4 ms·

Open Source Resistance: keep OSS alive on company time

275 points by mikemcquaid 5mo ago

mikemcquaid 5mo ago
Author here. I've maintained Homebrew since 2009. This manifesto is for the maintainers I know who have quietly built a sustainable OSS practice inside companies that directly or indirectly depend on their work. I'm also at the point in my career where I can say these things with fewer negative consequences than most maintainers can. The "polite" channels (Open Source Pledge, GitHub Sponsors, Open Source Friday) ask companies nicely to contribute. I argue instead that maintainers inside those companies should just take the work time they need to maintain the open source those companies already benefit from. Happy to take questions. (I'm not a lawyer: please read your employment contract before acting on any of this!)
- chrisweekly 5mo ago
  Great post. Also thanks for homebrew! And for your post on sandboxes... secure agentic setup!
  - droctothorpe 5mo ago
    Love the manifesto. It perfectly describes the approach I adhere to and have encouraged many other engineers to adopt. Better to ask for forgiveness than permission. Open source means distributed maintenance. Many hands make light work.
__MatrixMan__ 5mo ago
This is a good idea, a great idea even, but I'm not sure it's a good idea to position it as "resistance". Your job, likely, is to achieve some goal. You're the specialist who gets to decide how to achieve that goal. If open source software is part of that decision, then maintaining it is should also part of that decision. It's not radical, it's just doing your job by protecting the future stability and maintainability of things you rely on for that job.
- redwood 5mo ago
  Agree. The characterization makes it seem like somebody's trying that extra attention on social media. It's sad that we're at the point where everything has to be hyperbolic
- blurbleblurble 5mo ago
  It's also just good business sense. Companies that promote collaboration via open source are promoting the ecosystem that feeds their business.
- aleqs 5mo ago
  While I agree with everything you say, the reality of most tech companies these days (based on my experience), is that they will not even invest time into maintaining their own infrastructure and libraries unless forced to do so - much less OSS. Building useless features for gaming metrics, enshitification, dark patterns, borderline malware/hype integration - all would be prioritized over foundational infra/library investments.
  - __MatrixMan__ 5mo ago
    I've seen plenty of the evils you're talking about, managers tend to make terrible engineering decisions and then instruct their engineers to go forth and make it so. I guess what I'm saying is that, as an engineer, your value proposition is that you can shield your manager from getting mired in such details by not asking for their unqualified opinion in the first place. Just give estimates which include time for not doing things the dumb way, and then don't do things the dumb way. When it comes time to talk about performance reviews, call it "taking ownership."
    - aleqs 5mo ago
      Ah yes, agreed!
jmclnx 5mo ago
Where I use to work, you got 4 hours per week to work on your on thing, but that ended when covid hit and the company started feeling some financial pain.
zokier 5mo ago
While I wholeheartedly agree this as a general concept, I find it tricky to accomplish in practice. Ianal, but afaik in general your employer owns the ip, and as such publishing it as oss requires explicit permission. And getting that permission often is difficult, needs to go through endless red tape and legal departments etc. > In the United States, United Kingdom, and several other jurisdictions, if a work is created by an employee as part of their job duties, the employer is considered the legal author or first owner of copyright. https://en.wikipedia.org/wiki/Work_for_hire https://en.wikipedia.org/wiki/Work_for_hire That being said, I do think open source work (maintenance/development) should happen by salaried professionals instead of volunteers begging for donations. The big question is how to make that happen, how to get companies accept oss contribution as standard practice instead of something that needs separate individual negotiating.
- deleted 5mo ago
  [deleted]
- gchamonlive 5mo ago
  You don't need to push for full opensource to be able to contribute. You can negotiate time to help maintain oss packages the company IP relies upon and design your IP around creating agnostic modules that can later be released to the community.
- shimman 5mo ago
  This doesn't apply to every state. In California you have the California Labor Code Section 2870 which prohibits employers from stealing workers IP.
  - em-bee 5mo ago
    that does not apply to work done during work hours or on company equipment.
- mikemcquaid 5mo ago
  I'd personally got specific contract carveouts for this to only apply e.g. during working hours on company equipment (or even more liberal). The GitHub liberal IP agreement is a good example of being even more chill here.
wbolt 5mo ago
This is so crazy. Companies benefit from OSS so they need to pay? Come on. Companies benefit from OSS because the core idea of most of these licenses is exactly this - everyone can benefit even without contributing back. Don’t like it? Think this is not fair? Don’t do OSS or pick a more restrictive license. If a company pays for your work time not work products (many contracts work like this) they have the full right to expect that during this work time you do the work explicitly ordered by them. It’s not only the law - it’s common sense.
- telesilla 5mo ago
  Unfortunately there are often questions of liability. What if you commit code that later becomes subject to litigation? It's more complicated than "we don't want to". (I'm fully supportive but when legal is involved you have to be able to justify the risk).
beastman82 5mo ago
This is an ethical disgrace and everyone involved should be ashamed.
- keybored 5mo ago
  Elaborate?
  - beastman82 5mo ago
    Read "Not everyone will approve of this" section. You are not free to make any of these decisions on behalf of your employer.
    - somewhatgoated 5mo ago
      Won’t somebody think of the companies and their shareholders!!1
      - beastman82 5mo ago
        *and their employees, who depend on the company to be healthy as a central economic tenet of their employment. This really isn't debatable
        somewhatgoated 5mo ago
        The employees are able to make their own decisions and as written on the site should make sure that they are allowed to contribute - I don’t get why you think that’s a “disgrace” and not debatable
ktallett 5mo ago
Whilst not viable in every business, I do this a lot in my research, scripts I create, custom software I make for the lab, I have been fortunate to be able to plop online. It is extremely niche software (power meter, and in the pipeline, aligning photonic chips) and often simply a linux/haiku version of existing windows based software but I like to at least give a little bit back considering all the taking the institute does.
jcalvinowens 5mo ago
My employers have generally been fine giving me blanket permission to contribute to specific open source projects. The framing matters: don't say "can I please do some charity work because it makes me feel good". Say, "can I have your permission to get free rigorous review from experts in my field, and zero out all future maintenance costs for your company by contributing my fixes to the upstream open source project?" Because that's really how it is. No employer of mine has ever said no to that. It is entirely in their interest for you to do this, you just have to help them see it.
- throw1234567891 5mo ago
  “Sure, let me run this through the compliancy team. Just to make sure there’s no intellectual property infringement. Which repository and issue, exactly?”
  - lqstuart 5mo ago
    it hurts how true this is
  - deleted 5mo ago
    [deleted]
- tombert 5mo ago
  I'm a little sad that I got laid off from a previous job for a variety of reasons, but one big one was that there were discussions of letting me open source some very big changes I had made to the Kafka Streams library. I rewrote a lot of stuff while keeping the API mostly compatible, focusing on emphasizing non-blocking IO with backpressure semantics available if necessary. It was really cool and enabled a lot of interesting stuff involving the state store and mixing+matching blocking and non-blocking IO in a way that was still relatively performant. I think it was really neat and it's one of the projects I am most proud of because I was able to squeeze out performance in a lot of places that were non-obvious. I was pushing to allow us to release it to Github and/or make a PR to the upstream Kafka Streams project, but sadly they did layoffs before that was completed and afterwards there was really no "champion" to do that, so it's stuck in proprietary land. I might still do it from scratch and FOSS it, it's been long enough to where I think I wouldn't get in trouble if I rewrote it and released it (there weren't any patents or anything attached to it), and there are a few things I'd like to change anyway (like getting rid of the dependency of Vert.x). Maybe if I ever get a week off I'll do that.
keybored 5mo ago
Don’t give shit away for free if you expect something in return, even something altruistic like for the recipients to be nice to the gift and keep it in good shape. I think it makes more sense for the commons to be built on mutuality and some kind of antibody against parasitic exploitation. There is no “tragedy of the commons”. Private enterprise is the only tragedy.
- cindyllm 5mo ago
  [dead]
rhubarbtree 5mo ago
Surely OSS is a solved problem. AI generates everything automatically. You don’t need to look at the code, so there is nothing for humans to do but prompt. If you can do 1000x surely most projects are now essentially “complete” and bug free. I don’t get this contradiction. Something is wrong.
prmoustache 5mo ago
> "and make sure you own the open source IP you ship. " In all the juridictions I have worked in, the code I ship during my work hours is owned by my employer, not me. I simply just can't decide on my own to contribute during my work hours. I need a formal agreement to work on open source code, and every single time I asked for it it took so much time (months) to run through legal department that I simply gave up or another contributor had shipped a PR in the meantime so I just gave up asking.
- blurbleblurble 5mo ago
  I wouldn't take a job where the employer wasnt publishing permissively licensed code for all but the production bits. It's demoralizing for me and would stress my soul to the brink. I'd rather be broke.
  - jagged-chisel 5mo ago
    In the US, you’d definitely be broke. There just aren’t many employers willing to deal with it. All the ones I’ve worked for just use what’s available without modification.
    - blurbleblurble 5mo ago
      I'm in the US and have made a living writing open source for almost 10 years now, through ups and downs, but it's worked out.
- Aurornis 5mo ago
  I think they were trying to say that you shouldn't try to commit work that is not yours to give away. There's another section down below about it, but the bullet point up top became confusing. This point is obvious to devs with more experience but has been a real problem with some junior devs at some of my companies: They see something cool the company is doing in an internal project and think it would make a great contribution to some open source project, without thinking about the problems with using their knowledge of closed-source code to submit substantially similar code (or in some cases, copy and pasting) to an open source project.
donatj 5mo ago
I work for a reasonably large company. We have an Open Source policy that boils down to ask your manager first, don't do it in the name of the company and don't release anything confidential. It's never been a problem, and I feel is perfectly reasonable in the grand scheme of things.
lacymorrow 5mo ago
[flagged]
aleqs 5mo ago
Absolutely love this!
groby_b 5mo ago
Every single fucking employee contract in the US mentions that the company has the right to any work done on company equipment and/or on company time. This is such a bad idea, it's impressive.
tonymet 5mo ago
brought to you by the unemployed , or soon to be unemployed and sued.
aledem 5mo ago
Generally in every big corporation I worked any request to work on something outside of directly writing code to the company's codebase was answered by the direct manager with "Do it in your free time", even if the justification was provided. In a profit oriented environment only immediate value is considered worth pursuing. The attitude is pretty parasitic and dictated by the constant race for higher efficiency and metrics, which comes from the very top.
marcogarces 5mo ago
with seniority, when you get to that point in the interview process where they ask you: "so you have any questions for us?", I just ask: "what is your position of using some of my time contributing to the OSS projects this company relies on?". Based on the answer, you decide if you want to stay.
Steinmark 5mo ago
[flagged]
johnmcarthur 5mo ago
I don't have any problem contributing to 3rd party open source projects at work time for e.g. fixing a bug, but how do you deal with your OWN open source? Let's say you have a small library you made personally, then use it at work, then find a bug during work hours. If I contribute during those work hours, I think that'd be on the gray zone. Has anyone negotiated this during an interview? How do you do it?
- skywhopper 5mo ago
  I’ve never worked anywhere that actually cared about this in practice. I just did what needed doing. When I asked about how to do it “right”, I could never get any answer.
skywhopper 5mo ago
I’ve never had luck asking permission for open source stuff, either contributing or just publishing my own stuff (which is often work-related). No one told me no, but they never approved anything either. So at some point I stopped asking and I just do what needs to be done.
tracker1 5mo ago
I've definitely forked to fix a problem and PR'd the result upstream to fix work problems before. IT's one of the nice things in terms of being able to use/access open source. It's also why git is pretty much a first class option for package.json and cargo.toml... Just so you can direct to the fork until a change is upstreamed.
smaudd 5mo ago
noooo
autobe 5mo ago
Developing typia (https://github.com/samchon/typia https://github.com/samchon/typia), and have used it in many companies. Although I never explicitly discussed open source when signing my employment contract, generally no one said anything about using or maintaining it. Even when I mentioned the need to add features or fix bugs while writing work logs or roadmaps, no manager really said anything.

275 points by mikemcquaid 5mo ago

Author here. I've maintained Homebrew since 2009. This manifesto is for the maintainers I know who have quietly built a sustainable OSS practice inside companies that directly or indirectly depend on their work. I'm also at the point in my career where I can say these things with fewer negative consequences than most maintainers can. The "polite" channels (Open Source Pledge, GitHub Sponsors, Open Source Friday) ask companies nicely to contribute. I argue instead that maintainers inside those companies should just take the work time they need to maintain the open source those companies already benefit from. Happy to take questions. (I'm not a lawyer: please read your employment contract before acting on any of this!)

chrisweekly 5mo ago
Great post. Also thanks for homebrew! And for your post on sandboxes... secure agentic setup!
- droctothorpe 5mo ago
  Love the manifesto. It perfectly describes the approach I adhere to and have encouraged many other engineers to adopt. Better to ask for forgiveness than permission. Open source means distributed maintenance. Many hands make light work.

__MatrixMan__ 5mo ago

This is a good idea, a great idea even, but I'm not sure it's a good idea to position it as "resistance". Your job, likely, is to achieve some goal. You're the specialist who gets to decide how to achieve that goal. If open source software is part of that decision, then maintaining it is should also part of that decision. It's not radical, it's just doing your job by protecting the future stability and maintainability of things you rely on for that job.

redwood 5mo ago
Agree. The characterization makes it seem like somebody's trying that extra attention on social media. It's sad that we're at the point where everything has to be hyperbolic
blurbleblurble 5mo ago
It's also just good business sense. Companies that promote collaboration via open source are promoting the ecosystem that feeds their business.
aleqs 5mo ago
While I agree with everything you say, the reality of most tech companies these days (based on my experience), is that they will not even invest time into maintaining their own infrastructure and libraries unless forced to do so - much less OSS. Building useless features for gaming metrics, enshitification, dark patterns, borderline malware/hype integration - all would be prioritized over foundational infra/library investments.
- __MatrixMan__ 5mo ago
  I've seen plenty of the evils you're talking about, managers tend to make terrible engineering decisions and then instruct their engineers to go forth and make it so. I guess what I'm saying is that, as an engineer, your value proposition is that you can shield your manager from getting mired in such details by not asking for their unqualified opinion in the first place. Just give estimates which include time for not doing things the dumb way, and then don't do things the dumb way. When it comes time to talk about performance reviews, call it "taking ownership."
  - aleqs 5mo ago
    Ah yes, agreed!

jmclnx 5mo ago

Where I use to work, you got 4 hours per week to work on your on thing, but that ended when covid hit and the company started feeling some financial pain.

zokier 5mo ago

While I wholeheartedly agree this as a general concept, I find it tricky to accomplish in practice. Ianal, but afaik in general your employer owns the ip, and as such publishing it as oss requires explicit permission. And getting that permission often is difficult, needs to go through endless red tape and legal departments etc. > In the United States, United Kingdom, and several other jurisdictions, if a work is created by an employee as part of their job duties, the employer is considered the legal author or first owner of copyright. https://en.wikipedia.org/wiki/Work_for_hire https://en.wikipedia.org/wiki/Work_for_hire That being said, I do think open source work (maintenance/development) should happen by salaried professionals instead of volunteers begging for donations. The big question is how to make that happen, how to get companies accept oss contribution as standard practice instead of something that needs separate individual negotiating.

deleted 5mo ago
[deleted]
gchamonlive 5mo ago
You don't need to push for full opensource to be able to contribute. You can negotiate time to help maintain oss packages the company IP relies upon and design your IP around creating agnostic modules that can later be released to the community.
shimman 5mo ago
This doesn't apply to every state. In California you have the California Labor Code Section 2870 which prohibits employers from stealing workers IP.
- em-bee 5mo ago
  that does not apply to work done during work hours or on company equipment.
mikemcquaid 5mo ago
I'd personally got specific contract carveouts for this to only apply e.g. during working hours on company equipment (or even more liberal). The GitHub liberal IP agreement is a good example of being even more chill here.

wbolt 5mo ago

This is so crazy. Companies benefit from OSS so they need to pay? Come on. Companies benefit from OSS because the core idea of most of these licenses is exactly this - everyone can benefit even without contributing back. Don’t like it? Think this is not fair? Don’t do OSS or pick a more restrictive license. If a company pays for your work time not work products (many contracts work like this) they have the full right to expect that during this work time you do the work explicitly ordered by them. It’s not only the law - it’s common sense.

telesilla 5mo ago
Unfortunately there are often questions of liability. What if you commit code that later becomes subject to litigation? It's more complicated than "we don't want to". (I'm fully supportive but when legal is involved you have to be able to justify the risk).

beastman82 5mo ago

This is an ethical disgrace and everyone involved should be ashamed.

keybored 5mo ago
Elaborate?
- beastman82 5mo ago
  Read "Not everyone will approve of this" section. You are not free to make any of these decisions on behalf of your employer.
  - somewhatgoated 5mo ago
    Won’t somebody think of the companies and their shareholders!!1
    - beastman82 5mo ago
      *and their employees, who depend on the company to be healthy as a central economic tenet of their employment. This really isn't debatable
      - somewhatgoated 5mo ago
        The employees are able to make their own decisions and as written on the site should make sure that they are allowed to contribute - I don’t get why you think that’s a “disgrace” and not debatable

ktallett 5mo ago

Whilst not viable in every business, I do this a lot in my research, scripts I create, custom software I make for the lab, I have been fortunate to be able to plop online. It is extremely niche software (power meter, and in the pipeline, aligning photonic chips) and often simply a linux/haiku version of existing windows based software but I like to at least give a little bit back considering all the taking the institute does.

jcalvinowens 5mo ago

My employers have generally been fine giving me blanket permission to contribute to specific open source projects. The framing matters: don't say "can I please do some charity work because it makes me feel good". Say, "can I have your permission to get free rigorous review from experts in my field, and zero out all future maintenance costs for your company by contributing my fixes to the upstream open source project?" Because that's really how it is. No employer of mine has ever said no to that. It is entirely in their interest for you to do this, you just have to help them see it.

throw1234567891 5mo ago
“Sure, let me run this through the compliancy team. Just to make sure there’s no intellectual property infringement. Which repository and issue, exactly?”
- lqstuart 5mo ago
  it hurts how true this is
- deleted 5mo ago
  [deleted]
tombert 5mo ago
I'm a little sad that I got laid off from a previous job for a variety of reasons, but one big one was that there were discussions of letting me open source some very big changes I had made to the Kafka Streams library. I rewrote a lot of stuff while keeping the API mostly compatible, focusing on emphasizing non-blocking IO with backpressure semantics available if necessary. It was really cool and enabled a lot of interesting stuff involving the state store and mixing+matching blocking and non-blocking IO in a way that was still relatively performant. I think it was really neat and it's one of the projects I am most proud of because I was able to squeeze out performance in a lot of places that were non-obvious. I was pushing to allow us to release it to Github and/or make a PR to the upstream Kafka Streams project, but sadly they did layoffs before that was completed and afterwards there was really no "champion" to do that, so it's stuck in proprietary land. I might still do it from scratch and FOSS it, it's been long enough to where I think I wouldn't get in trouble if I rewrote it and released it (there weren't any patents or anything attached to it), and there are a few things I'd like to change anyway (like getting rid of the dependency of Vert.x). Maybe if I ever get a week off I'll do that.

keybored 5mo ago

Don’t give shit away for free if you expect something in return, even something altruistic like for the recipients to be nice to the gift and keep it in good shape. I think it makes more sense for the commons to be built on mutuality and some kind of antibody against parasitic exploitation. There is no “tragedy of the commons”. Private enterprise is the only tragedy.

cindyllm 5mo ago
[dead]

rhubarbtree 5mo ago

Surely OSS is a solved problem. AI generates everything automatically. You don’t need to look at the code, so there is nothing for humans to do but prompt. If you can do 1000x surely most projects are now essentially “complete” and bug free. I don’t get this contradiction. Something is wrong.

prmoustache 5mo ago

> "and make sure you own the open source IP you ship. " In all the juridictions I have worked in, the code I ship during my work hours is owned by my employer, not me. I simply just can't decide on my own to contribute during my work hours. I need a formal agreement to work on open source code, and every single time I asked for it it took so much time (months) to run through legal department that I simply gave up or another contributor had shipped a PR in the meantime so I just gave up asking.

blurbleblurble 5mo ago
I wouldn't take a job where the employer wasnt publishing permissively licensed code for all but the production bits. It's demoralizing for me and would stress my soul to the brink. I'd rather be broke.
- jagged-chisel 5mo ago
  In the US, you’d definitely be broke. There just aren’t many employers willing to deal with it. All the ones I’ve worked for just use what’s available without modification.
  - blurbleblurble 5mo ago
    I'm in the US and have made a living writing open source for almost 10 years now, through ups and downs, but it's worked out.
Aurornis 5mo ago
I think they were trying to say that you shouldn't try to commit work that is not yours to give away. There's another section down below about it, but the bullet point up top became confusing. This point is obvious to devs with more experience but has been a real problem with some junior devs at some of my companies: They see something cool the company is doing in an internal project and think it would make a great contribution to some open source project, without thinking about the problems with using their knowledge of closed-source code to submit substantially similar code (or in some cases, copy and pasting) to an open source project.

donatj 5mo ago

I work for a reasonably large company. We have an Open Source policy that boils down to ask your manager first, don't do it in the name of the company and don't release anything confidential. It's never been a problem, and I feel is perfectly reasonable in the grand scheme of things.

lacymorrow 5mo ago

[flagged]

aleqs 5mo ago

Absolutely love this!

groby_b 5mo ago

Every single fucking employee contract in the US mentions that the company has the right to any work done on company equipment and/or on company time. This is such a bad idea, it's impressive.

tonymet 5mo ago

brought to you by the unemployed , or soon to be unemployed and sued.

aledem 5mo ago

Generally in every big corporation I worked any request to work on something outside of directly writing code to the company's codebase was answered by the direct manager with "Do it in your free time", even if the justification was provided. In a profit oriented environment only immediate value is considered worth pursuing. The attitude is pretty parasitic and dictated by the constant race for higher efficiency and metrics, which comes from the very top.

marcogarces 5mo ago

with seniority, when you get to that point in the interview process where they ask you: "so you have any questions for us?", I just ask: "what is your position of using some of my time contributing to the OSS projects this company relies on?". Based on the answer, you decide if you want to stay.

Steinmark 5mo ago

[flagged]

johnmcarthur 5mo ago

I don't have any problem contributing to 3rd party open source projects at work time for e.g. fixing a bug, but how do you deal with your OWN open source? Let's say you have a small library you made personally, then use it at work, then find a bug during work hours. If I contribute during those work hours, I think that'd be on the gray zone. Has anyone negotiated this during an interview? How do you do it?

skywhopper 5mo ago
I’ve never worked anywhere that actually cared about this in practice. I just did what needed doing. When I asked about how to do it “right”, I could never get any answer.

skywhopper 5mo ago

I’ve never had luck asking permission for open source stuff, either contributing or just publishing my own stuff (which is often work-related). No one told me no, but they never approved anything either. So at some point I stopped asking and I just do what needs to be done.

tracker1 5mo ago

I've definitely forked to fix a problem and PR'd the result upstream to fix work problems before. IT's one of the nice things in terms of being able to use/access open source. It's also why git is pretty much a first class option for package.json and cargo.toml... Just so you can direct to the fork until a change is upstreamed.

smaudd 5mo ago

noooo

autobe 5mo ago

Developing typia (https://github.com/samchon/typia https://github.com/samchon/typia), and have used it in many companies. Although I never explicitly discussed open source when signing my employment contract, generally no one said anything about using or maintaining it. Even when I mentioned the need to add features or fix bugs while writing work logs or roadmaps, no manager really said anything.