5 ms·

This is the part that scares me the most when it comes to security related open source systems, tools and software. What if there is suddenly no maintainer for

This is the part that scares me the most when it comes to security related open source systems, tools and software. What if there is suddenly no maintainer for a project? If the project is too complex to fork and there is no one willing to invest in development - would it not leave the door open for a project to be overtaken/maintained by surveillance authorities themselves? Also, I get the feeling that most people take projects like these for granted, shouldn't security companies that rely on these projects at least want to try and keep them alive by donations?

nextw33k 12y ago
I am surprised that the developers don't just seek sponsorship from corporate entities, especially with distributions which can get given priority support. Asking the populous to donate seems like a short term fix.
- peterwwillis 12y ago
  It doesn't really make sense for a corporation to fund development outside of its organization. First, how would you bill it? Tax-deductible gifts to a charity? To an individual, at the rate of a salary, to develop and maintain a product you want to use? Sounds an awful lot like employment. Somebody would need to pay taxes on it, and then there's the laws in whatever countries you're working to consider. Second, there's the immediate lack of benefits to funding someone outside your company. If you want a particular feature or fix done, you can't demand this person do it as they don't work for you. And if they quit, you'll have to hire someone to maintain it anyway, right? And if you need some domain-specific expertise or customization down the road, you'll again need to hire an expert for your company. It just makes a whole lot more sense to hire and keep an expert in-house that maintains the code, rather than gift to some rando some large chunk of money to work on something without addressing your company-specific needs. Third, if you wanted funding, you'd probably have to show you have a board made up of the companies that fund you and some industry peers, have a roadmap, processes for discovering, addressing and solving issues, etc... basically your own little organization to manage everything. Just one guy doing code isn't necessarily enough for sponsors to take you seriously. The problem here is that there's just one developer. Open source projects usually only work if there's many developers working on it a little at a time; then you don't need to pay full salaries and it won't go into disrepair. But for whatever reason (stagnation, disrepair, difficulty working with the community, obsolescence, etc) nobody is interested in working on it or with them. To me, that's a recipe for disaster: it means there's a 'smell' with this project, and maybe someone should fork it and do what they want with it now. (I actually work and have worked in companies where this has happened... nobody is going to get funding approved to give money to someone outside their company for something that would be better served in-house)
  - edwintorok 12y ago
    What makes you think that forking it will suddenly bring more developers? Why wouldn't that developer try and contribute patches first to the existing project?
    - peterwwillis 12y ago
      I'll answer that question with a question: why do you think only one developer is working on GnuPG?
      - edwintorok 12y ago
        There is one full-time developer, but if you look at the git history there were contributions from other people as well: $ git shortlog gnupg-2.0.9..gnupg-2.1.1|grep :|grep -v ^\ | wc -l 25
        res0nat0r 12y ago
        If you look at the git summary output you will see that one person Werner Koch was responsible for 82.4% of the work, NIIBE Yakuta was the next closest at 5.4% and it only goes straight off the cliff from there.
        dd9jn 12y ago
        To be fair, we switched to git only in December 2011, before that you would need to look at the ChangeLog. BTW, there is a http://gitstats.gnupg.org http://gitstats.gnupg.org.
        mintplant 12y ago
        I'm sorry, I just accidentally downvoted your comment. Hopefully someone else can cancel it out with an upvote, as HN doesn't let you undo a vote.
        res0nat0r 12y ago
ranko 12y ago
Good point - though it also applies to non-open-source systems, where we don't necessarily even get to keep the pieces if the maintainers disappear.
- tmikaeld 12y ago
  Of course! And it can get even worse with a proprietary system, if the company goes bankrupt, then there's no system or code left at all... or they may open source it. Although, the companies that open source their code after going bankrupt are extremely rare. But then there's the question, what will the clients do with that code? If it is a large system, it would take months to continue development on it - and who would pay for it? The most likely outcome is that the clients will go to the nearest competitor.

nextw33k 12y ago

I am surprised that the developers don't just seek sponsorship from corporate entities, especially with distributions which can get given priority support. Asking the populous to donate seems like a short term fix.

peterwwillis 12y ago
It doesn't really make sense for a corporation to fund development outside of its organization. First, how would you bill it? Tax-deductible gifts to a charity? To an individual, at the rate of a salary, to develop and maintain a product you want to use? Sounds an awful lot like employment. Somebody would need to pay taxes on it, and then there's the laws in whatever countries you're working to consider. Second, there's the immediate lack of benefits to funding someone outside your company. If you want a particular feature or fix done, you can't demand this person do it as they don't work for you. And if they quit, you'll have to hire someone to maintain it anyway, right? And if you need some domain-specific expertise or customization down the road, you'll again need to hire an expert for your company. It just makes a whole lot more sense to hire and keep an expert in-house that maintains the code, rather than gift to some rando some large chunk of money to work on something without addressing your company-specific needs. Third, if you wanted funding, you'd probably have to show you have a board made up of the companies that fund you and some industry peers, have a roadmap, processes for discovering, addressing and solving issues, etc... basically your own little organization to manage everything. Just one guy doing code isn't necessarily enough for sponsors to take you seriously. The problem here is that there's just one developer. Open source projects usually only work if there's many developers working on it a little at a time; then you don't need to pay full salaries and it won't go into disrepair. But for whatever reason (stagnation, disrepair, difficulty working with the community, obsolescence, etc) nobody is interested in working on it or with them. To me, that's a recipe for disaster: it means there's a 'smell' with this project, and maybe someone should fork it and do what they want with it now. (I actually work and have worked in companies where this has happened... nobody is going to get funding approved to give money to someone outside their company for something that would be better served in-house)
- edwintorok 12y ago
  What makes you think that forking it will suddenly bring more developers? Why wouldn't that developer try and contribute patches first to the existing project?
  - peterwwillis 12y ago
    I'll answer that question with a question: why do you think only one developer is working on GnuPG?
    - edwintorok 12y ago
      There is one full-time developer, but if you look at the git history there were contributions from other people as well: $ git shortlog gnupg-2.0.9..gnupg-2.1.1|grep :|grep -v ^\ | wc -l 25
      - res0nat0r 12y ago
        If you look at the git summary output you will see that one person Werner Koch was responsible for 82.4% of the work, NIIBE Yakuta was the next closest at 5.4% and it only goes straight off the cliff from there.
        dd9jn 12y ago
        To be fair, we switched to git only in December 2011, before that you would need to look at the ChangeLog. BTW, there is a http://gitstats.gnupg.org http://gitstats.gnupg.org.
        mintplant 12y ago
        I'm sorry, I just accidentally downvoted your comment. Hopefully someone else can cancel it out with an upvote, as HN doesn't let you undo a vote.
        res0nat0r 12y ago

ranko 12y ago

Good point - though it also applies to non-open-source systems, where we don't necessarily even get to keep the pieces if the maintainers disappear.

tmikaeld 12y ago
Of course! And it can get even worse with a proprietary system, if the company goes bankrupt, then there's no system or code left at all... or they may open source it. Although, the companies that open source their code after going bankrupt are extremely rare. But then there's the question, what will the clients do with that code? If it is a large system, it would take months to continue development on it - and who would pay for it? The most likely outcome is that the clients will go to the nearest competitor.