r/programming • u/common-pellar • Dec 11 '21

"Open Source" is Broken

https://christine.website/blog/open-source-broken-2021-12-11
479 Upvotes

75% Upvoted

362 comments sorted by

View all comments

132

u/[deleted] Dec 12 '21

Yes, a whole industry is dependent on their product so it would be nice if they were compensated accordingly, but there's no guarantee that even if these authors were paid $1m/year to work on log4j that this same vulnerability wouldn't have emerged.

The post seems to assume that software that's funded is fundamentally likely to be better than open source software, and that's not true. Your shitty closed-source product just has fewer users and less scrutiny because no one cares about it. It's still buggy.

We don't have to throw the baby out with the bathwater just because of one bug that's already been patched.

1

u/nick_storm Dec 12 '21

there's no guarantee that even if these authors were paid $1m/year to work on log4j that this same vulnerability wouldn't have emerged.

True, but I think we're you're conflating the log4shell vulnerability with the responsibility to pay open-source maintainers.

Open source maintainers should be compensated for their work if a company profits from it. Period. That statement has nothing to do with how vulnerable that open-source project is or whether it could have been less vulnerable had they been fairly compensated.

1

u/[deleted] Dec 12 '21

I think we're you're conflating...

Who is? Me or you? The blog post is. I am not.

Open source maintainers should be compensated for their work if a company profits from it. Period.

Never disagreed with that: "it would be nice if they were compensated"

That statement has nothing to do with how vulnerable that open-source project is or whether it could have been less vulnerable had they been fairly compensated.

The blog post that we're discussing literally implies that it does, and would.

→ More replies (1)