I think it's fine when you are doing open source for fun, and for other individual users.
If a company is basing their livelihood on your library, they should (in my opinion) be supporting it somehow -- either by paying you, or paying someone to keep an eye on new versions.
The other choice is they are trusting you to fix bugs and not be malicious, which isn't (in my opinion) reasonable, as you get nothing in return.
Nobody has any right to expect labor from an unpaid person. I get feature requests from people who make money with my OSS work (which I don’t begrudge), but unless I find the work inherently interesting to prioritize then I respectfully ask them to compensate me, make a PR, or file a GitHub feature request so that someone else can. I fix legitimate bug reports for free ASAP because I care about the quality of my work. Nobody has ever offered my compensation, despite the fact that my work has been used by millions of people. That’s fine with me though, OSS is just a hobby for me. :)
Anyone can choose this strategy, and I don’t quite understand why more OSS maintainers don’t.
> Nobody has any right to expect labor from an unpaid person.
I'm very grateful for OSS projects and maintainers but this is an interesting question: is doing something for free a free pass for false promises (advertising)? If I commit to help someone for free I then have a responsibility to show up. If an OSS developer advertise their projects as production ready then they have a responsibility to honor what is promised. Otherwise it should be stated plainly that the project should not be used in production ("This is a hobby project, use it at your own risks"). Sure it's less attractive and can be incompatible with success and resume building, but it's not possible to have it both way.
Yes, it is possible to have it both ways. Your reliance on something isn't material when trying to get support from someone you're not paying. Full stop.
Maybe it's important to you and maybe people you support -- but that has nothing to do with your right to make demands against someone who put their work out there for free.
If you need a guaranteed support model, you either do it yourself or hire a company to provide that for you. I've used _supported_ commercial software that's garbage, and I've used FOSS software which has been absolutely rock solid. Also, commercial or not, just because it's supported doesn't mean the problem will be fixed or a feature added.
If you aren't directly paying someone to be there for you, then you're trusting goodwill and/or the community at large to fill that role for you. If you need that assurance, pony up to one of the consultancies like IBM which will support "X" for price "$Y". That support you're referring to is available, at a price -- but doesn't necessarily involve the original contributors.
I've had far better luck with FreeBSD on servers for the past 20 years than I have with Microsoft Windows, but I also understood the deal: "Fix it yourself, or submit a bug report and see if anyone else wants to work on it."
The corporate software method: "Pay us lots of money to look into the bug report, and maybe we'll fix it, maybe we won't -- but you'll need to pay hourly until we determine if its a bug. Then MAYBE we'll refund your money."
The primary difference is that OSS gives you the source and the ability to fix problems on your own, without any involvement from the original contributors/projects. You can also hire any number of other companies to provide support. With a traditional commercial model, you're entirely at the mercy of the company which originated the software, and you likely have no rights to the source or tools which would enable you to fix the problem yourself.
Sure I don’t disagree, I think I was too broad. I’m talking about only a subset of projects that are not just free work put out there, but actively promoted as some serious building block with a business agenda behind like personal brand building. There is OSS and OSS, I’m not talking about FreeBSD, Linux or PostgreSQL types, but projects that are part of a company marketing strategy or resume building and kind of white lie about their seriousness. My issue is with marketing, promises and expectations, and not OSS as it is to its roots. Edit: for a concrete example, I agree with you in the case of say curl, but not for React.
Also tangentially I don’t buy into the binary distinction “it’s free it can be poison I can’t complain / I paid it’s my right to be an entitled asshole”. The cost is irrelevant with the promise for me, the first cent doesn’t have magical entitlement, and its absence is not a free pass to (white) lie.
> Also tangentially I don’t buy into the binary distinction “it’s free it can be poison I can’t complain / I paid it’s my right to be an entitled asshole”. The cost is irrelevant with the promise for me, the first cent doesn’t have magical entitlement, and its absence is not a free pass to (white) lie.
There is no binary distinction and it isn't about the amount of money per se.
What you're missing is that full extent of what you can expect is spelled out in the license.
Whether it's an open source license or a commercial one, a common one or a custom one. If you don't prefer the terms of the default license, attempt to negotiate a different one. You can always negotiate. If you expect more, expect to pay more.
There is no clause in any license (that I've ever seen) that says if this project is more popular or shows up more often in search results then the license grants the recipients more support. That's not how it works. Read the license, that's what you get, nothing more.
… PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
I think it’s particularly clear, and that part is even in all capitals.
Sure, but it’s for legal responsibility. I’m talking about marketing, i.e. lies/false promises and/or error inducing landing pages regarding the reality of the project. It was not general point about all OSS projects, but to point a difference between projects that are part of a dishonest business strategy (company or personal) and “classic” OSS.
> is doing something for free a free pass for false promises (advertising)?
If you have a specific project in mind, have you read the license under which that project has been made available to you?
If it is under most of the common open source licenses, you will find that it already states very clearly what applicability and support you can expect (none).
You are free to pay for a support contract if you need anything beyond what the free license guarantees you.
The dead simple solution to this nobody is talking about is to fork it. If you want to ensure that some random stranger (our friendly FOSS maintainer) isn't going to sabotage your product, the only solution short of negotiating a support contract with them (which some FOSS developers are not amenable to) is to bring that software internal. You still benefit from FOSS because you get a huge head-start from all the up-front work, but software maintenance going forward should be the responsibility of the user of that software, not of some random stranger.
But commercially this is unpopular because it means that companies have to actually account for the cost of maintaining a complex software stack instead of pretending all the open source dependencies maintain themselves.
This is really the only correct solution. Either pay the maintainers to do the work (preferable) or in-house the work (second choice).
Long ago at Sun the practice was that all code had to have an internal team maintaining it. If the code was brought in from outside that's fine, but some team internally still had to be where the buck stops for fixes. If all bugs can be fixed by bringing in updated version from open source, that's great. But if not, there's still a customer with a bug and it must be fixed by the internal team if that's what it takes.
Of course, this wasn't too popular with some management, since they wanted to bring in all the free code but offload all the work to unpaid volunteers, instead of budgeting for maintenance.
management and investors, whose goals are clearly stated by their roles, have no trouble taking "shares" and then some.. while people who build things "craftspeople" are motivated in a plurality of ways, and have often and quickly been written out of the bargain by the aforementioned. In each extreme, the situation is obvious. Yet, whole portions of a "modern economy" are now built on this..
You both feel right to me. We've found a vast amount of really important& exciting technology come from unhindered & unencumbered open sourcerers, people enjoying buding great things.
And I agree with you, that these people as their software ascends in use & importance, need support.
The term professionalization is dangerous to apply here though. There's a lot of baggage & constraint, power/hieraechy dynamics, employer/employee relationships that are no fun, are against the spirit of the thing. To have this vibrant, radical, free spirited altermative, & to turn around & try to consume the spirit of the thing, digest it into the the dun, boring, mundane mediocre shit-show world is a sure & sad way to wreck the thing. Yet these people deserve & need support somehow. Finding innovative ways to support those doing vast social good without binding & restricting them, without entailing them into your projects & curtailing their potential.
That all said, at this point, we just need to start funding these people far far better, step 1. These concerns about whether professionalization see destroys our golden vibrancy are abstract when so few (& only such select industrially useful) projects garner any support at all.
I, and a number of other people that possibly includes you, like programming enough that we do it for free.
I don't like doing free tech support for entitled mean people on GitHub, which is what you're really asking about, but I'm perfectly happy to throw code over the fence for the general public to use if they don't bother me about it.
What happens if the log4j developers just... don't fix the bug? Other people who rely on the library fork it, development continues with more funding, the world keeps turning, and maybe a few tens of millions of dollars of additional economic damage are inflicted in a diffuse fashion across the global tech industry.
The thing is, if you aren't getting paid, people can demand all they want. Scream until their faces turn blue, stomp their feet, bawl like a baby, write mean things on twitter, stick a voodoo doll full of needles.
It isn't nice though, as the maintainer. I gave up on doing any kind of open source stuff probably a decade ago for way less than screaming. Just getting bug reports is depressing, it was a relief to walk away and never have to think about it again. I know I didn't owe people anything, but hearing that I'd written buggy incomplete code (which worked and was good enough for me) sucked the joy out of it all.
For me, getting bug reports and feature requests is actually fun and makes the project more interesting. It is telling me that someone uses my software seriously and the bug was worth reporting. Many people don't report bugs because it takes some effort.
It can be, yeah, it just ground me down in the end. Deciding to stop was a huge weight off, I can only imagine the stress someone running a big successful project must feel.
I’ve always found people are reasonably happy when I send them big reports — though I always either send a fix or, if I can’t figure it out on my own, a test program that demonstrates the problem.
The last time was for some random library I was writing a python wrapper for and the author seemed way too happy to be getting a bug report for the code he based his master’s thesis on. Pretty amusing to be perfectly honest.
Yes, I like working for free. I tried doing open source work for money but the only thing that happened was that I lost all motivation. It stopped being fun and became yet another job. And I make more than enough money from my main job.
In my opinion Filo is completely off base. It's the Americanization of Open Source. Notice some of the OSS conferences in the US are big sponsored events by O'reilly, to some extent big recruiting events.
Contrast that to FOSDEM, which is completely different. This isn't just an offspring of early hacker culture. This is as offspring of how "socialist" european university systems were.
A lot of bigger OSS projects were started during peoples university time and what's so fundamentally different between how universities in Europe were before? You didn't have care about graduating. Some people stayed in University for 10 years, it was free and sometimes even had some benefits, like cheaper healthcare.
Now studying forever subsidized isn't always a good thing, but it has some nice side effects, like being able to work on your side project without having to worry about your livelihood(something that is unthinkable in the US).
The European higher ed systems has gotten more and more close to the US system with the Bologna process[1].
Most Americans immediately think about how to monetize things, and don't get me wrong, being able to live off of your open source project is nice, but it wasn't the focus in the past.
It's not as if this was something that started elsewhere and is being adapted to the American value system: Free Software / Open Source started in the U.S.[1] That's largely due to the fact that for the first couple of decades of it's existence, Internet access[2] was heavily concentrated in the U.S. as it was originally a U.S. government funded project. There are a variety of factors that have changed the open source ecosystem, Americanization isn't one of them. Quite the opposite: if anything, Open Source has been globalizing over the past 25 years or so.
[1] Free Software originated with GNU which was started by Richard Stallman, an American at MIT. Open Source originated in Palo Alto, CA as an alternative (less political, more business friendly) approach to Free Software. There was freely available software prior to the formalization of terminology and licenses from organizations like FSF and OSI, but even then most of it was from developers in the U.S.
[2] Prior to the Internet, most open source projects were heavily concentrated in the U.S. as large scale distributed projects weren't a thing until the 90's with widespread availability of Internet access.
I was in the room with Richard Stallman, in Palo Alto, in the 1980s, as he gave a careful and serious presentation to about twenty chosen people.. from my point of view, the statement above does show one part of the OSS evolution. Meanwhile, the "net" was growing as a combination of ex-dot-mil and their allies, and people who were deeply committed to signals, evolution and in most cases math or physics training, for its own sake, and the social evolution it implied (science fiction readers and highly creative signal processors like musicians but different).
both sides of this odd couple had different motivations and restrictions, but they cooperated in building the network and the software that ran the network. People here have complained, but I claim, TCP/IP was not the only network game in town then, and the massive scaling that you see today was not done yet, and did not work for lots of reasons. Many OSS projects related to the network itself, the signals across the network, and math/science. The media world was largely influenced by commercial print and Hollywood, and was less influential in the early days, as they stuck to the commercial distribution mechanisms. Network media tended to be odd, music-oriented, or sick things, in those early days. Also note that single, massive source code repos were not a thing, so people traded "tarballs" with important releases of whatever.
Linux has been developed by paid professional developers for 20 years or more. I agree that the European university model is interesting for initial R&D, but things have to professionalize over time.
If you just want to share code, that's fine as well, but that's not an OSS project (sure, it can be an open source "project" - but not a project that grows)
The alternative is not the status quo. Look at all the talk of supply chain security from the big players. The alternative is that all power and profit is just moved to large institutional middlemen or directly to a few big companies who can afford such a program.
If you don't care about control over the downstream of your project, or funding, no one is forcing you to professionalize! I just want that to be available as an option to those who do.
I worry that if the majority of open source contributors professionalize, then we're left with something that resembles top-down directed corporate work (and an absence of a lot of the freedom that draws people towards developing free and open source software in the first place).
Proprietary and corporate players are equally useless at securing their supply chains; I don't love that (from my perspective) they're now blaming and trying to coerce open source to become more like them to ostensibly fix the same problems they propagate themselves.
I'm not a security nihilist: I think improvement is possible. But in my experience, not many corporate managers or project sponsors ask for removal of features and reduction of attack surface.
Anticipating a counter-argument: wouldn't individuals become the arbiters of the software functionality that is developed, if all open source software was based on a sponsor model? Isn't that more democratic?
Perhaps; some financial statistics that I'd suggest to consider would be:
- As of June 2018, U.S. households in the 0-40% income-level group had $0 median savings[1]
- From the same source: the median savings for a household in the U.S. is approximately $11k. There are approximately 120m households in the U.S. according to the U.S. Government census[2].
- As of 2022, thirteen firms from within the S&P 500 hold a combined $1 trillion in cash-on-reserve[3]
And yep, it'd be sensible to debate whether individuals or companies would be more likely to influence the direction of software; it's a disingenuous comparison to draw in that regard.
But even if we consider only individual citizens, there would still be significant disenfranchisement in dollar-voting ability.
* There are rough edges, but the basics are there: calling/SMS/4G/WiFi/audio/browsing/suspend.
* If you want to try it, put https://xnux.eu/p-boot-demo/ on an SD card and plug that into your PinePhone. That has a bunch of different distros and UIs on it.
Did they ever fix the modem disappearing on suspend? I have the latest kernel (as of a month ago) and a build of bitkorgii's modem firmware from last year but I still need to reboot the phone every time I pull it out to check my texts.
EDIT (I'm throttled and can't reply): I already have a script/service/runlevel that handles periodically waking the phone for notifications (I wrote it fall 2020 when I got mine.) I'm talking about the bug that causes the modem USB device to disappear and not get probed again after a random number of wakes from suspend. It's not an issue if you're only on WiFi and use VOIP but some people get annoyed that they can't call me while I'm driving.
Yes, it works, but I think the situation is fluid at the moment depending on distro, config, etcetera. Latest Sxmo on pmOS it works OOTB. You can find many other reports in the wild, for example https://www.reddit.com/r/pinephone/comments/rp3c14/deep_slee...
> https://hstspreload.org/ offers the same benefits. You are guaranteed to be connected to what you expect - or not at all.
TLS/HSTS is still subject to CA attacks, e.g. diginotar.
CA/X.509 is a complex stack too.
> TLS mitigates attacks that can be executed by malicious exit nodes (or WiFi networks, or ISPs), that is the whole purpose of TLS.
A malicious exit node could refuse to serve some websites. This seems a minor risk though.
Reducing load on exit nodes is a technical benefit that's in that blog post.
Another benefit to using Tor onion services for large sites is that the Tor circuit ID can be used as an additional key in an IP rate limit cache. This helps block Tor bots (on the basis that establishing a Tor circuit is expensive).
>TLS/HSTS is still subject to CA attacks, e.g. diginotar.
Largely solved by Certificate Transparency. If you compromise a CA, you can issue certificates. However, you can't issue new certificates without broadcasting that fact to the whole world as browsers will not accept certificates without SCTs.
>Reducing load on exit nodes is a technical benefit that's in that blog post.
This hasn't been a real benefit for years. Exit nodes are running at something like 10% capacity.
>Another benefit to using Tor onion services for large sites is that the Tor circuit ID can be used as an additional key in an IP rate limit cache. This helps block Tor bots (on the basis that establishing a Tor circuit is expensive).
This is just another problem with hidden services. Opening circuits costs malicious clients far less cpu time than it costs the server.
Do we? I do open source work and maintainership, and am happy that this is outside the control and influence of industry.
Must even this that "makes the Internet special" also bow to industry needs?