stop using languages low level like C except where it matters, and improve the UI capabilities of higher level like Lisp. Most of the problems in free software are rooted in the use of C and C++. When you are doing things for free you shouldn't be using slow, difficult tools.

mystified5016 2y ago
What on earth are you talking about? The problem is corporate interests thinking that 'open' means 'free labor' The choice of language has absolutely nothing to do with it. Not in the slightest. This cargo cult nonsense does not make you smart or cool. Try some critical thinking next time instead of regurgitating catch phrases you haven't even bothered to analyze.
- vfclists 2y ago
  Most of the people burned out developing for Linux should focus on a cut down system developed for end users and small businesses in mind. You clearly haven't heard those jokes about C and C++ have you? You are talking about unpaid people using the wrong languages to do difficult things and that never works. http://harmful.cat-v.org/software/c++/I_did_it_for_you_all http://harmful.cat-v.org/software/c++/I_did_it_for_you_all https://xkcd.com/303/ https://xkcd.com/303/ The Unix Haters Handbook http://harmful.cat-v.org/software/c++/linus http://harmful.cat-v.org/software/c++/linus http://harmful.cat-v.org/software/c++/ http://harmful.cat-v.org/software/c++/ Not only that the industry ignores the foundations and principles of correct and sound programming in low level programming languages like C and C++ which makes things even worse. Going back to the start Linux did not start of with an intention to be an operating system developed for enterprise users. Commercial interests took it over and decided to go with it. The simple truth unpaid hobbyists and hackers should not be involved in the development enterprise operating systems. Windows NT was not developed by unpaid hackers. Why should that apply to Linux? Unix was developed by corporate employees, and it is only when the GNU project decided to replicate the toolsets it used that Linus decided to build a kernel of his own, after which corporations jumped on it because of the GPL. Those days are long gone and hobbyists and part timers shouldn't be really involved. It is OK to write and develop programs gain a sense of achievement and pride from them, but when the need to maintain it kicks in that is when it all starts to south.

zxilly 2y ago

The word underpaid seems too friendly. In the case of the open source developers I know, they don't get any money

smashah 2y ago
The conversation about OSS devs getting paid happens amongst the extremely small slice of OSS devs (probably less than 0.0001%) who have managed to get >$10pm out of it.
- romanobro56 2y ago
  Nah that figure hella exaggerated and you know it
xtracto 2y ago
This for me yields a more general "generational" discussion: It seems to me that the current youth generation is less "giving" than previous ones. 70s , 80s and 90s where full of "sharing is caring" mantra. We had people like Stallman, a lot of "crackers" removing copy protection and people just sharing their stuff on an individual level (via edonkey, soulseek, imeem, etc). Same with software, I would never feel "underpaid" for software I release as open source. It's just some code I share, with some open license. If I keep building it, is because I enjoy it. But now, everyone is driven by monetization so much. Maybe it's the fact that it had gotten more difficult to make ends meet, and everyone is looking for a way ti squeeze a cent. I just miss those days.
- unleaded 2y ago
  I would say the opposite happened but maybe it depends on how long you've been using Linux or been in those types of circles. Throughout the 90s and maybe until the late 2000s seemingly all free Windows software was released as shareware or otherwise closed source. Now open source utilities are a lot more common as people became more aware of open source, although there still remains some freeware that only makes money from donations where the authors still refuse to release the source for some reason (e.g. Nirsoft tools)

tracerbulletx 2y ago

Creating value doesn't automatically get you any money no matter how much value it is. You might get some by adjacency. Businesses capture and raid value.

OutOfHere 2y ago
Oh there is value in moving civilization forward. It creates value for everyone including oneself.

steelframe 2y ago

For the only significant upstream OSS contributions I've made I was being paid a pretty good tech salary to make them. The first major contribution happened because the organization I worked for was still in an incubation mode and wasn't on the hook to show any P&L results. The second and third major contributions happened because they shipped on a proprietary platform that was built on top of an OSS release, and the company didn't want to maintain those parts in the proprietary layer. After I left the first company they provided zero maintenance support for the major upstream feature, and I won't maintain it on an individual basis because life moves far too quickly for that. Occasionally I'll happen to run across exasperated posts along the lines of, "Help this is broken for me! Why is my patch being ignored? Is this even maintained any more??" Chances are you only care because the company you work for wants it done so they can make some money off a product they're building with it. Half an hour dealing with some random patch and/or bug report for an upstream thing I did 10 years ago is half an hour less I have to spend with my daughter before she leaves for college. Nope, fuck you and your bug report. No, you can't even pay me to fix it. I have a job, and it's already taking more of my limited time on this earth than I want it to take. The email address I used to submit those patches was deactivated when I left that company, and I ain't handing out my current one. For any minor contributions I made I had to convince the powers that be that there was no real IP or competitive value in maintaining the patch ourselves, and they after much hand-wringing and delay they finally let me push a few small patches up to the maintainers. In hindsight that ended up being more trouble than it was worth because I wouldn't have been the one needing to maintain that patch in the long run. I should have just submitted it to the company-internal repo and let the next guy deal with maintaining that patch. In spite of all that, my contributions are still there. They still provide tons of value to both individuals and to companies that mooch off of them. Somehow at some point someone somewhere steps up after enough time has passed to review and merge a patch or fix a bug. Or the bug report just withers and dies, and the world keeps turning.

limpbizkitfan 2y ago

I wish there was a better solution to this crisis. There should be a corporate tax on software companies solely to fund open source efforts or something of the like. Some open source projects have merged into one umbrella organization to better solicit sponsors but I don't think that will lead to anything fruitful, more so lead to a thing like Canonical where there's a profit motivation to the project

account42 2y ago
This is a wider problem than just software. We need to find a way for people to be able to afford doing things they want but don't profit them directly. Pure capitalism has too many bad incentives for enshittification of software, entertainment, food, and so much more.

FMecha 2y ago

Are there even unions for open source maintainers/contributors?

sithadmin 2y ago
Those unions would bargain with...whom, exactly?
- euroderf 2y ago
  Companies that avoid the AGPL, but are open to suggestions ?

sirspacey 2y ago

[flagged]

lionkor 2y ago
No

rekabis 2y ago

As I have said before, here and elsewhere: I would love to work on open-source full time, but I exist in a capitalistic hellhole which employs violently coercive methods - the constant threat of homelessness, destitution, and even death - to ensure I remain “sufficiently profitable” to someone else who already has more wealth than I could ever spend in a dozen lifetimes. If UBI is ever implemented in Canada to an effective degree, you can bet both your left titties that I would be able to afford the time to contribute. But now? I’m just struggling to tread water.

vfclists 2y ago

Rewrite of https://news.ycombinator.com/item?id=41591692 https://news.ycombinator.com/item?id=41591692 To summarize the programming toolsets used in open source are not the kind that hobbyists and volunteers should be using, that is why I mentioned the use of Lisp and other higher level languages compared to C and C++. If you are going to write non-trivial programs and utilities in C and C++ then you should absolutely be paid for it. Most of the people burned out developing for Linux should focus on a cut down system developed for end users and small businesses in mind. You clearly haven't heard those jokes about C and C++ have you? You are talking about unpaid people using the wrong languages to do difficult things and that never works. http://harmful.cat-v.org/software/c++/I_did_it_for_you_all http://harmful.cat-v.org/software/c++/I_did_it_for_you_all https://xkcd.com/303/ https://xkcd.com/303/ The Unix Haters Handbook http://harmful.cat-v.org/software/c++/linus http://harmful.cat-v.org/software/c++/linus http://harmful.cat-v.org/software/c++/ http://harmful.cat-v.org/software/c++/ Not only that the industry ignores the foundations and principles of correct and sound programming in low level programming languages like C and C++ which makes things even worse. Going back to the start Linux did not start of with an intention to be an operating system developed for enterprise users. Commercial interests took it over and decided to go with it. The simple truth is unpaid hobbyists and hackers should not be involved in the development of enterprise operating systems. Windows NT was not developed by unpaid hackers. Why should that apply to Linux? Unix was developed by corporate employees, and it is only when the GNU project decided to replicate the toolsets it used that Linus decided to build a kernel of his own, after which corporations jumped on it because of the GPL. Those days are long gone and hobbyists and part timers shouldn't be really involved. It is OK to write and develop programs to gain a sense of achievement and pride from them, but when the need to maintain it kicks in that is when it all starts to south. Their involvement should on simple utilities for end users. That is what free software development which is not well remunerated should focus on. https://xkcd.com/2347/ https://xkcd.com/2347/

account42 2y ago
So besides not paying people you depend on you also want to tell them what programming languages to use?

PeterZaitsev 2y ago

There is so much self imposed hurt in Open Source. Many maintainers feel they owe something to their project community, even if they are rude, entitled, unhelpful bunch. It is self imposed though. In reality unless you have a Support agreement or similar, you do not really own folks anything. I wish more Open Source community players to stand up for their interest more strongly. In the end, whenever you like it or not, few are going to pay for what they can get for free, and it especially applies to large enterprises

OutOfHere 2y ago
[flagged]
- lionkor 2y ago
  Thats the point though, and you're missing it: In FOSS, the maintainer doesnt owe you anything. It doesn't matter what the bug is. Most popular software licenses contain a clause about no warranty etc. for a reason. Maintainers owe you absolutely nothing for just using their software. Go pay them if you want them to work for you, and see if they want that.
  - atq2119 2y ago
    Correct. I think the one thing that is "owed", if that is even the right word, is that you don't knowingly put malicious software out there. But that's it.
  - OutOfHere 2y ago
    If a public software is very far off from working as advertised, effectively demonstrating bad faith, if its code is being hosted on a social hosting site, you can bet that I will complain about it to the site, and get everyone else to complain as well. If the software is no longer being developed and has been dead for years, then it's a different story, and the intent then is to move elsewhere. The license file is not an excuse using which to hide lies.
- duckmysick 2y ago

anonfordays 2y ago

And openly attacked, derided, and pushed out by organized gangs of activists who will use your community like cannon fodder to virtue signal and push their ideology.

gedy 2y ago
PR: Add Code of Conduct
- anonfordays 2y ago
  Exactly. CoCs are Trojan horses.
_ugfj 2y ago
[flagged]
- gotoeleven 2y ago
  [flagged]
deleted 2y ago
[deleted]

smashah 2y ago

Also OSS maintainers bear the brunt for interoperability projects while the startups built on those same libraries get handsomely VC funded without ever contributing back. Any institutionally funded project should be forced to take a percentage of the raise and pay it to the OSS projects/dependencies (even the deep ones they dont see). thanks.dev is a good platform that does this well.

rockskon 2y ago

Feels a lot less joyful to be involved in open source than it used to be when there's just not as much of a culture of respect/"respect" or even the knowledge that you're making the world a better place for individuals. It's difficult for me to point to any one specific cause of this. I want to say the reduced control over your own computing environment, far greater propensity for litigation and control, and the reduced or eliminated means of using social media website APIs to curate your own online experience. Everything's feels so helpless and the primary reasons to solve these don't feel like they're technical in nature. They used to always feel technical in nature. I have to wonder how much of the problem space of individual empowerment is even left for technology to fix?

rockskon 2y ago
That all said.... There's a lot of comparatively wealthy engineers and programmers out there. Enough to fund a powerhouse of a lobbying force. But lobbying to change what is the question?

RcouF1uZ4gsC 2y ago

[flagged]

lionkor 2y ago
I don't think this applies for most software. I write code to solve a problem for myself, and then I open source it. I maintain it as long as I need it. Its sharing that does not cost me a cent to do.

fsndz 2y ago

Open source is one of the most thankless jobs. People who do it should still think about other ways to make money, or find a way to earn while contributing. It makes no sense to write amazing software, used by large corporations to generate billions, while you end up poor and bitter. No, it’s not fair, and no one should allow themselves to be taken advantage of in that way. Open source is a gift, but before giving to others, you should ensure you have enough for yourself.

benfortuna 2y ago
As an Open Source maintainer, I have always considered it something to do when I want to. If it becomes a burden or a chore, then I stop doing it, regardless of demands from users. I have no expectations of the users, and I expect the same from them.
- fsndz 2y ago
  best mindset tbh
- stavros 2y ago
  This is the only way OSS can be sustainable, I appreciate people who make OSS their (unpaid) job, but it can't be healthy for them.
theosp 2y ago
At JustDo we make our source code available for transparency and collaboration, we use a source-available license that ensures fair compensation for our work. This model allows us to maintain the benefits of open development while avoiding the pitfalls of unrestricted open-source licensing, ensuring we can sustainably develop and support our software. I developed this license https://justdo.com/source-available-license https://justdo.com/source-available-license , if someone wants to adopt it for their project, I'd love to provide its Latex form, just DM me. (With enough demand, I might Open Source the Source available license ;) )."
- llm_trw 2y ago

DoreenMichele 2y ago

I don't know how we resolve this. Some things are excellent because open source allows an individual to make what they want without answering to a boss or whatever and then if it gets popular, it comes with responsibilities but probably little or no pay. As someone who did a lot of volunteer work, these issues resonate with me -- painfully so. That's probably my primary motive for reading such articles when I'm not really a programmer.

bongodongobob 2y ago
What's to resolve? You either do something for the love of it or you don't. There's nothing to solve, it is what it is. If you want to get paid for writing your software get a job, start a company. OSS is neither of those things.
- DoreenMichele 2y ago
  I'm far from the only person who feels people should get paid for their work if they add value to the lives of others or this article wouldn't exist. Some people know how to add value and don't know how to turn that into an income and if they desperately need income and everybody wants their work but nobody pays them, it's extremely infuriating and crazy making.
  - bongodongobob 2y ago
    Then they should ask for it. "I give my software away for free and no one pays me for my work." Your argument makes no sense.
    - DoreenMichele 2y ago
      Some of them do ask for it. And it does little or nothing. I'm a writer and a blogger. Newspapers are dying. If you put ads on your site, people use ad blockers. People find ways around pay walls. Etc. Sometimes you can't somehow magically control the fact that people won't pay you.

bongodongobob 2y ago

Old open source maintainers think they are more important and replaceable than they really are. It's the same in any job or company. We are all very replaceable. Boomers thinking they hold the world together is typical and hilarious. Edit: At my current job I replaced a 65 year old retiree that the company thought was an irreplaceable lynchpin. I learned his job in 2 weeks.

account42 2y ago
Anyone who says they learned a long-term employee's job in two weeks is either full of shit or hopelessly naive.

swayvil 2y ago

There ain't no justice so don't expect any. Either join the filthy dogfight or not. I prefer to not.

lazyasciiart 2y ago

Hm, sounds the same as the concerns about the fields of teaching, nursing, eldercare and childcare. Interesting parallel.

journal 2y ago

It's the same reason why it's difficult for single men to find a partner. Life has become too individual. Didn't Rick Beato just talk about this... https://www.youtube.com/watch?v=h_DjmtR0Xls https://www.youtube.com/watch?v=h_DjmtR0Xls I have a project. I'm willing to spend time to help someone learn how to contribute, and in return they'll gain experience they can use to earn money elsewhere. How do you find those people? It's the sales. We have saturated our tolerance for advertising. We just assume everyone who approaches us wants to sell us something right away. When I started development on my accounting application, I decided to go around town and talk to businesses to figure out what features I should add. I had nothing to sell, I just wanted to talk to people about my own personal initiative. Never mind everyone on the internet screaming that an ERP system can't be done by a single person. No one wants to talk to me, no one cares. And you all know the best of us are introverts because we focus on the problem and not the sale. YCombinator: learn to do sales on your own, don't look for sales oriented co-founder. Seriously? Every day it's getting harder and harder to do sales. It's not even sales but social engineering. You hear words like "funnels" and "CPA". I reached out to my network, I know about 7 people capable of helping me. None had the drive to lift a finger cause they're all too comfortable with their day jobs. I don't blame them, I would be too if I was being paid $100k to change background color of buttons every two weeks. Yes, what I'm building is of commercial nature, but I have other interests too, like creating mesh network with ESP32 which to me has no commercial value and would be done purely for fun. I'm sure there's people with similar interest exist, but they're being kept guard by social media companies that work against collective initiative. Cause if they didn't, it would be too easy for people to find what they're looking for. I have interview on 24th. If I get the job the progress on my project stops. I'm 1/4 ways through to production, that's three more years of development. If I had few people to help me, we could complete it in six months and end up with jobs maintaining it. Like many people pointed out - time is precious, "you couldn't even pay me to do it", "I have a family". So you have to find people just at the right time who have overlapping free time. I've run out of money, gotta go back to work. Increment this counter if you gave up on open-source: 1

sureIy 2y ago

On a related note: the worst thing you can possibly do as an open source developer is to create a product for the general public to use. You hate tickets without repro? Enjoy the barrage of “help. Doent work”, “me too” and “HELLO IT’S BEEN 3 DAYS” messages.

hypfer 2y ago
I think the problem isn't it being open source but it being GitHub flavored open source. If you're building a product, you probably should not be having it on GitHub with issues enabled. There are very good reasons why the support processes of commercial entities that build products are the way they are. You do want a lot more friction and you do likely want to limit support to paying customers. GitHub-style public issue trackers are just a bad idea overall IMO. They only work if the "public" is only "public" because everyone _in theory_ could take part. In practice however, you only want to grant such unlimited write access to vetted individuals. This happened to happen automatically previously (because getting to the point where you even know where to open a ticket _was_ part of the vetting process), but with GitHub as the default for everyone and everything, it needs to be a conscious effort. If you think about it, it is completely insane how any random individual just has to press one button to publish whatever they want to a super prominent part of what is effectively your products/projects website. That simply shouldn't be a power random individuals have
- antimemetics 2y ago
  You can restrict issue creation/comments etc to certain users if you don’t want to open it to the public. You can also use a separate repo: https://docs.github.com/en/repositories/creating-and-managing-repositories/creating-an-issues-only-repository https://docs.github.com/en/repositories/creating-and-managin... It’s a choice the maintainer has to make. To me this is mostly self inflicted pain…
  - hypfer 2y ago
    Yes and no. Sure, countermeasures exist, but the issue is that you first need to be aware of what exactly the problem is before you can take these countermeasures. The reality however is that people just hear "You should do GitHub" and then for some inexplicable reason slowly descend into feeling bad without any clear reason why. After all, they're following all the "best practices" laid out by people that clearly know what they're doing and surely have their best interest in mind.

kkfx 2y ago

There are few points: - there is no FLOSS culture in most people, so the classic model "I publish and maintain my code, others get it from free and give back their improvements equally for free" does not work anymore in most cases. Collaboration culture seems to be very diminished, some try be moral police, some simply do not care etc; - mere widespread lack of competence mixing, in the past with usenet newcomers and gurus was together, interact and share visions, doubts etc, make all people involved learn. Today with Reddit and co people are divided, gurus with gurus, newcomers with newcomers, these are Indian castes with extremely little "social mobility" and that's a large part of why the mean culture is collapsed and almost all new projects not only in FLOSS but in the whole society are failures; - lack of a good software base, modern software designed by commercial/managerial needs are CRAP, even the finest one, not because the code is crap, but because the environment is. An OS need to be a single application where anyone can automate their small bits at their competence level, this mode was killed because compartmentalizing anything means more products to sell, this is technically unsustainable and most modern people works in such environments and many young have no idea of the old mode and it's power, as a result good tools left behind, those who know them isolated, newcomers suffer from the lack of proper tooling and can't progress; - finally the "slavery flat line with a dot on top", meaning only few nowadays do things, the giants, others are essentially their slaves. Most companies have no iron, no operation in house, just sitting on the shoulders of giants, using their iron and operation through their interfaces/services. This means the social FLOSS ecosystem does not exists anymore. More and more people burned by this model try to go FLOSS, off the cloud etc, but they lack tools and competence and resurface from such disaster it's damn not easy since still the largest part of the world is in the barbaric land of the giants where even damn simple things are complicated because that's makes the money for someone.

hiAndrewQuinn 2y ago

I've long wondered why FOSS developers of successful software don't offer some kind of financial bounty for whistleblowers who reveal that a given legal entity is violating the terms of their license. Like, I release pretty much everything I create into the extended public domain (CC0/the Unlicense/0BSD), so I very intentionally have no dog in this race, but for those who make different choices for me regarding their public contributions, it just seems logical. Maybe it's just impossible to sue someone for violation of the GPL in a way which makes it easy to come out financially ahead, though.

delusional 2y ago
How would you pay for the bounty? It seems hard to argue that you sustained any damages in the violation, and that's usually the only thing you can ask for in a civil suit. Additionally, you just invented another thing for developers to maintain.
- baq 2y ago
  Ah gotta love the percentage of gross revenue clause of the GPL in the violations section.
  - hiAndrewQuinn 2y ago
    Man, I actually went looking for that. I bet some of us here could've made a killing bringing violators to justice if such a thing existed.
- hiAndrewQuinn 2y ago
  Yup, as hinted at in my comment. Seems tough. They could sue or try to settle out of court to get the company's own code to get licensed under the GPL, which seems like something they'd want as well. In that sense an open bounty is like putting a price tag on how much you really care, in terms of hours of your life you're willing to spend (indirectly) enforcing the rules you have set.
jackdaniel 2y ago

franciscop 2y ago

Want to just briefly mention, since the article doesn't mention it at all, the blatant conflict of interests: > open source project maintainers are not being paid for their work, spend three times as much time on security than they did three years ago, and have become less trusting of contributors following the xz backdoor, according to open source package security firm Tidelift. > Tildelift: Reduce security risk from bad open source packages

richbell 2y ago
I don't think "conflict of interest" is the right term in this case.

zaraGaj 2y ago

There used to be a culture of respect for talent and work in OSS. That is gone in many projects. Python for example is now run by repressive bureaucrats who abuse the infrastructure to intimidate and coerce people. Those who do not obey are slandered, libeled and banned, so they have no recourse to defend themselves against the libel. Python is a great example how OSS can be stolen by a small dominant clique that is active on Twitter (now Mastodon) and markets themselves as leaders while having done very little actual work in the past 15 years. All of this is enabled by Python's propaganda arm, the PSF, which is filled to the brim with mediocre members, most of whom haven't done anything at all but who brag with @psf in their Mastodon and GitHub bios. It is all smoke and mirrors now.

arresin 2y ago

> [Linus] also said it's far too early to give up on Rust in the kernel as it's still early days. Did I miss something? This sounds like they’re thinking about giving up on rust. Edit: this from the lead working on it: > "I am retiring from the project," Filho declared. "After almost four years, I find myself lacking the energy and enthusiasm I once had to respond to some of the nontechnical nonsense, so it's best to leave it up to those who still have it in them." It truly is the most toxic community. I’m just glad I’m not to feel like the only seeing / be affected by it.

account42 2y ago
> It truly is the most toxic community. Which one? Rust? Coming to an existing project and expecting them to convert to your pet language is pretty toxic, yes.

ruuda 2y ago

There is a growing culture of microdependencies, where one project can depend on hundreds or thousands of libraries, combined with automated "vulnerability" tracking, which means projects are constantly receiving notifications about issues in libraries deep in the dependency tree, most of the time in a part of the library that is not even used by the top-level application. It's no surprise that "security" is eating up more and more time.

pornel 2y ago
And every CVSS score is 9.8, because it's designed to never underestimate potential risk, no matter how absurdly unlikely, rather than be realistic about the actual risk.
- clwg 2y ago
  CVSS is not not really meant to measure risk, it primarily measures the severity of technical vulnerabilities. It should be used in conjunction with other factors such as system exposure and threat sources to determine the probability of exploitation. This should then be combined with impact and costing data to fully assess the risk. Regulatory requirements also need to be contextualized similarly. If they become burdensome, efforts should focus on reducing the exposure of your systems to those risks. That said, patch and configuration management should be second nature and performed continuously so that when a real issue arises, you're prepared and not worried about your environment falling over because you're unsure how it will respond to an update, or whether your backups will restore properly - which are risks as well. I saw more than a few organizations struggle with log4j because they only patched server systems when a vulnerability was publicly exposed, and a Metasploit exploit was available.

donatj 2y ago

> and have become less trusting of contributors following the xz backdoor That's almost certainly a good thing. Over the last decade plus of my using GitHub on three different occasions I have wandered into a project, submitted a pull request, and the author has simply given me full write access to the repo without my asking. I didn't want it. I didn't ask to be a maintainer of this project. People can be really weirdly not unconcerned about security.

keybored 2y ago

I don’t understand why this isn’t framed as an Economics problem? If a large group of people stop doing something that someone else depends on then that’s an Economic problem. No? I don’t mean in the narrow of sense of exchanging things for money. If society wants some undefined group of any kind of people to do something but they are not (or they are about to quit) then that’s a resource allocation problem of sorts. That’s the bare problem. This problem does not immediately prescribe a solution like paying someone in dollars and cents. That’s only one solution. Same if a country is having a fertility issue. The problem is sort of an economic one. But the answer doesn’t have to be paying would-be fathers and mothers. It could for example be to provide more free services that parents benefit from. Or it could mean reducing the hours in the “standard work week”. Or it could be to improve the pension of part-time workers (mothers are often part-time workers). Or it could be to more child-friendly urban planning. Or it could be to improve the public transportation and road infrastructure for households where the two partners work in different parts of the city/municipality/county. Are professional economists working on this problem? If not, why aren’t they? This seems like it should be their domain. Am I being totally naive here?

HL33tibCe7 2y ago
> Are professional economists working on this problem? If not, why aren’t they? Because right now the impacts aren’t particularly noticeable, even for people “in the know”, let alone professional economists who have never heard of the software supply chain
poincaredisk 2y ago
It's a global/international problem where each country efforts will improve the situation (OS ecosystem) for everyone equally. At this point it is clear that the humanity is terrible in solving problems like this (just see how climate change is going so far)

deleted 2y ago

[deleted]

qwertywert_ 2y ago

Open source maintainers get a kit of "clout" and respect, and they can use this experience to get high paying jobs at big companies. I know of a few people who clearly do this.

jazz9k 2y ago

If you want to get paid for software, open source isn't the answer. Charge for support or have commercial licenses in place.

mmooss 2y ago

> Small wonder then that the maintainer population is aging – not enough newcomers want the undercompensated, unappreciated job. Small wonder that some might not want to do that, but it doesn't explain why fewer people than previously would want that responsibility, especially if the population of developers has increased. My guess is that people are less interested in taking over other people's projects than in starting their own.

rldjbpin 2y ago

as an inexperienced, thankless issue-raiser in this world, i can give my 0.02 on this. a lot of open-source today seems like the charitable organizations of the world. the idea is to give selflessly, but a lot of it has become about lowkey entitlement, just because "nobody else is doing it" or will do it without our support. on the other hand, i do empathize with the double-edge nature of accessibility to open-source platforms. while using git can still be a daunting task, raising issues or "contributions" has become easier than making a ticket in most teams' Jira. again, you can choose to adapt to the platforms or just have a simple one that you control. i might raise well-thought out issues once in a while when it affects my work projects, but i will not even consider using the mailing list for a linux kernel issue. maybe that is a good way to get rid of the noise. i envy those who could generously give and also enjoy the process of just coding for its sake. those who don't do open-source with these ideas should not be asking for anything in return. we are not owed anything, no matter what good can come out of our work.