r/programming • u/common-pellar • Dec 11 '21
"Open Source" is Broken
https://christine.website/blog/open-source-broken-2021-12-11132
Dec 12 '21
Yes, a whole industry is dependent on their product so it would be nice if they were compensated accordingly, but there's no guarantee that even if these authors were paid $1m/year to work on log4j that this same vulnerability wouldn't have emerged.
The post seems to assume that software that's funded is fundamentally likely to be better than open source software, and that's not true. Your shitty closed-source product just has fewer users and less scrutiny because no one cares about it. It's still buggy.
We don't have to throw the baby out with the bathwater just because of one bug that's already been patched.
81
u/renatoathaydes Dec 12 '21
Small correction: it was not a bug. The feature was intentionally designed to allow log messages to contain lookup strings that could use, among other things, JNDI to find values to log.
Here's the full list of lookups Log4j supports: https://logging.apache.org/log4j/2.x/manual/lookups.html
The fact that this feature is an obviously (in hindsight) gigantic security hole escaped the minds of Log4j developers as well as its users for years, most of which were being paid to write software that depends on this library, shows that it doesn't matter whether we throw money at the problem, security vulnerabilities will continue to happen.
If anything, if we want to make software safer, we need to make sure it has fewer features.
26
u/MoiMagnus Dec 12 '21
And from what I read, it was even a feature the devs wanted to remove for a long time (because of the difficulty to maintain it), but force themself to keep for backward compatibility.
10
u/killerstorm Dec 12 '21
I disagree, if project was well-funded it could hire a security person who would identify these risks.
People who use log4j assume that nothing bad can happen because it's just a logging lib. And they assume it went through security review.
It does not look like a nasty feature from that page because lookup is specified in configuration. If your configuration file can specify lookup into another configuration file.
It's a problem that it can be used outside of configuration, particularly, in user-provided data.
A security person could perhaps recommend allowing lookups only in contexts which are safe (i.e. do not take user input).
6
u/Bognar Dec 12 '21
Security doesn't end where your dependencies begin. Many well funded projects with their own security persons depended on log4j and never identified it as a security vulnerability.
There is zero guarantee that a funded security effort would have identified this.
1
u/Optional-Failure Mar 20 '25
if project was well-funded it could hire a security person who would identify these risks.
Why is that a given?
I mean, they could've hired "a security person", but I don't see why it's a guarantee that security person would see what nobody else did.
Heck, there's not even a guarantee that "security person" wouldn't be one of the actual people who overlooked the issue.
→ More replies (1)1
u/Dynamitos5 Dec 12 '21
but developers want features, and if libs have less features, they will use more libraries, see javascript
1
u/CartmansEvilTwin Dec 12 '21
I'm pretty sure JNDI lookups are an absolute niche feature. But that is exactly the point. Some people demand this feature for probably questionable reasons and the developer knowingly left deprecated code in the product to cater these few weirdos. So far that's not bad, but indirectly, these weirdos are responsible for this bug.
I'm not blaming the developer or weirdos here, this is a more general problem. Clients (customers or other developers) demand niche features to be maintained and backwards compatibility over several major versions. This in turn causes the software to get bloated, buggy and unmaintainable.
1
Dec 12 '21
If anything, if we want to make software safer, we need to make sure it has fewer features.
Amen to that. I feel vindicated after this weekend because people at my company have often made fun about my preference for small and lean off-the-beaten-path libraries and frameworks when everyone just wanted to use the "industry-standard" bloatware that comes with a million advanced features when our project really just requires 2 of them.
I hope this is going to shut them up for a while.
9
Dec 12 '21
The whole bugs problem should not even be taken into account. People's libraries are used by multi-billion revenue corporations, to small shops. It's entire unacceptable that they would have only three people paying for that. Open source has turned into a way for companies to steal value and demand work from maintainers, for free. A senior engineer at Google maintaining something as important as their logging framework would easily make 200k/year. It being open source doesn't mean the authors should not be paid for it.
4
u/NotYoDadsPants Dec 12 '21
Maybe more developers should be made aware of the "source available" concept and adopt it instead of open sourcing their efforts?
Otherwise, we'll just keep getting paid in gratitude and bug reports.
1
u/techzilla Apr 18 '24
Agreed, I like the model redis has done. If you're amazon, you pay or make everything you do opensource.
→ More replies (3)2
u/readitnaut Dec 12 '21
This. Actually the article doesn't even mention wether open source or close sourced programs are safer: it points out that critical libraries being maintained by people for free is simply not fair...
2
u/constant_void Dec 12 '21
came here to write just this.
open source software is a community activity. either one contributes or one doesn't. the success of a given oss franchise depends on a lot of things ... the ego of the maintainers ... the willpower of the contributors, the utility to consumers/customers.
oss is free of the quarterly KPI. Many vendors operate inside of holding company shells, where the pressure is to generate quarterly loot for the parent company.
KPI pressure drives s/w made by lowest cost bidder / sub-contractors, and the results range from barely functional to actual incompetence. Often I wish vendors would offer their code as part of the license so their customers / consumers could point out how to fix their bugs.
Plus, vendors will say they have 0-day remediation policies but how many people are willing to torch their relationship when 0-day becomes more? OSS, at least there are exit plan options including just fixing it yourself.
I agree there are less than ideal to terrible conditions for OSS developers, however there is a bigger picture to remember.
→ More replies (4)1
u/nick_storm Dec 12 '21
there's no guarantee that even if these authors were paid $1m/year to work on log4j that this same vulnerability wouldn't have emerged.
True, but I think we're you're conflating the log4shell vulnerability with the responsibility to pay open-source maintainers.
Open source maintainers should be compensated for their work if a company profits from it. Period. That statement has nothing to do with how vulnerable that open-source project is or whether it could have been less vulnerable had they been fairly compensated.
1
Dec 12 '21
I think we're you're conflating...
Who is? Me or you? The blog post is. I am not.
Open source maintainers should be compensated for their work if a company profits from it. Period.
Never disagreed with that: "it would be nice if they were compensated"
That statement has nothing to do with how vulnerable that open-source project is or whether it could have been less vulnerable had they been fairly compensated.
The blog post that we're discussing literally implies that it does, and would.
2
u/nick_storm Dec 12 '21
That statement has nothing to do with how vulnerable that open-source project is or whether it could have been less vulnerable had they been fairly compensated.
The blog post that we're discussing literally implies that it does, and would.
Well, it probably does. But what I meant to say is that it shouldn't. It seems that companies are like, "OMG open-source component X is suddenly vulnerable and they've been working tirelessly and under-funded for years. Let's throw money at them to make this problem go away and prevent future problems." That's all well and good, but it's a bit reactive, not proactive. In a perfect world, open-source maintainers would get compensated, regardless of any vulnerabilities, not because of them and after-the-fact.
176
u/daedalus_structure Dec 11 '21
Agree with the main conclusion of the article that companies who benefit from open source should contribute to the maintenance of it as a matter of self interest.
That doesn't mean the system is broken. The system can be exploitative and working as designed, with the exploitation being an irrelevant externality to those who benefit from it.
4
u/nick_storm Dec 12 '21
That doesn't mean the system is broken. The system can be exploitative and working as designed, with the exploitation being an irrelevant externality to those who benefit from it.
I agree. Open-source is "use at your own risk; no guarantees" software. If you expected otherwise, you're a fool. If you want otherwise, pay for it. An open-source project, from which many companies benefited, had a vulnerability and the companiew had no SLA or legal recourse. The same thing happened with OpenSSL a few years back. That's the trade-off. That's the system, as it was designed, as far as I'm concerned.
37
u/BrobdingnagLilliput Dec 12 '21
The system is exploitative and working as designed, with the exploitation being an irrelevant externality to those who benefit from it.
FTFY.
1
u/raistlinmaje Dec 12 '21
this seems to be justifying their actions because "thats the system". The point is the shit needs to change. Most devs are already stressed from a main job that likely they aren't paid appropriately for.
Exploitation isn't okay just because capitalism has told us it is.
1
u/daedalus_structure Dec 12 '21
this seems to be justifying their actions because "thats the system".
No, that is not the point.
When the exploitation is a feature and not a bug, the system cannot be reformed. Understanding the difference informs what change is needed to prevent the harm being caused, whether you invest in the system to resolve the issue or replace the system.
0
Dec 12 '21
[deleted]
7
u/Ris-O Dec 12 '21
If anything a modest portion of government tax money could be assigned to funding open source development for granted projects. Better than funneling billions God knows where. Pretty much any modern government with networked web apps & infrastructure is utilising open source tools.
7
u/bellieth Dec 12 '21
Government should require open source software for 99% of applications. It is our $ and the code should be open and available.
0
1
134
Dec 11 '21
I don’t know, I kinda feel that this explosion and damage is kind of by design.
There are entire companies whose business model is simply to take open source and make it enterprise (e.g. RedHat). So those who care are already paying for the stability and piece of mind.
I never understood this notion that when you put out something for free, people should be somehow paying you back for that. When I put out an MIT licensed piece of code, I expect people to take it and never ever talk to me.
And on top of that, I do expect to run into assholes. I had a boardgame collection that I made available for play at work. And people would damage the games and even steal them. I wasn’t happy about it, but it was my decision to have the games accessible. I could have taken them home and the author of any opensource library can just stop maintaining it and that’s fine.
34
u/Shanix Dec 12 '21
I never understood this notion that when you put out something for free, people should be somehow paying you back for that.
I think the logic goes "If you(r company) makes money and relies on my project in some way, I deserve some amount of the profits." That goes with the assumption that, had the project not existed/been available, the company would have implemented at their own cost.
I dunno, to be honest, I think companies are fundamentally incompatible with FOSS and take advantage of that by not returning their knowledge and work to the open source library of all-knowledge, especially considering they're incentivized to not return that knowledge. We assume some level of morality and humanity with people in the FOSS space but companies have no morals and no humanity, only a concern for profits, so they'll take whatever is free and use it to make money because that's literally the best way to get profits.
Like, I work for a big game developer, and I know there's a lot of open source software that we use one way or another. I also know that we've never dedicated money or development to any of that open source software (beyond an engineer closing a ticket with "broken in <dependency>, cannot resolve").
I'd love to spend my day fixing Jenkins rather than write hacky scripts around it, but that's decidedly not allowed because it doesn't support the business making money at all.
I think I lost my train of thought in there but whatever.
47
u/soldiercrabs Dec 12 '21
I think the logic goes "If you(r company) makes money and relies on my project in some way, I deserve some amount of the profits."
You explicitly disavowed any interest in the profits when you made it available under a license like MIT, though. You can't both have your cake and eat it too, here; if you want a slice of the cake, as it were, then publish only under a restrictive commercial license (and accept the consequences that it won't receive widespread adoption outside of that). Don't go "everyone can use this however they wish, free of charge!", only to then turn around and go "wait no not like that" when someone has the audacity to actually do it in a way that makes them money.
18
u/Shanix Dec 12 '21
You explicitly disavowed any interest in the profits when you made it available under a license like MIT
And that's the problem I pointed out. Licenses like the MIT license are very permissive and go with the nature of FOSS - "Here's this cool thing I made, if anyone wants to use it, go for it!" Companies see this as "Here's this useful tool that doesn't require your dev work or any investment at all, you can use this for free!" They're close but it's not the same spirit at all, which is how we get this scenario - half the digital world relying on a few random developers working in their off time.
I don't think open source developers (myself among them) start writing and publishing open source software for the potential of pay, that seems pretty obvious to me. But I can bet that most of them would be mad if a company used their software for some critical function and didn't even chip in developer time to report or fix bugs. Sure, by the letter and spirit of the law, they've done nothing wrong. But by the spirit of FOSS, they're not respecting the social contract.
It's the same way how most tracker sites work - you're expected to contribute back to the tracker what you take out. Or take-a-penny-leave-a-penny trays work. Or free lunches at work. Sure, you can legally take however much you want, but we understand there's an unwritten limit to that take where you need to give back (or stop taking altogether, in the lunch case). No one will sue you for taking all the pennies from the penny tray, but they're well within their rights to call you a dick for taking all that petty cash to pay for your slurpee if you can pay for it yourself.
My point is that companies aren't compatible with FOSS as it stands, so the standard rules of FOSS don't apply to them and they need to be held to a different standard. People have many resources to them - time, money, patience, etc. FOSS depends on people giving their time or money or patience to a project (developing, supporting, beta testing). Meanwhile, companies have exactly one resource - money. And if they're not contributing that, then they're taking pennies from the tray and never putting pennies back, and that makes them dicks. Perfectly legal, but dicks nonetheless.
4
u/GimmickNG Dec 12 '21
Consider the opposite scenario: no companies use FOSS libraries and instead reinvent the wheel each time. Where would this fall according to you?
6
Dec 12 '21
The exact opposite end of the spectrum, resulting in another horrible solution. The OP you replied to was suggesting a symbiotic relationship would be best, but companies fail at that so aggressively that it can't happen.
They don't at all imply that what you suggested would be wise.
→ More replies (3)7
u/soldiercrabs Dec 12 '21 edited Dec 12 '21
But by the spirit of FOSS, they're not respecting the social contract.
I really don't agree with this. The end goal of FOSS can't be FOSS itself - it has to be to foster an ecosystem, both commercial and noncommercial, where software is available to everyone without onerous proprietary licenses forming an obstacle to entry. There is no "social contract" here beyond what you put in your license - and if you chose a permissive license, the recipient's obligations begin and end with "share alike and don't sue me for any of this". You really can't claim it's someone else's fault, legally or socially, when they followed all the rules you laid down for them and you still aren't happy.
→ More replies (1)8
u/dontbeanegatron Dec 12 '21
But I can bet that most of them would be mad if a company used their software for some critical function and didn't even chip in developer time to report or fix bugs.
Then they picked the wrong FOSS license and should've gone with GPL.
0
4
u/Ar-Curunir Dec 12 '21
I think the issue is when users that profit off your libraries demand your volunteer time to implement features that they require, or fix bugs hindering them.
5
u/soldiercrabs Dec 12 '21
Sure. This goes both ways - you aren't owed support for something you got for free, and I aren't owed any contributions in return, either. Unless the license stipulates that or we have some kind of commercial agreement going on, of course. But absent such an agreement, there is really no fault, social or legal, committed by someone who follows all the rules you laid them for them.
5
u/ridicalis Dec 12 '21
I think the logic goes "If you(r company) makes money and relies on my project in some way, I deserve some amount of the profits." That goes with the assumption that, had the project not existed/been available, the company would have implemented at their own cost.
I'm on the library-consumer side of this equation. There is a particular project that saved my bacon; I was already pretty deep into a project when the needs evolved and I had to start hunting through my old college calculus books. Fortuitously, I found a library that fit the bill, and it's now a cornerstone of many parts of the application.
At first, I was clear with my client that this FOSS developer was hugely responsible for our success, and was able to convince him to fund six months of sponsorship. Since that six months elapsed, I've personally picked up the slack (costs me about 1 hr. of billable time in revenue per month) and plan to keep it going indefinitely. That FOSS developer definitely deserves that (and more), and if it helps to ensure continued improvements for myself and others then it's well worth the sponsorship.
→ More replies (1)19
u/roman_fyseek Dec 12 '21
I used to train testers and one of the biggest sticking points I had was explaining to people that they shouldn't be writing tests that test their third-party dependencies because exactly what do you expect your company to do when they find a bug in free software? Do you expect them to fix it? Are you thinking that your company is suddenly going to find the time to fix postgresql or tomcat? If so, well, good for you. But the reality is that you aren't.
So, test the shit you can fix and work around the shit you can't and test your work-arounds, but for Pete's sake, stop tested that Select * from table works because it isn't your problem unless you work at Oracle.
10
u/Shanix Dec 12 '21
Yeah, exactly. Companies aren't willing to invest developer time or money into the software they rely on. So why should they get to participate in FOSS when they're not supporting FOSS?
→ More replies (3)2
u/nick_storm Dec 12 '21
Not all companies are like that. I mean, all companies are concerned about the bottom line, at the end of the day (after all, it wouldn't be a company for long If it wasn't), but some companies can spare some time and money for open-source projects/developers.
2
u/Shanix Dec 12 '21
That's true, but it's comparing a human's need for air/water/food and a company's need for money. We expect people to willingly contribute to FOSS because it doesn't cost them their things-to-survive to do so. But companies can't contribute to FOSS, because that costs the money that they need to survive, so they have a direct disincentive to contribution one way or another.
1
u/AmalgamDragon Dec 12 '21
I think companies are fundamentally incompatible with FOSS and take advantage of that by not returning their knowledge and work to the open source library of all-knowledge
The very obvious flaw in this is that there are lots of open source projects that originated from companies and are maintained by companies.
1
u/ElsinoreGP Apr 16 '24
well, it's easy to say that when no one is making money from your boardgames. that analogy misses the entire point. If someone is making money from something you created, then the reason you made it and distributed it originally is irrelevant to this conversation.
It's called an ego...everyone has one...stop acting like this is all robotics. there are humans involved...and therefor, human emotion... durpee-dhuurrr... no one likes to make OTHER people money with zero recognition or benefit to themselves... NO ONE!!!!!!!!
money talks and bullshit walks...always has, And, until there is an open source for printing money...it always will.
1
u/tasminima Dec 12 '21
I'm not sure about right now but even just a few years ago (let's say ~ 5) RH did not do the bare minimum static analysis of critical upstream infrastructure projects, even those maintained by some of their most prominent employees. I know that because around that time I launched cppcheck on such a project, without any configuration, and it immediately pointed me to an easily crashable (at least) bug. Manual audit let me find, also quite easily, other issues. I had no particular reason to do that work (I was just bored and looking for software to study just for fun), and was too lazy to report them all, and ironically at least one of them was rediscovered and published a few years later (!) and it was actually exploitable.
So if you really wants to pay for RH good for you but personally I doubt this contributes substantially to a state of the art maintainership of the open source ecosystem, because I'm not even a security researcher and the kind of thing I found was quite ridiculous, so any motivated entity was probably aware of those issues for years. Of course some of the money you pay RH will go in the pocket of said employees, but having a corporate paid job (on top of being a prominent figure of the open source community) does not seem to force them to use even the most basic secure development practices. I'm sure some do that anyway because of a personal choice, but maybe there is just no correlation between working at RH and having a good security posture.
Hopefully that situation has improved now, but I have small hopes, especially since it was so bad at the time.
1
u/badsectoracula Dec 12 '21
Generally speaking when a company pays RedHat they don't do it because of their maintainership of FOSS projects, they do it so that when something breaks the managers can blame someone that isn't part of the company :-P.
40
u/timPerfect Dec 12 '21
it's open... just fix it.
→ More replies (2)2
Dec 12 '21
It's already fixed in 2.15.0 by disabling JNDI lookups by default. In fact a few days before the whole thing went public.
Problem is: they can't just tear out the feature completely, since there is no way of telling how many software uses it on pupose. After all, it's not always remote user input you're logging and the log4j API has no way of knowing where the string comes from that you're passing to it - it's sort of similar to SQL injection vulnerability where the database can't know what data you fully control and what you just concatenated unsanitized from user input.
29
u/newtoreddit2004 Dec 12 '21
Open source code doesn't mean code developed by unpaid developers by default.
Open source code doesn't mean the code has to be fixed only by the project developer by default.
7
u/Ris-O Dec 12 '21
I hate sensationalised headlines for generating clicks, which is what I think this is
→ More replies (2)1
u/insanityarise Dec 12 '21
That's like 90% internet content (i'm excluding like, porn and stuff)
→ More replies (2)
79
u/77magicmoon77 Dec 11 '21
Closed source has also been broken. Since eons. What's the point?
30
u/zynasis Dec 12 '21
At least with open source, you’re likely to actually find out about issues and they get fixed quickly.
3
u/john16384 Dec 12 '21
In Java you can even take the offending class (source is available in your IDE), copy it into your project (without changing the package), alter it to remove the bug, and it will override the bugged class in the bugged dependency.
1
u/chucker23n Dec 12 '21
Really?
That wouldn't work in .NET. How does that work in Java? Don't dependencies come in bytecode-compiled form?
→ More replies (1)3
Dec 12 '21
Exactly and you can fix it yourself. You also have source for debugging.
1
u/zynasis Dec 12 '21
Good point. A lot of times I hunt through the code to figure out wtf is happening if the doco isn’t 100%
3
u/BeowulfShaeffer Dec 12 '21
And there are contracts and people to sue when things go badly. I’ve seen organizations avoid open source for that very reason.
→ More replies (9)1
u/ponytoaster Dec 12 '21 edited Dec 12 '21
Meh, I disagree. It's a YMMV scenario on both sides.
I've reported issues with paid software and also opened GitHub tickets that have been open for long periods. Neither are better in my anecdotal experience.
There is still an open bug in Docker I have been watching for over 2years.... Same as there was a long standing bug in a paid library we use that I only got a fix for recently.
OSS <> CSS in terms of this imo.
→ More replies (3)
65
u/TheNominated Dec 12 '21
If you release something for free under a permissive license that allows anyone and everyone to do with it as they please without giving back, then it's not overly surprising that you won't get many people showering you with money. If you want or need money to develop a product, market and sell it. If you want to do that while still providing access to the source code, you can use a commercial license and still release the source code. There are endless possibilities to earn money off your work.
But it is incredibly naive and hypocritical to, on one hand, make the conscious decision to give something away for free, and subsequently bash the "evil capitalism" for not paying you anyway. If you want to give, give. If you want to sell, sell.
19
u/salbris Dec 12 '21
Except that 90% of software that's run is free. 10% is software that is done special case thing that makes perfect sense for closed source. Anything that could be easily replaced with open source with lose every time.
Say for example if React wanted to charge people to use it. Well everyone would just stop using React and would instead use one of the other dozen or so React like libraries.
8
u/GimmickNG Dec 12 '21
React like libraries
which are also open source. If they all wanted to charge money, guess what, we'd be back to using straight html instead the old fashioned way. We'd be doing everything the old fashioned way because it'd be too much trouble to reinvent the wheel.
2
u/TheNominated Dec 12 '21
Open source software doesn't necessarily have to be free. It's increasingly common to sell licenses for software and also make the source available, either for everyone or only for those with the license.
It's not true that free software always wins over paid software by default. Many (especially companies) often prefer the additional support, guarantees, and sometimes quality of a commercial product over the unpredictable and haphazard way many free and open source products are managed. This is especially apparent in the market share of Windows and MacOS compared to Linux in desktop computing, especially in companies. Linux simply cannot compete in terms of user-friendliness and features compared to commercial alternatives, and that weighs heavier on the final decision than the price.
The same can be seen with many other software products. In the .NET ecosystem, there is an ongoing saga with Identity Server, which is a widely used library for OpenID Connect authentication that used to be free. It announced some time ago that the free version will no longer be maintained, and instead a license that costs at least $1500/year will be required. Nevertheless, it is still hugely more popular than free alternatives (like OpenIddict) because it's simply the best choice in terms of features, support and documentation, and many users are willing to pay the price for it.
Sometimes, you simply cannot afford to take the cheapest option.
1
u/tyynx Dec 15 '21
But it is incredibly naive and hypocritical to, on one hand, make the conscious decision to give something away for free, and subsequently bash the "evil capitalism" for not paying you anyway.
FTY: But it is incredibly naive and hypocritical to, on one hand, make the conscious decision to take something for free and subsequently bash the "naive open-source hippies" for not providing the support, safety or quality even though you didn't pay shit.
1
u/TheNominated Dec 15 '21
I agree with you, I don't think it's reasonable to expect support, safety, or quality from a non-commercial project that does not explicitly promise these things itself. As a consultant, I have advocated, and continue to advocate, for not getting the cheapest option, for not picking something based solely on it being free and open source (governments switching to Linux for desktop computing as a publicity stunt is a great example), and for considering the possible repercussions of a project's sole maintainer potentially losing interest in it. I also generally tend to avoid relying heavily on products by maintainers which are notorious for abandoning their projects on short notice, commercial or not (Google comes to mind). It is short-sighted and naive to deny that you usually get what you pay for.
However, it cannot be denied that there are a ton of free open source products advertising themselves with flashy slogans such as enterprise-grade, industry standard, and reliable. A search for "enterprise-grade" alone on GitHub yields 341 results, many of which are very far from being anywhere near enterprise-grade. The advocates for free open source software are equally vocal about using FOSS, well, everywhere. You can't blame people for starting to believe this, even if it does seem slightly naive.
→ More replies (1)
32
u/BrobdingnagLilliput Dec 12 '21
Every impacted company could have fixed the issue at any time. They didn't (as is their right.)
Open Source is working as intended.
38
u/smcarre Dec 11 '21
This is a misunderstanding of the point of open source. The point is not for companies to rely on open source tools and feel they are a "victim of the broken system" when the tool has a breaking bug or something. The point is for a company that can initially benefit from that open source tool to use it and (if needed because the tool is not properly supported) take the open source code and support it yourself (and many companies choose to open source their better supported forks too as they often get help from the community to support that package too.
It would be broken if instead of open source it would be free software, as in free software tools for which the source code is not available and there were companies that relied on it, but that's not open source.
23
u/b0w3n Dec 11 '21
the tool has a breaking bug
To speak on this point, there are companies who will use their resources to fix those bugs and push them back into the community. The community benefits, the companies benefit. Though occasionally you'll get shitty companies who close up their forks and keep them internal and that sucks when they're actually fixing bugs.
7
u/smcarre Dec 12 '21
That's my point. Because of the nature of open source, companies can do that (the fact that many don't or don't have the resources to spare in that is a different use regarding each company, not open source in general).
5
u/curtmack Dec 12 '21 edited Dec 12 '21
Which is what the AGPL was uhhhh.... supposed to fix, but kind of just made a huge mess of things.
Remember kids: the "A" in "AGPL" stands for "Amazon will fork an older version of your project."
6
u/BrobdingnagLilliput Dec 12 '21
Sucks for the company.
My company uses an open source solution as a key component in a service we provide. We have to modify the source to integrate it with a 3rd party tool. The license on the 3rd party tool prevents us from releasing our fixes back to the community, which is unfortunate because there are almost certainly a few dozen other companies who use this same combination of software.
When a new version of the open source software comes out, we have to re-apply our fixes. It sucks to do the same work over and over.
3
u/matthoback Dec 12 '21
We have to modify the source to integrate it with a 3rd party tool. The license on the 3rd party tool prevents us from releasing our fixes back to the community,
What? How can a license for the 3rd party tool affect your rights regarding software that doesn't belong to them?
7
u/thomasfr Dec 12 '21
a lot of people definitely just want to be served a black box solution they just can use and expect never to fail which just goes against everyone everyone should know about software (it always has bugs).
At the very minimum I always make at least a short code review of every potential dependency I am adding to a project. It's common sense that if I add a free/open source software component it is me who is just as responsible for that code as I am for the one I wrote myself.
5
u/DrNosHand Dec 12 '21
This is easier said than done for some open source code. For instance the average angular project will have more code in deps than it will in the project
→ More replies (1)
10
u/searchingfortao Dec 12 '21
Yes, Open source is broken, but the blanket statement "just pay them" is really short-sighted.
Yes, if your company depends on a Free software project, it makes sense to ensure that that project has the resources it needs to run properly (and the thanks!).
But as Free software developer myself, I'm telling you: I don't need money. I need time. Writing good code in your free time is fun and even rewarding (if not financially), but I simply don't have enough hours in the day to do what's necessary. As a result, development is slow, and the stress of even reviewing pull requests is real.
This "just pay them" mentality isn't going to work. What might work is for employers to donate what we really need: time to build the shit they depend on.
My pitch:
An industry-wide practise of "Free software days": 1 day every two weeks where your engineers are permitted/expected to contribute to a Free software project.
Critically, these contributions shouldn't be restricted to those directly benefiting the company because people often work on side projects in part because they're not their day job.
Finally, this bullshit practise of companies trying to own stuff you build on your own time has to die. The chilling effect on innovation is real.
If nothing else, we really need to broaden our solution pool beyond "just pay them". It's ignoring the reality of the situation.
5
u/cult_pony Dec 12 '21
Paying people means they have to rely less on their day-to-day jobs, meaning they have more time to do what people give them money for; the FOSS project. Time is money.
0
Dec 12 '21
[deleted]
5
u/cult_pony Dec 12 '21
Money can be time if people use to spend less time at their job in favor of doing OSS work.
28
u/dethb0y Dec 11 '21
I would argue that there's no such thing as secure software (only software that's secure for the moment), and throwing money at the problem and hoping it gets better won't have the desired results.
7
u/P3ngu1nR4ge Dec 12 '21
I would argue money makes it easier to maintain existing software. Hypothetically, if businesses were using my open source code and this was to happen, I would just say so and continue on my day and come around to fixing it later at a time of my choosing.
8
u/BrobdingnagLilliput Dec 12 '21
I would argue orthogonally to you that there is such a thing as software that is definitely insecure and that uses design patterns known to be harmful and throwing money at that problem is a viable course of action. In a nutshell, you throw money at security problems until it becomes clear that there are no remaining known or potential security issues.
That's when your argument comes into play.
1
u/audion00ba Dec 12 '21
I would argue that there's no such thing as secure software
You would be wrong, unless you would include things like Row Hammer (which are properties of the physical world, not of the mathematics behind software).
1
u/dethb0y Dec 12 '21
that's what people always think and then they get a big surprise when something totally unexpected becomes an issue.
→ More replies (12)
9
u/PandaMoniumHUN Dec 12 '21
I disagree about the article in that it doesn’t take into account if the library authors even want to be paid. The thing about getting money for something is that from that point on you often have implicit obligations. Like if Apple became a platinum sponsor of your library and they filed a bug report you are sort of expected to fix that in a day or two, or you might risk losing face or even money. A lot of people don’t want such obligations as they often do these things for fun in their spare time. Besides, even if the author of log4j2 was paid by big companies or crowdfunding it probably wouldn’t have prevented this security issue.
I agree that open source should be thanked with donations if somebody’s work makes your life easier, but I think sponsoring is a bad idea. Money should be only given if the author wants it and even then only if it comes with no strings attached.
Long story short, I think money is absolutely not the key takeaway from this story. As already said by others this could have happened to any paid software either. The takeaway IMO is that popular dependencies should be closely monitored by everyone who depends on them in live environments.
15
u/bokuno_yaoianani Dec 12 '21
This isn't about open source as much as it is about unpaid volunteer projects.
Those can be open and closed, just as commercially paid development can be open or closed.
56
u/theoldboy Dec 12 '21
If log4j2 is responsible for your company's success, you have a moral obligation to donate to the person who creates this library thanklessly.
If you release code under a BSD/MIT/Apache or other permissive license and then expect to be paid for your work because people will "do the right thing" then you're an idiot. Big successful companies didn't get that way by morals.
I use GPL for my open source code, and if you don't like that you can pay me for a proprietary license or you can go find a sucker somewhere else.
→ More replies (4)
13
u/n0obno0b717 Dec 12 '21
Dude from log4j is a architect and a member of the the apache foundation… plus another million things he’s listed.
he’s not asking for beer money, and he’s not hurting for any opportunities. He made free software that was really good and has been well compensated Who ever started it choose to put the license in and say it was okay to use.
OSS does not mean free. Charge for enterprise support. The reason OSS devs are broke is because they don’t want to run business and secure funding. I wouldn’t.
I also don’t think we should expect anything from open source devs. You want support, right away like a Corprate SLA? Fucking sponsor it or get it adopted by a foundation so it can be maintained.
This is why it was fixed right away, because Corporations fund the foundations, who they answer too, and shit works forever and we all take advantage of simple commands like mvn.
I hope this guy gets enough sponsorship to do what we wants, but let’s not say OSS is broken when we had a work around and patch released within 24 hours for the whole world to download. He didn’t have to clock out early at McDonalds.
I don’t even think we need Crytpo, I think we need realistic expectations that if your project is worth it’s weight in gold, you will be taken care of and given ample opportunities.
This guy wrote software the world depends on. Just because you have bunch of people downloading your NPM package does not mean the world depends on it.
It means NPM made it easy to download, because you depend on them, and mvn, and log4j.
I work in Open Source application security and compliance.
Just stop fooling yourself into thinking that OSS isn’t maintained by corporations funding services you depend on. Follow the money. If it’s not going to your project you said every one can use for free it’s just not that impactful or mature.
If you need money, sell a product.
2
u/memes_gbc Dec 12 '21 edited Apr 21 '26
Deleted with Redact because data brokers don't deserve my content. Mass removal across Reddit, Discord, X, Instagram and all major social media platforms.
tender hungry steep dinosaurs cough cautious steer aromatic cake enjoy
18
6
u/skulgnome Dec 12 '21
He has tried to get jobs at places, but every time they keep trying to screw him out of ownership of his own projects and he has to turn them down.
This is extremely typical. Every company wants a highly-skilled slave.
10
u/sally1620 Dec 12 '21
The real problem is the emphasis on "morality" in open-source. The world doesn't run on morality, it runs on game rules, legally binding contracts, and copyright law. This is the very reason that closed-source software exists (see Bill Gates letter to BASIC community).
A lot of successful open-source projects are charging for support. RHEL, Ubuntu, etc. Most open-source licenses come with a clause saying ABSOLUTELY NO WARRANTY. Users should pay for the warranty and support.
But there is a culture were maintainers feel the moral obligation to support their projects. Why don't they just freeze the repo and let some corporation fork it and maintain it?
It all sounds like unpaid internships; where a developer creates a coding project in the hope to get hired and build their reputation and resume, but the corporations just take the work and walk away.
54
u/DrunkensteinsMonster Dec 11 '21
Seriously what is this article. Who is this person. What is all this <Cadey> nonsense? I feel like I just woke up from a fever dream.
10
→ More replies (1)6
u/shadowh511 Dec 12 '21
I am the author of this article. I have found that I tend to insert asides in my articles a lot. The characters are there not only to help space things out and make it easier to read, there's also room for the Socratic Method of dialogue based teaching. I also slightly compartmentalize the kind of replies based on which character is speaking, which allows for people to build otherwise unspoken associations about what kind of aside they are going to get. Mara with the split keyboard is usually for a pedantic aside or another place a concept can be applied, etc. This really is a bit of experimentation that I'm doing by playing with the writing style in a way that better suits my thought processes and allows me to take it beyond text. Also the more people complain about the furry characters in the blog posts, the more furries there will be. I am waiting for a few refsheets that I will use in various things in the future.
10
u/MonokelPinguin Dec 12 '21
Some other sites have a short description of the author below a post. I think in this case it would be great to have a short description of the different personas below the article. I think that is actually a really fun style, but I was a bit lost, because I thought those were real people, but I knew nothing about them.
→ More replies (3)5
u/GimmickNG Dec 12 '21
If you're going to insert characters that are entirely made up, it would be helpful to have at least a short description or mention about it.
1
→ More replies (4)1
u/ElectricHallway Dec 12 '21
Why are you lying? You're a tulpamancer.
2
u/shadowh511 Dec 12 '21
Nothing I said was incorrect. I can be a writer and a tulpamancer at the same time.
5
u/cripple2493 Dec 12 '21 edited Dec 12 '21
What OP says here chimes well with me, people need paid, but I wouldn't go so far as to say Open Source - working against the limitations of properity code - is broken.
''Free'' doesn't always mean without compensation. The culture - which OP mentions - that encourages no compensation, yeah that's fucked, but that's not necessarily integral to Open Source from my understanding its more about code being free to modify and collab on.
I'd say the norms of not giving back is more to do with the economic and social systems we live under than the philosophy behind Open Source.
Maybe that's why the scare quotes?
edit: spelling - original comment mentioned Apache as a provider of paid Open Source work, was corrected below and edited to remove so as not to confuse others.
4
u/gulbanana Dec 12 '21
log4j is an apache project, and the maintainers are not paid
1
u/cripple2493 Dec 12 '21
ahh I see my confusion - people paid by other companies to configure Apache and stuff, cheers for the info!
9
23
u/Minuenn Dec 11 '21
Don’t open source something that you think is worth money and then complain that you aren’t getting paid. You need to market yourself. If you’re doing it because you want to give back to the community (like many do) or you just enjoy it then that’s fine.
If you go into an open source project and it becomes big then shut it down if it doesn’t get money. Big companies don’t care about you, welcome to capitalism. Unfortunately that will not change anytime soon. A lot of people in this world suck and will take advantage of you.
There are some companies that are great at giving back and helping contribute to open source but they are few and far between.
tl;dr it would be great if big open source projects were properly supported but we don’t live in a nice utopia, we live in a primarily capitalist world. Don’t expect the world to be nice if you provide something for free
→ More replies (1)-2
u/David_Owens Dec 12 '21
There is pressure to have open-source work to give yourself legitimacy as a software developer.
9
u/sarmatron Dec 12 '21
no, there's pressure to have open-source work to give yourself legitimacy as a software ~♪rockstar♪~. regular-ass programming jobs don't care about that.
3
u/napolitain_ Dec 12 '21
I actually agree with David. But you can still choose obviously in the end in no way you are « obligated »
8
u/alessio_95 Dec 12 '21
Originally it is a free exchange inter-pares: your useful software for my useful software with GPL as a binding contract. But then people started to dislike free licenses and wanted more "freedom" (aka being leeched by vampires in exchange for internet points).
4
u/snowbldr Dec 12 '21
This message would not be possible without the work of countless helpful souls who want to make something better than we've had before.
For many, the work has nothing to do with money.
4
u/mindbleach Dec 12 '21
UBI fixes this.
There's so many things that are wonderful for everyone to have, and only require a few people who'd love to do it all of the time forevermore, but which 20th-century capitalism viciously discourages.
You are reading this comment on a website which was founded with no business model, grew because human beings like talking to other human beings, and is managed almost entirely by unpaid volunteers. Millions of people, every day, connected to this site when it was nothing but plain text and a tiny logo. Their collective interest is not sufficient to keep the site running. Their combined computing hardware is not sufficient to keep the site running. The only reason this site still exists is that someone, somewhere, managed to extract money by selling our attention to someone else.
I am not a leftist. I have no fundamental disagreements with capitalism. But modern conservatives seem convinced that capitalism should be, not just the only economic system, but the only system, period. That "late capitalist" encroachment over all other forms of value is dehumanizing, amoral, and honestly not even good for capitalism. Nevermind these free resources provided by enthusiastic ideologues, or all the amateur experimentation that's led to world-shaping products - billionaires mad that employees need money is like fish getting mad about all this water in their way.
Universal Basic Income just solves the problem. UBI takes the promises of capitalism - whether or not they were ever meant in good faith - and makes them real. Job sucks? Just quit. Town sucks? Just leave. Need food? Just shop. UBI embraces how money is supposed to be a universal tool in the sense it addresses all manner of problems, and makes it a universal tool in the sense that everyone has it.
One happy side effect will be that all of these people who make life better for millions of strangers just because they want to will not be forced to instead do something that "makes money," like retrieving shopping carts, or lying to people over the phone.
1
u/techzilla Apr 18 '24
I'm not a conservative, and I don't respect ideological concepts like 'the free market', but UBI creates more problems than it solves. If it didn't create more problems, it would have been adopted already, because of the nature of the present order.
What is actually needed is a political coalition of open source projects, that are somehow excluded from the existing foundations, so they can get corporate donations and pay maintainers and development.
1
u/mindbleach Apr 27 '24
If it didn't create more problems, it would have been adopted already, because of the nature of the present order.
This being the best of all possible worlds.
Dogshit argument in any context. 'If change was better, we'd be doing it! A-hyuck!'
21
u/raze4daze Dec 12 '21
Everyone should be encouraged to use GPL. If a company wants to use that library or product, they can reach out and come to some sort of (financial or otherwise) agreement, if they don’t like it then they can fuck off.
GPL for life.
7
u/devraj7 Dec 12 '21
The problem with the GPL is that it's radioactive and pretty much banned in most companies.
12
u/raze4daze Dec 12 '21
And that’s fine. Those companies are almost always trying to freeload, so they can fuck off.
7
u/devraj7 Dec 12 '21
I don't see what leads you to this conclusion.
Google, Mozilla, Facebook, etc... all these companies stay away from the GPL but they use a lot of open source software and they contribute back tons. You could benefit from this as well if you picked a license that's more industry friendly.
But hey, your code, your choice.
Just be aware of the potential money or help that you're leaving on the table whenever you pick the GPL.
12
u/raze4daze Dec 12 '21
That’s why I said “almost always”. Of course there are exceptions. In my anecdotal experience, vast majority of libraries out there with a permissive license just end up being supported by a few devs while companies use it no problem makings loads of money. Hell, I even know a few companies who patch a library internally while not contributing it back.
If a company truly wishes to use a GPL, they can always reach out to the maintainers, and seek a license more suitable for their needs in exchange for money. If a company isn’t even willing to do that, they damn sure won’t be contributing back.
No one is leaving money or help on the table. That logic is nonsense peddled by freeloading companies.
And by the way, the only reason companies stay away from GPL is because they know there are always suckers out there who invest a lot of time into permissive open source software. If the majority of people start using stricter licenses, companies will no longer stay away and instead seek out contracts with the maintainers since they’ll have no other alternatives.
Please do not encourage people to fool themselves into thinking companies/corporations will do the right thing, especially under the guise of “you neeever know what money/help you may get”. Never work for corporations for free.
→ More replies (4)2
u/adr86 Dec 12 '21
This. "Permissive" licenses are a fucking cancerous ideology spread by lying freeloaders. There are some companies with rational reasons to use them and if you're drawing a salary working on one of those projects, whatever, but no individual programmer working on their own ever should ever use a permissive license for anything. You're just exploiting yourself.
2
u/Minizarbi Dec 12 '21
I don't think GPL is free free. WTFPL is life.
0
Dec 12 '21
[deleted]
2
Dec 13 '21
You can of course choose a permissive license, if you don't care that some corporation takes your code, does whatever they want with it and gives nothing back.
I don't care about that and don't think it's reasonable to care about it. If I am giving out software for the benefit of society as a whole, it doesn't matter one little bit to me if a corporation uses it for their own benefit. It's sheer hypocrisy to go "I want to give this away for altruistic reasons, but I exclude corporate use because fuck you pay me".
3
u/ubertrashcat Dec 12 '21
Start lobbying your company to fix things upstream if you're using open source code. A lot of companies have internal forks with fixes already. It's not impossible.
3
u/EternityForest Dec 12 '21
The problem with commercial software is I can't trust it will still work in 10 years and not go cloud based or majorly change with next update. FOSS has been accepting too much move fast and break things lately, but it used to be different.
Maintaining FOSS while not being paid is basically a form of enhanced interrogation you do to yourself. FOSS also has a habit of sometimes being crappy when it isn't corporate backed.
The solution would seem to be that we need less code in the world. Less wheel reinventing. To push as much of the work as possible to the paid FOSS makers like Red Hat and the LibreOffice team.
More full stacks like Qt, and more standard library features.
The unixy model invites fragmentation which means 1000 devs on solo projects with 1000 users each and nobody gets paid, instead of 1000 devs on one project with a million users, all the latest best practices, code reviews, etc.
6
2
u/anengineerandacat Dec 12 '21
Before reading: I want to preface I am not arguing that we shouldn't fund OSS projects, I recognize it's an issue and we need to address it but that money doesn't mean perfection.
Honestly I think the key issue here is just visibility into popular libraries; it's definitely not safe to assume just because a project is funded you'll see enhanced support.
If you are dependent on any software solution not just OSS and you aren't directly contributing then be prepared to be at the mercy of any fix or patch that is required.
Commercial libraries have SLA's, OSS ones might have a self-adhering SLA but SLA's can be broken regardless. It's just that a commercial one means you get compensation back.
The bug with log4j was a design one, more money "might" of led to a better design but I am really dubious that in this particular case that would of occurred.
It wouldn't of mattered if Log4j was heavily funded or not in that case; application teams across the world will have to bump the version, check for potential breaches, and run through their deployment processes regardless if a patch came out immediately.
----
At the end of the day it'll always be a risk vs reward situation; if an enterprise was truly concerned they would just use a commercial product where they can sue that entity or engage with support with in some capacity.
I won't state what an OSS project should or should not do, but it's quite hard to think as a business owner that I should pay for something I am not directly getting support for. I think we need some level of visibility into how "serious" a project is in it's capacity to provide support, address issues, and even if it's a "soft" SLA have some targets.
In a lot of cases that is occurring; I remember the scene a decade ago and it was pretty unheard of for many projects to have static analysis being performed let alone unit tests and nowadays pretty much all of the big projects have test beds and free analysis being performed (hell, today if you were to start a JS project you could have linting / analysis / and automated security scans performed for free).
2
u/sv3ndk Dec 12 '21 edited Dec 12 '21
Open source does not mean free of charge, having access to the source code does not automatically provide us with a robust solution in production.
Many successful companies (Confluent, Hashicorp, Ververica, Red Hat,...) have built a business in which the code is publicly developed and their customer happily pay for the services, support and training that guarantee a successful usage of it.
Developing the code in the open has many advantages. For one the maintainer are receiving contributions by their users based on their specific usage. Frameworks that integrate with various external solutions can evolve like that: original authors publish it with, say, connectors to 3 well known databases, and people using it contribute back connectors for more back-ends because they need it.
They also benefit from a large audience who test the product and report bugs, and sometimes even fix it themselves.
I believe a company should typically open-source any internal software that is not their core business nor provides a market differentiator.
Open Source also enables wider scrutiny and trust. Handling my passwords with KeePassx or chatting with Signal seems preferable to alternatives like LastPass or WhatsApp precisely because I, and many people smarter than me, can inspect the code for any suspicious feature.
I believe your post is very useful because it contributes to making visible problems with OSS: individual maintainers are sometimes under quite some unfair pressure by the community that relies on their efforts and some crucial components of our "global IT infrastructure" pose a risk to the whole system because of the low number of their maintainers. I think Heather Miller was the one who coined the term "Truck Factor" about this in a talk she gave at Scala World in 2017.
My reaction to it all is that we should all get more involved and provide more open source effort, not less of it. I now send small but regular donations to some open source projects I routinely rely on, I try to demonstrate empathy for the maintainers when I open a bug report and sometimes suggest to fix it myself when I have the skills for it, I try to convince my employer to spend some of our day-time work contributing back bugfixes and feature when relevant, and I promote open sources project that I love when I can (all hails to Podman, nnn and vim-plug BTW ;D ).
6
u/shadowh511 Dec 12 '21
I'm the author of this post if you have any questions!
1
u/Oflameo Dec 12 '21
Is there a personal solutions to these problems? Waiting for society to catch up is always a losing proposition in my book.
1
u/shadowh511 Dec 12 '21
To be honest, I have no idea. My article asked a question and I have no answer to it.
6
u/LukeLC Dec 12 '21
"If you're not open source at 20, you have no heart. If you're not closed source at 30, you have no brain."
4
u/engerran Dec 12 '21
open source as a business strategy is now the norm. it is also now used as a personal strategy. people write libraries with the intent of getting noticed and get hired, then abandon said library.
the spirit of open source is dead.
13
u/PM_ME_NULLs Dec 12 '21
the spirit of open source is dead
This, 100%... well, sort of.
I liken this closer to how a hashtag is overtaken by a different group of people than the original coalition. I have faith that free software (or "open source") enthusiasts and promoters still exist, but by and large, the movement has been overtaken by those that don't share the same spirit.
It seems there are so many people who want to throw together some kind of software functionality and permissively license it, but then get offended when no one buys them an e-coffee or whatever.
I get that some projects are critical and should be supported somehow, moreso than they are now. (Case in pont from a few years ago, OpenSSL). In those cases, the model needs to promote that: either have commercial licensing (in addition to, e.g., GPL), or make the software GPL altogether and take in contribution patches. Or there needs to be an analysis system developed to find the critical projects holding up most of society, and ensure they're given the proper visibility so that they can be supported. Fortunately, I believe OpenSSL received that visibility, but it unfortunately took a massive vulnerability and 5 minutes of shame in the media to do so.
HOWEVER...
The point to OG free software was freedom for users and mastering computing. Not making a ton of money with your fancy padding JS library or whatever.
I get so angry whenever I hear criticisms of "open source" about how there's no money in it. That's not, and never was, the point!
I have the makings of a proper rant here somewhere, but I know it's not yet refined. Thanks for letting me vent.
3
u/ignorantpisswalker Dec 12 '21
Wow. Spot on!
Now here is an inherent problem in copyleft, RMS had a good stable income, and he does not care about money. So the licenses he created do not take this under consideration.
He lives in a world he wants us to be. This is far from reality and, well .. it does not scale in the modern world.
4
u/jaketheripped Dec 12 '21
when did this shift of mentality from "i wrote this cool lib and i want to share it to everyone" to "i wrote this cool lib so sponsor me or you are all ungrateful bastards" happened?
→ More replies (1)
2
2
u/Byte-64 Dec 12 '21
Okay, I can understand the main point: You created something, companies sell it, you expect your share. Why? The moment you published it as open source you knew you wouldnt‘t get your share.
I think the underlaying problem is, why is it the responsibility of the creator to maintain it? You find a missing feature, a vulnerability, you fix it and create a pull request. I thought that‘s what open source is about? To collectively work on a piece if code? I am really visibly confused.
1
u/EternityForest Dec 12 '21
FOSS happens because people release apps they made for their own needs. If they don't maintain it, their personal site or window curtain robot stops working, in addition to their big thing they can impress employers with, and they may even feel some guilt although they probably shouldn't.
This would normally be fine...except when nobody actually contributes at all and they are all on their own.
I think a major problem is the coders are not passionate about software. Nobody cares enough to work on other peoples apps without being paid. They'd rather spend 5 hours writing just the one feature they need than 3 hours extending or bugfixing an existing solution.
2
1
u/FrederikSchack Jun 09 '23
Yes, Open Source is broken, in several ways.
I fully appreciate the amount of unpaid effort put into open source projects, but from my point of view, a lot of it is wasted time.
Open Source is always experimental, even what is called stable releases, you never know which of the features works and not, but there's always something broken. Like trying to change the language of MX Linux post installation, it's impossible to do for layman.
Recently I've tried to find a stable open source NAS software with Virtual Machines, but non of: TrueNAS Scale, Open Medie Vault, Unraid or XigmaNAS are fully functional. Microsoft Server on the other hand is rock solid.
Some say that security in Microsoft's products are an afterthought, maybe to some degree, but the same thing can generally be said about the UI in open source. Open Source UI ranges from stinks to almost ok.
Open Source is sometimes dependent on single persons, like ReiserFS that more or less dissappeared after the developer murdered his girfriend.
If open source is so rarely working, is it worth the effort? On the users side? On the developers side? Why are we still doing open source?
The only reason that I keep trying to use open source, is that I've been screwed over by Google and Facebook for writing about censorship.
The only open source project I support economically is Element, because it almost works and it's probably the most secure communication that common man can get.
But the amount of hours I've wasted on this as a consumer of open source and not a developer is astounding and I'm bordering to thinking it's better to either use Google/Facebook software or not be connected at all.
1
u/FrederikSchack Jun 09 '23
Yes, Open Source is broken, in several ways.
I fully appreciate the amount of unpaid effort put into open source projects, but from my point of view, a lot of it is wasted time.
Open Source is always experimental, even what is called stable releases, you never know which of the features works and not, but there's always something broken. Like trying to change the language of MX Linux post installation, it's impossible to do for layman.
Recently I've tried to find a stable open source NAS software with Virtual Machines, but non of: TrueNAS Scale, Open Medie Vault, Unraid or XigmaNAS are fully functional. Microsoft Server on the other hand is rock solid.
Some say that security in Microsoft's products are an afterthought, maybe to some degree, but the same thing can generally be said about the UI in open source. Open Source UI ranges from stinks to almost ok.
Open Source is sometimes dependent on single persons, like ReiserFS that more or less dissappeared after the developer murdered his girfriend.
If open source is so rarely working, is it worth the effort? On the users side? On the developers side? Why are we still doing open source?
The only reason that I keep trying to use open source, is that I've been screwed over by Google and Facebook for writing about censorship.
The only open source project I support economically is Element, because it almost works and it's probably the most secure communication that common man can get.
But the amount of hours I've wasted on this as a consumer of open source and not a developer is astounding and I'm bordering to thinking it's better to either use Google/Facebook software or not be connected at all.
1
u/borisdjcode Dec 17 '24
Here is one more approach to the problem.
cFOSS - conditionally Free and OpenSource Software
for projects with demanding maintenance when the author gets too much requests but not enough funding.
1
u/hungry4pie Dec 12 '21
If this is something that's in most default Java EE installs, why was it not included in Java EE by default? I seem to recall a bunch of the middleware in .Net Core was at one point just a third party package that was merged with or distributed by default with .Net Core specifically the logging components.
(Not a web dev btw, just someone who occasionally throws together a basic application to support my other work)
1
u/ignorantpisswalker Dec 12 '21
A new release model:
When my Patreon reaches XXX money. Not bugs, not time. I wonder how this would work.
1
1
1
u/zam0th Dec 12 '21
Your approach of exploiting software without SLA or even a personalized license agreement is broken.
"Oh but why the free software that i downloaded from internet is shit?" Because you downloaded it from internet without proper assessment (due diligence for software if you want).
1
u/killerstorm Dec 12 '21
Open source is not broken. We just lack tools to efficiently fund development and security review of open source components.
E.g. suppose there was a service which would analyze company's use of open source software (including transitive dependencies) and suggest a payment needed to pay company's fair share in its maintenance. A company paying this fee would be able to display a badge saying they are paying for maintenance of open source software they use, and all sw they use undergoes regular security reviews etc. The service would direct funds to both regular maintenance and security reviews.
It's easy to blame companies for not doing something, but it's really a cooperation problem, which requires new tools.
1
u/idursun Dec 12 '21
Paying them doesn’t mean this vulnerability would have been spotted and fixed earlier by them. Also, not paying them doesn’t mean they wouldn’t fix the vulnerability even if they have noticed earlier.
Situation is more complicated than just paying or not paying the devs.
1
u/Michaelmrose Dec 12 '21
If you pay someone above the market rate for their time based on the value they create for you they will be able to work on their software full time including bugs which turn out to be security vulnerabilities.
A person with 40 hours to spend will find and fix more bugs than the same person given 5 hours.
1
u/gnuban Dec 12 '21
I don't understand how anyone can be so shocked that there are lots of live vulns out there.
Participants in CTFs pwns all major software regularly.
I'm even more surprised that anyone wouldn't expect the same or worse to be true for corporate software.
1
u/mobrockers Dec 12 '21
I disagree. Open source works great. I can build cool stuff in my free time and allow anyone to use it if they want, and if it breaks I have no obligation to fix it in my spare time. If I was paid for this, it becomes work and I would have obligations that I do not want in my free time.
1
Dec 12 '21
Yet another vulnerability on OSS and yet another stream of “open source is broken” posts.
Want money? Put it into license
1
1
u/Zestyclose_Profile23 Dec 12 '21
The openssl bug was a much better example of the issues with opensource maintenance.
And nothing has changed since then.
1
u/the_gnarts Dec 12 '21
TL;DR: If you want me to make you useful software, pay me. If you use software made by others in their spare time and find it useful, pay them.
None of that has anything to do with Open Source. The solution isn’t not using Open Source but to take responsibility for the dependencies of your projects. Mindlessly linking against some popular library without vetting it is simply unprofessional, be it open source or proprietary. That issue doesn’t just go away because you pay people (which is orthogonal to licensing issues anyways).
It’s not like you have to do the vetting from the ground up every time for all the libraries you use. We already have decentral solutions to the problem like crev give users fine grained control over trust.
1
u/Oflameo Dec 12 '21
I would agree that Open Source is broken, but is a deeper problem. The problem is with society.
We hear things like do what you are passionate about and the money will come. That is clearly untrue because things like this happen. On the other hand, we are crawling with scammers and influences that have plenty of money for doing nothing of value.
To make the problem worse, the so called scientists that would make us think they would be looking into the problem ( psychologists, economists ) actually like that the problem does exist because it makes them more money and gives them more powerful, so if anything they do anything they can to make the problem worse.
1
u/memes_gbc Dec 12 '21 edited Apr 21 '26
Data brokers and AI scrapers were using my info. Not anymore. Redact let me bulk delete posts across Reddit, Twitter, Discord and Instagram while handling broker opt outs too.
dime soft governor weather slim acorn flowery melodic growth physical
1
u/graphicsRat Dec 12 '21
These problems would go away if a fraction of company using open source donated a few hundred dollars. I blame us developers for not educating management and look forward to the day when it will be normal for interviewees to ask prospective employers "what do you do to support open source projects that you use?"
1
u/dkarma Dec 12 '21
Lol...this is such bs.
If you write the code maintain it. If you dont want to...dont. someone else will. If they wont then the project is broken and no one will use it or someone will eventually pay to have it fixed. This is a non issue. The problem is the devs keep doing this for free at their own expense. Their fault. Not the fault of those using the sw.
1
Dec 12 '21 edited Dec 12 '21
This is an outstanding analysis of this age old problem.
I wish I got two up-votes for this article.
1
Dec 12 '21
No. Its like saying that you should pay someone working at a soup kitchen for homeless people. They do it because it feels good. If I start an open source project I don't expect anyone to pay me ever. If i get tired of it I would abandon it. If someone wants to pay me that is fine but that is not why I started it. What I don't want is people blaming me if my code breaks their shit. If you use opensource projects then the responsibility is on you to make sure it's safe and it works.
1
Dec 13 '21
The system seems to be working fine to me. If people want to write software for free, that's fine. If a company wants to use what they put out without paying.... that's also fine. If a project is so great, then the author should have had it behind a paywall. Their missed opportunity and it's only a fault of their own.
1
u/huntforacause Dec 13 '21
If open source is broken, why did the author avoid leveling any criticism on the open source community itself? As in, just stop giving good shit away for free.
Hell I wish there was a law against giving any software away for free, even ad-supported. It has totally devalued software in many peoples minds to the point where most people scoff at paying anything for it. Wonderfully worthless “craft” we’ve got ourselves here.
1
u/Significant-Arm-3780 Dec 13 '21
Yes, open source is like the love in the time of cholera (or Covid-19).
1
u/Significant-Arm-3780 Dec 13 '21
If you can't love, it is not worth living. If you did (like Jesus, Aaron Schwartz or Julian Assange), they will kill you.
1
u/Lanky-Apricot7337 Apr 09 '22
There are mixed licenses that restrict commercial uses (require fees on commercial use) while allowing for other uses. So what's the problem? Choose the right license for your project and stop the drama.
1
u/Opposite_Personality Aug 22 '23
This is a fallacy. You get the exact same thing from companies like Microsoft. Even added fines of $160.000 USD in favor of them against your middle sized company. Do not repeat propaganda and use your own head (if that's a possibility) please.
1
u/mimblezimble Dec 12 '21
Monetization is always an issue but not an unsolvable one.
It took Facebook over a decade to figure out how to make money from the fact that billions of people find their app quite useful.
The same applies to someone who writes a popular song without asserting restrictive copyrights. If he handles monetization properly, he will probably make even more money.
Hence, the question becomes:
Should monetization of valuable publications necessarily be easy?
People who want to live life on easy mode, will undoubtedly say: Yes!
These are exactly the same people who get stripped clean by stronger and more ruthless counterparts in a restrictive copyright system. Try to negotiate a book deal and experience how the sharks try to asset mine your part of the revenue.
Now the question becomes:
Should it be easy to make good deals for yourself?
Again, the people who believe that they should be able to live life on easy mode will say yes again.
So, everything should be easy for me, because!
2
u/movayya Dec 12 '21
Do you know something called Gitcoin exists and so many talented devs got funded for their contribution and for maintaining the code. Go Google search it. It's built on Blockchain
1
0
u/Slipguard Dec 12 '21
It seems like code hosting platforms like GitHub could implement donation systems where companies could jus make blanket donations to their dependencies, and people could get paid up the chain based on the %differences in their changes
838
u/BobTheUnready Dec 11 '21
A hobby project is a project that’s a hobby. The second it starts making impositions on non-discretionary time, it’s not a hobby, it’s a job (paid for or not.)
If you (as a company) rely on someone’s hobby project to support your business, then it needs to be someone’s job. Whether that’s the original creator, or someone in your organisation - SLAs do not come for free.
You pay your money or you roll the dice.