5 ms·

I'll never understand why people do free dev work for multinational trillion dollar conglomerates.

by citizenpaul 1y ago

apwell23 1y ago
i don't think they did the work for them. they just reported it to them.
hombre_fatal 1y ago
Could say the same thing about open source software.
- blendergeek 1y ago
  It's why I don't understand why people believe in "open source". Why would I contribute free dev work to a billion dollar corporation? I do believe in "Free Software" which is contributing free dev work to my fellow man for the benefit of all man mankind.
  - CharlesW 1y ago
    This may be a misconception. "Free software" (e.g. Linux) also benefits billion-dollar corporations and "open source" also benefits all mankind.
    - blendergeek 1y ago
      Free software and open source are two ideologies for the same thing. Free Software is the ideology of developing the software for the benefit of mankind (it's sometimes termed a "political" stance but I see it as an ethical stance). Open source is the ideology of saving money at a corporation by not paying the developers. Sure open source can benefit mankind but will only develop corporate software for money. When developing on my own time, I will focus on software that either personally benefits me or benefits other regular people.
      - CharlesW 1y ago
        I applaud your choice! I just can't think of any free software examples that don't also benefit corporations.
        trueismywork 1y ago
        You need to think it in a different manner. When you have AGPL code, then it benefits mankind more than corporations. There's a Harvard report on value of open source to society based on how much money corporations put in. Today linux is working nicely on desktops (even though it's not the year of linux) and is heavily dominated by corporations. The parts where linux doesn't do well are exactly parts without corporate support. Software is becoming complex enough that it's not possible for a single company to just even maintain a compiler let alone an office suite. Its perfect ground for either one company having monopoly or an free software (not open source) being a base for masses.
        kortilla 1y ago
        That’s not an example of open source that doesn’t benefit corporations. Linux is amazing for corporations.
        Wilder7977 1y ago
        Lichess, the gazillion of self-hosting software. There are many examples of free software that are exclusively (or let's say predominantly) used in noncommercial environments. In any case, I agree with the commenter, and I think that developing a software which is also used by companies is different from looking for vulnerabilities in the context and scope of a bug bounty program for a specific company. Yes, you could argue that users of said company are going to be more secure, but it's evidence t like even in this case the company is the direct beneficiary.
    - NoOn3 1y ago
      at least under some licenses like GPL/AGPL you get some code back.
  - exe34 1y ago
    I think the argument is that when big companies make use of stuff, it gets more scrutiny and occasionally they contribute back improvements, and the occasional unicorn gets actual man hours paid for improving it. So if your project gets big enough, it's beneficial. But you have to have a MIT/BSD license usually, because companies will normally stay away from GPL.
  - eastbound 1y ago
    > Why would I contribute free dev work to a billion dollar corporation? The billion dollars company contributed more to your startup than you do to them. Microsoft provides: - VSCode, - Hosts all NPM repositories. You know, the ones small startups are too lazy to cache (also because it’s much harder to cache NPM repositories than Maven) and then you re-download them at each build, - Typescript
    - wkat4242 1y ago
      Meh it depends whether you use those things of course. There's other IDEs, other languages. And Microsoft isn't doing this out of charity. A lot of the really useful plugins are not working on the open source version, so people that use them provide telemetry which is probably valuable. Or they use it as a gateway to their services like GitHub Copilot. If a mega corporation gives you something for free it's always more beneficial to them otherwise they wouldn't do it in the first place.
      - eastbound 1y ago
        So, no OSS contribution is valid unless you are using this very library? Did Microsoft contribute more to the OSS world, or did the OSS world contribute more to Microsoft? I pardon Microsoft because they have donated Typescript, which is a true civilizational progress. You could say the OSS world has contributed to Microsoft because they’ve given them a real OS, which they didn’t have inner expertise to develop. We’re even. Now you sound like you have a beef against large companies and would find any argument against them. Some guy once told me that I didn’t increase my employees by 30% out of benevolence, but because I must be an awful employer. See, why else would I increase employees. This behavior is actively harmful to the rest of the world. You are depriving good actions from a “thank you” and hence you are depriving recipients of good actions from more of them. With this attitude, the world becomes exactly like you project it to be: Shitty.
        bgwalter 1y ago
        The open source ecosystem was perfect before Microsoft tried to meddle, assimilate and destroy. Microsoft has destroyed several open source projects by infiltrating them with mediocre MSFT employees. Microsoft bought the GitHub monopoly in order to control open source further. Microsoft then stole and violated the copyright by training "AI" on the GitHub open source. Microsoft finances influential open source organizations like OSI in order to make them more compliant and business friendly. The useful projects are tiny compared to the entire open source stack. Paying for NPM repositories is a goodwill gesture and another power grab.
  - victorbjorklund 1y ago
    Why do basic science which benefits everyone else for free?
- dylan604 1y ago
  I know maintainers of projects have been hired directly by companies using their code as it is the most expedient way forward. Others might just offer up enough money to get the maintainer to take up a few of their specific issues/requests in a way that makes it worth their while. Just because someone is working on a project that is open source does not mean that money cannot be involved in the development. The company paying that money knows that the updates released as a normal part of the project will be available to anyone else using it as well.
- pharrington 1y ago
  It's called "I use the software, I already want to improve the software I'm using, so after I improve it I'll contribute the improvements I've already made to the broader community." Granted, I myself have been guilty of not giving back to the open source community this way in the past, but I won't pretend that was reasonable or ethical of me! edit: after reading some commemnts, i realize i may have meant to say "free software" instead of "open source"
- Disposal8433 1y ago
  No, we can't say. I'm not an asshole, it helps people, and companies shun GPL licenses. That's not a valid comparison. Microsoft can go fuck itself, people around me love my software and it improves their lives.
  - tptacek 1y ago
    It's... 100% a valid comparison? The point is that doing free vulnerability research isn't irrational, not that doing open source work is bad. You're twisting yourself into a pretzel trying to keep the original argument alive.
hnthrow90348765 1y ago
It's still good for reputation. This is by a researcher at a company, so a benefit for both of them. Plus if we didn't have bug bounty programs, they'd have to willingly work at Microsoft to do this research.
- nicce 1y ago
  This could have turned badly in terms of reputation if they had tried to complain that the vulnerability should be critical, e.g. or using other ways to seek attention for not getting bounty, but current way was rather neutral way.
MattGaiser 1y ago
It mostly pays in career benefits. Same reason why plenty intern for free.
- qbit42 1y ago
  Who is interning for free as a software engineer?
  - koakuma-chan 1y ago
    Me
  - MattGaiser 1y ago
    People people who did bootcamps and thus are too risky to hire for most roles and cannot get into the standard CS hiring pipeline. Especially now that junior roles are drying up. In professions like fashion, virtually everyone seems to at some point.
jimbokun 1y ago
Well a lot of people do this kind of work to be able to commit crimes.

I'll never understand why people do free dev work for multinational trillion dollar conglomerates.

apwell23 1y ago

i don't think they did the work for them. they just reported it to them.

hombre_fatal 1y ago

Could say the same thing about open source software.

blendergeek 1y ago
It's why I don't understand why people believe in "open source". Why would I contribute free dev work to a billion dollar corporation? I do believe in "Free Software" which is contributing free dev work to my fellow man for the benefit of all man mankind.
- CharlesW 1y ago
  This may be a misconception. "Free software" (e.g. Linux) also benefits billion-dollar corporations and "open source" also benefits all mankind.
  - blendergeek 1y ago
    Free software and open source are two ideologies for the same thing. Free Software is the ideology of developing the software for the benefit of mankind (it's sometimes termed a "political" stance but I see it as an ethical stance). Open source is the ideology of saving money at a corporation by not paying the developers. Sure open source can benefit mankind but will only develop corporate software for money. When developing on my own time, I will focus on software that either personally benefits me or benefits other regular people.
    - CharlesW 1y ago
      I applaud your choice! I just can't think of any free software examples that don't also benefit corporations.
      - trueismywork 1y ago
        You need to think it in a different manner. When you have AGPL code, then it benefits mankind more than corporations. There's a Harvard report on value of open source to society based on how much money corporations put in. Today linux is working nicely on desktops (even though it's not the year of linux) and is heavily dominated by corporations. The parts where linux doesn't do well are exactly parts without corporate support. Software is becoming complex enough that it's not possible for a single company to just even maintain a compiler let alone an office suite. Its perfect ground for either one company having monopoly or an free software (not open source) being a base for masses.
        kortilla 1y ago
        That’s not an example of open source that doesn’t benefit corporations. Linux is amazing for corporations.
      - Wilder7977 1y ago
        Lichess, the gazillion of self-hosting software. There are many examples of free software that are exclusively (or let's say predominantly) used in noncommercial environments. In any case, I agree with the commenter, and I think that developing a software which is also used by companies is different from looking for vulnerabilities in the context and scope of a bug bounty program for a specific company. Yes, you could argue that users of said company are going to be more secure, but it's evidence t like even in this case the company is the direct beneficiary.
  - NoOn3 1y ago
    at least under some licenses like GPL/AGPL you get some code back.
- exe34 1y ago
  I think the argument is that when big companies make use of stuff, it gets more scrutiny and occasionally they contribute back improvements, and the occasional unicorn gets actual man hours paid for improving it. So if your project gets big enough, it's beneficial. But you have to have a MIT/BSD license usually, because companies will normally stay away from GPL.
- eastbound 1y ago
  > Why would I contribute free dev work to a billion dollar corporation? The billion dollars company contributed more to your startup than you do to them. Microsoft provides: - VSCode, - Hosts all NPM repositories. You know, the ones small startups are too lazy to cache (also because it’s much harder to cache NPM repositories than Maven) and then you re-download them at each build, - Typescript
  - wkat4242 1y ago
    Meh it depends whether you use those things of course. There's other IDEs, other languages. And Microsoft isn't doing this out of charity. A lot of the really useful plugins are not working on the open source version, so people that use them provide telemetry which is probably valuable. Or they use it as a gateway to their services like GitHub Copilot. If a mega corporation gives you something for free it's always more beneficial to them otherwise they wouldn't do it in the first place.
    - eastbound 1y ago
      So, no OSS contribution is valid unless you are using this very library? Did Microsoft contribute more to the OSS world, or did the OSS world contribute more to Microsoft? I pardon Microsoft because they have donated Typescript, which is a true civilizational progress. You could say the OSS world has contributed to Microsoft because they’ve given them a real OS, which they didn’t have inner expertise to develop. We’re even. Now you sound like you have a beef against large companies and would find any argument against them. Some guy once told me that I didn’t increase my employees by 30% out of benevolence, but because I must be an awful employer. See, why else would I increase employees. This behavior is actively harmful to the rest of the world. You are depriving good actions from a “thank you” and hence you are depriving recipients of good actions from more of them. With this attitude, the world becomes exactly like you project it to be: Shitty.
      - bgwalter 1y ago
        The open source ecosystem was perfect before Microsoft tried to meddle, assimilate and destroy. Microsoft has destroyed several open source projects by infiltrating them with mediocre MSFT employees. Microsoft bought the GitHub monopoly in order to control open source further. Microsoft then stole and violated the copyright by training "AI" on the GitHub open source. Microsoft finances influential open source organizations like OSI in order to make them more compliant and business friendly. The useful projects are tiny compared to the entire open source stack. Paying for NPM repositories is a goodwill gesture and another power grab.
- victorbjorklund 1y ago
  Why do basic science which benefits everyone else for free?
dylan604 1y ago
I know maintainers of projects have been hired directly by companies using their code as it is the most expedient way forward. Others might just offer up enough money to get the maintainer to take up a few of their specific issues/requests in a way that makes it worth their while. Just because someone is working on a project that is open source does not mean that money cannot be involved in the development. The company paying that money knows that the updates released as a normal part of the project will be available to anyone else using it as well.
pharrington 1y ago
It's called "I use the software, I already want to improve the software I'm using, so after I improve it I'll contribute the improvements I've already made to the broader community." Granted, I myself have been guilty of not giving back to the open source community this way in the past, but I won't pretend that was reasonable or ethical of me! edit: after reading some commemnts, i realize i may have meant to say "free software" instead of "open source"
Disposal8433 1y ago
No, we can't say. I'm not an asshole, it helps people, and companies shun GPL licenses. That's not a valid comparison. Microsoft can go fuck itself, people around me love my software and it improves their lives.
- tptacek 1y ago
  It's... 100% a valid comparison? The point is that doing free vulnerability research isn't irrational, not that doing open source work is bad. You're twisting yourself into a pretzel trying to keep the original argument alive.

hnthrow90348765 1y ago

It's still good for reputation. This is by a researcher at a company, so a benefit for both of them. Plus if we didn't have bug bounty programs, they'd have to willingly work at Microsoft to do this research.

nicce 1y ago
This could have turned badly in terms of reputation if they had tried to complain that the vulnerability should be critical, e.g. or using other ways to seek attention for not getting bounty, but current way was rather neutral way.

MattGaiser 1y ago

It mostly pays in career benefits. Same reason why plenty intern for free.

qbit42 1y ago
Who is interning for free as a software engineer?
- koakuma-chan 1y ago
  Me
- MattGaiser 1y ago
  People people who did bootcamps and thus are too risky to hire for most roles and cannot get into the standard CS hiring pipeline. Especially now that junior roles are drying up. In professions like fashion, virtually everyone seems to at some point.

jimbokun 1y ago

Well a lot of people do this kind of work to be able to commit crimes.