6 ms·

I think the biggest problem is visibility for these projects. They need to be louder. In the case of openssl, I had no idea that they were severly underfunded (

by lawl 12y ago

I think the biggest problem is visibility for these projects. They need to be louder. In the case of openssl, I had no idea that they were severly underfunded (until heartbleed). Same for GPG until now. I didn't hear they asked for donations. And I doubt I'm the only one. So I quickly checked if maybe this was big on HN at a point and I just missed it. https://hn.algolia.com/?query=GPG%20donation&sort=byPopularity&prefix&page=0&dateRange=all&type=story https://hn.algolia.com/?query=GPG%20donation&sort=byPopulari... https://hn.algolia.com/?query=GPG%20fund&sort=byPopularity&prefix&page=0&dateRange=all&type=story https://hn.algolia.com/?query=GPG%20fund&sort=byPopularity&p... https://hn.algolia.com/?query=GPG%20money&sort=byPopularity&prefix=false&page=0&dateRange=all&type=story https://hn.algolia.com/?query=GPG%20money&sort=byPopularity&... Nope. It's not just me. If not even the most technical people (that actually know what GPG and openssl are without looking it up) don't hear about this, how are regular people going to find out where to throw their donations at? I think people would donate if they knew about it. I'm going to send this guy $100 and consider it a license fee, because he deserves it.

pyre 12y ago
I knew that the developer pool for GPG was pretty small, and that this is a big reason why development isn't always fast. On the other hand, I had no idea that he was working full-time on it, and having money trouble. Also: If you search for "GPG Koch" you can come across this comment: https://news.ycombinator.com/item?id=6942254 https://news.ycombinator.com/item?id=6942254 EDIT: An example of development that is slow-coming: library support. Most GPG "libraries" in languages like Python and Ruby are just wrappers around the GPG command-line, because there is no proper library.
- nitrogen 12y ago
  Wrapping the command line should be a little bit safer from a security perspective, since a memory exfiltration bug won't transfer across processes. Just don't use the shell between the wrapper and the command.
  - pyre 12y ago
    Is this really the case? I recall that proper library support is slow-coming, not because of security model concerns, but because "doing it right" takes more time / money that there is in GPG development at the moment. EDIT: For example, I believe that it would require rewriting a lot of code, and that means said code would need to be audited to make sure no security bugs were introduced. It's "easier" to just wrap the current command-line tools because they are a known quantity.
    - nitrogen 12y ago
      I'm sure you're right, but because of this "laziness" we get a slight security boost at the cost of a slight performance loss.
- Torgo 12y ago
  is gpgme not a proper library? https://www.gnupg.org/%28it%29/related_software/gpgme/index.html https://www.gnupg.org/%28it%29/related_software/gpgme/index.... I haven't used it, so I really don't know.
  - csl 12y ago
    It's a library that talks through the shell. I was kinda disappointed when I learned that. But it may be on purpose, as someone else mentioned. I've used it while making bindings for it for my Scheme project: https://github.com/cslarsen/mickey-scheme/tree/master/lib/optional/gnupg https://github.com/cslarsen/mickey-scheme/tree/master/lib/op...
- lloeki 12y ago
  > Most GPG "libraries" in languages like Python and Ruby are just wrappers around the GPG command-line, because there is no proper library. IIUC this is intentional design of GPG 1.x vs GPG 2.x: the former is statically linked binaires for "security reasons" while the latter is a shared lib (libgcrypt) + binaries with exactly the same features.
davidroetzel 12y ago
You should have tried searching for GnuPG: https://hn.algolia.com/?query=GnuPG&sort=byPopularity&prefix=false&page=0&dateRange=all&type=story https://hn.algolia.com/?query=GnuPG&sort=byPopularity&prefix... I remember it made the front page (but that might have been during business hours here in europe).
malandrew 12y ago
I'm wondering if there is a meta-donation page that lists a bunch of the most important open source projects, how you can donate to them and their yearly funding goals (and how many developers are being supported).
- takluyver 12y ago
  That could be an interesting project for someone. I suspect the hardest bit would be how you determine which projects are most important or most deserving of donations. As soon as money is involved, people will try to game it and spam it.
  - gglon 12y ago
    I think the simplest method would be to consider total amount of donated money.
    - takluyver 12y ago
      As in projects that are attracting lots of donations are probably important? Or as in projects that aren't getting many donations probably need more?
  - logn 12y ago
    I think the package managers should add links to donate to projects. So I open up Synaptic to install GPG and in the description see that I can donate and they're only at 25% of their funding goal. Another key would be to add a real commercial justification to pay for projects instead of just donating. Often for tax and regulatory purposes businesses can't just spend money on fun, frivolous things unless they want to make a mess of their accounting. Maybe something like for each $50 you spend you get to ask one question on a mailing list or message board.
- korethr 12y ago
  Gratipay (gittip) comes to mind, but that's a donation mechanism, rather than the information collection you're describing. Sounds like a good idea for a project. IMO, the hardest part of that will be accurately prioritizing which projects are critical, very important, moderately important, etc.
drbawb 12y ago
>I think people would donate if they knew about it. Oh certainly, I use GPG on a daily basis, yet it never even occurred to me that such an ubiquitous project would have trouble gathering funds! I tossed in a donation as soon as I saw the link in the article. --- I remember jOOq (a Java SQL DSL) had similar troubles raising donations. They ended up moving to a commercial licensing model for 3.2+ that provides connectors for "enterprise" databases as well as professional support. Had I seen a banner asking for donations, I would've gladly donated what they're now charging for licenses. -- It is an excellent library. However I feel like the tooling does them a disservice. When the library can be added by tossing a few lines into `pom.xml` and having Maven fetch it, and the API can mostly be figured out w/ javadoc and your IDE's autocomplete: how many developers will even visit the project homepage and see a "We need funding!" banner?
- alex_duf 12y ago
  > When the library can be added by tossing a few lines into `pom.xml` and having Maven fetch it, and the API can mostly be figured out w/ javadoc and your IDE's autocomplete: how many developers will even visit the project homepage and see a "We need funding!" banner? That's a good point. Not sure how this can be technically addressed though
moron4hire 12y ago
This issue has been bugging me lately, given that I would like to start a product-oriented business, but I'm only one guy, who has to freelance to pay the bills. The problem, I think, lies in the lack of balance between different types of "users", their ability to absorb risk, and their ability to advertise. For an individual developer, new product development is a chicken-or-egg issue: you need money to live, but you can't make money off of an infant project. On the other hand, a corporation can siphon funds off of profitable projects into R&D, and the larger the company, the longer they can do it. There is a certain level of financial security that removes emotional burdens that can be real impediments to development progress. There is a singular focus that can be achieved by the developers in such a situation: one 100% focused developer is more than twice as productive as one 50% focused developer, all else being equal. It's also extremely difficult for an individual developer to get the word out on their project. But if Google even breaths a hint that they are doing something, a subreddit will be made for it overnight and TechCrunch will assign a team of reporters to cover breaking news. So from the start, the individual is behind the 8-ball in terms of being able to maintain a certain pace of development and gain mindshare for it. If you're entering an existing market, a lot of times the only way to gain traction for your project, to get any attention and get anything out of it, is to have to open source it just to meet other developer's expectations. But I suspect the vast majority of people who want "open source" really only want it as a security blanket and aren't actually going to look at it. I completely admit that I'm included in that group. For a corporation, what's the worst that can happen? In other words, who is going to fork their source? Another individual? They won't be able to keep up. Another corporation? They have to compete in both code and marketing, which isn't so attractive. It might be--all things considered--an equivalent effort to just start a competing product. Maybe even a little less effort, because you don't have to dance around collaboration and contribution issues. But for an individual, it's a significantly higher impact of a problem. If I make a tool, release it open source, and--say--Google decides that it's great and they want to use it, even if I license under the GPLv3, they can very easily strong-arm me out of the driver seat. They could be in complete compliance with the license and contribute all of their changes back, but their marketing machine could easily put themselves at the forefront of developers' minds as the source of that project. Is "closed now, open later" the solution? I don't know, that's always sounded to me like "closed now, closed later". See Android. What good is Android being open source if, by the time the source for the latest version is released, they've abandoned it for a new version? Correct me if I'm wrong. I'd like to be wrong, so I know in which direction to take my own business development. But it just seems like there are several types of power, and individual, independent developers have few that large corps do not, whereas large corps have several that indies do not.

by lawl 12y ago

pyre 12y ago

I knew that the developer pool for GPG was pretty small, and that this is a big reason why development isn't always fast. On the other hand, I had no idea that he was working full-time on it, and having money trouble. Also: If you search for "GPG Koch" you can come across this comment: https://news.ycombinator.com/item?id=6942254 https://news.ycombinator.com/item?id=6942254 EDIT: An example of development that is slow-coming: library support. Most GPG "libraries" in languages like Python and Ruby are just wrappers around the GPG command-line, because there is no proper library.

nitrogen 12y ago
Wrapping the command line should be a little bit safer from a security perspective, since a memory exfiltration bug won't transfer across processes. Just don't use the shell between the wrapper and the command.
- pyre 12y ago
  Is this really the case? I recall that proper library support is slow-coming, not because of security model concerns, but because "doing it right" takes more time / money that there is in GPG development at the moment. EDIT: For example, I believe that it would require rewriting a lot of code, and that means said code would need to be audited to make sure no security bugs were introduced. It's "easier" to just wrap the current command-line tools because they are a known quantity.
  - nitrogen 12y ago
    I'm sure you're right, but because of this "laziness" we get a slight security boost at the cost of a slight performance loss.
Torgo 12y ago
is gpgme not a proper library? https://www.gnupg.org/%28it%29/related_software/gpgme/index.html https://www.gnupg.org/%28it%29/related_software/gpgme/index.... I haven't used it, so I really don't know.
- csl 12y ago
  It's a library that talks through the shell. I was kinda disappointed when I learned that. But it may be on purpose, as someone else mentioned. I've used it while making bindings for it for my Scheme project: https://github.com/cslarsen/mickey-scheme/tree/master/lib/optional/gnupg https://github.com/cslarsen/mickey-scheme/tree/master/lib/op...
lloeki 12y ago
> Most GPG "libraries" in languages like Python and Ruby are just wrappers around the GPG command-line, because there is no proper library. IIUC this is intentional design of GPG 1.x vs GPG 2.x: the former is statically linked binaires for "security reasons" while the latter is a shared lib (libgcrypt) + binaries with exactly the same features.

davidroetzel 12y ago

You should have tried searching for GnuPG: https://hn.algolia.com/?query=GnuPG&sort=byPopularity&prefix=false&page=0&dateRange=all&type=story https://hn.algolia.com/?query=GnuPG&sort=byPopularity&prefix... I remember it made the front page (but that might have been during business hours here in europe).

malandrew 12y ago

I'm wondering if there is a meta-donation page that lists a bunch of the most important open source projects, how you can donate to them and their yearly funding goals (and how many developers are being supported).

takluyver 12y ago
That could be an interesting project for someone. I suspect the hardest bit would be how you determine which projects are most important or most deserving of donations. As soon as money is involved, people will try to game it and spam it.
- gglon 12y ago
  I think the simplest method would be to consider total amount of donated money.
  - takluyver 12y ago
    As in projects that are attracting lots of donations are probably important? Or as in projects that aren't getting many donations probably need more?
- logn 12y ago
  I think the package managers should add links to donate to projects. So I open up Synaptic to install GPG and in the description see that I can donate and they're only at 25% of their funding goal. Another key would be to add a real commercial justification to pay for projects instead of just donating. Often for tax and regulatory purposes businesses can't just spend money on fun, frivolous things unless they want to make a mess of their accounting. Maybe something like for each $50 you spend you get to ask one question on a mailing list or message board.
korethr 12y ago
Gratipay (gittip) comes to mind, but that's a donation mechanism, rather than the information collection you're describing. Sounds like a good idea for a project. IMO, the hardest part of that will be accurately prioritizing which projects are critical, very important, moderately important, etc.

drbawb 12y ago

>I think people would donate if they knew about it. Oh certainly, I use GPG on a daily basis, yet it never even occurred to me that such an ubiquitous project would have trouble gathering funds! I tossed in a donation as soon as I saw the link in the article. --- I remember jOOq (a Java SQL DSL) had similar troubles raising donations. They ended up moving to a commercial licensing model for 3.2+ that provides connectors for "enterprise" databases as well as professional support. Had I seen a banner asking for donations, I would've gladly donated what they're now charging for licenses. -- It is an excellent library. However I feel like the tooling does them a disservice. When the library can be added by tossing a few lines into `pom.xml` and having Maven fetch it, and the API can mostly be figured out w/ javadoc and your IDE's autocomplete: how many developers will even visit the project homepage and see a "We need funding!" banner?

alex_duf 12y ago
> When the library can be added by tossing a few lines into `pom.xml` and having Maven fetch it, and the API can mostly be figured out w/ javadoc and your IDE's autocomplete: how many developers will even visit the project homepage and see a "We need funding!" banner? That's a good point. Not sure how this can be technically addressed though

moron4hire 12y ago

This issue has been bugging me lately, given that I would like to start a product-oriented business, but I'm only one guy, who has to freelance to pay the bills. The problem, I think, lies in the lack of balance between different types of "users", their ability to absorb risk, and their ability to advertise. For an individual developer, new product development is a chicken-or-egg issue: you need money to live, but you can't make money off of an infant project. On the other hand, a corporation can siphon funds off of profitable projects into R&D, and the larger the company, the longer they can do it. There is a certain level of financial security that removes emotional burdens that can be real impediments to development progress. There is a singular focus that can be achieved by the developers in such a situation: one 100% focused developer is more than twice as productive as one 50% focused developer, all else being equal. It's also extremely difficult for an individual developer to get the word out on their project. But if Google even breaths a hint that they are doing something, a subreddit will be made for it overnight and TechCrunch will assign a team of reporters to cover breaking news. So from the start, the individual is behind the 8-ball in terms of being able to maintain a certain pace of development and gain mindshare for it. If you're entering an existing market, a lot of times the only way to gain traction for your project, to get any attention and get anything out of it, is to have to open source it just to meet other developer's expectations. But I suspect the vast majority of people who want "open source" really only want it as a security blanket and aren't actually going to look at it. I completely admit that I'm included in that group. For a corporation, what's the worst that can happen? In other words, who is going to fork their source? Another individual? They won't be able to keep up. Another corporation? They have to compete in both code and marketing, which isn't so attractive. It might be--all things considered--an equivalent effort to just start a competing product. Maybe even a little less effort, because you don't have to dance around collaboration and contribution issues. But for an individual, it's a significantly higher impact of a problem. If I make a tool, release it open source, and--say--Google decides that it's great and they want to use it, even if I license under the GPLv3, they can very easily strong-arm me out of the driver seat. They could be in complete compliance with the license and contribute all of their changes back, but their marketing machine could easily put themselves at the forefront of developers' minds as the source of that project. Is "closed now, open later" the solution? I don't know, that's always sounded to me like "closed now, closed later". See Android. What good is Android being open source if, by the time the source for the latest version is released, they've abandoned it for a new version? Correct me if I'm wrong. I'd like to be wrong, so I know in which direction to take my own business development. But it just seems like there are several types of power, and individual, independent developers have few that large corps do not, whereas large corps have several that indies do not.