3 ms·
Given all the efforts to produce SBOMs, it would be really nice if companies used them to pay a tithe to their dependencies. None will, of course, because compa
by teeray 2y ago
Given all the efforts to produce SBOMs, it would be really nice if companies used them to pay a tithe to their dependencies. None will, of course, because companies love getting all that software for free.
- ChoHag 2y agoIf the dependencies wanted to get paid they should not have given their work away for free. If you give your work away for free you cannot expect to get paid for it. For people who deal with intractible logic all day it's amusing how much these simple facts fail to get through their thick skulls.
- teeray 2y ago> If the dependencies wanted to get paid they should not have given their work away for free. That’s not really a reasonable position. Nobody signs up for maintaining a library that most of the Internet depends upon with megacorps beating down their doors for an unpaid P0 fix. “They gave it away for free” doesn’t mean they are your eternal slave.
- sister_shotgun 2y agohow much will they love it when their stuff starts breaking?
- keyringlight 2y agoAt that point (or preferably before) they need to pay attention to exactly what they're getting, including warranties (if any) and what paid options are available to get what they need or want.
- goodpoint 2y agoAt the very least we need AGPL to become the norm.
- goodpoint 2y agoInteresting, a rain of silent downvotes. And then you wonder why people give up.
- Tomte 2y agoOpen Source projects could sell SBOM fragments with correct licensing information. "Instead of scanning for copyright notices and license texts yourself, just sponsor us on GitHub and get access to always up-to-date SBOM information by the people who really know what‘s inside“.