Do we? I do open source work and maintainership, and am happy that this is outside the control and influence of industry.
Must even this that "makes the Internet special" also bow to industry needs?
If a company is basing their livelihood on your library, they should (in my opinion) be supporting it somehow -- either by paying you, or paying someone to keep an eye on new versions.
The other choice is they are trusting you to fix bugs and not be malicious, which isn't (in my opinion) reasonable, as you get nothing in return.
Anyone can choose this strategy, and I don’t quite understand why more OSS maintainers don’t.
I'm very grateful for OSS projects and maintainers but this is an interesting question: is doing something for free a free pass for false promises (advertising)? If I commit to help someone for free I then have a responsibility to show up. If an OSS developer advertise their projects as production ready then they have a responsibility to honor what is promised. Otherwise it should be stated plainly that the project should not be used in production ("This is a hobby project, use it at your own risks"). Sure it's less attractive and can be incompatible with success and resume building, but it's not possible to have it both way.
Maybe it's important to you and maybe people you support -- but that has nothing to do with your right to make demands against someone who put their work out there for free.
If you need a guaranteed support model, you either do it yourself or hire a company to provide that for you. I've used _supported_ commercial software that's garbage, and I've used FOSS software which has been absolutely rock solid. Also, commercial or not, just because it's supported doesn't mean the problem will be fixed or a feature added.
If you aren't directly paying someone to be there for you, then you're trusting goodwill and/or the community at large to fill that role for you. If you need that assurance, pony up to one of the consultancies like IBM which will support "X" for price "$Y". That support you're referring to is available, at a price -- but doesn't necessarily involve the original contributors.
I've had far better luck with FreeBSD on servers for the past 20 years than I have with Microsoft Windows, but I also understood the deal: "Fix it yourself, or submit a bug report and see if anyone else wants to work on it."
The corporate software method: "Pay us lots of money to look into the bug report, and maybe we'll fix it, maybe we won't -- but you'll need to pay hourly until we determine if its a bug. Then MAYBE we'll refund your money."
The primary difference is that OSS gives you the source and the ability to fix problems on your own, without any involvement from the original contributors/projects. You can also hire any number of other companies to provide support. With a traditional commercial model, you're entirely at the mercy of the company which originated the software, and you likely have no rights to the source or tools which would enable you to fix the problem yourself.
Also tangentially I don’t buy into the binary distinction “it’s free it can be poison I can’t complain / I paid it’s my right to be an entitled asshole”. The cost is irrelevant with the promise for me, the first cent doesn’t have magical entitlement, and its absence is not a free pass to (white) lie.
There is no binary distinction and it isn't about the amount of money per se.
What you're missing is that full extent of what you can expect is spelled out in the license.
Whether it's an open source license or a commercial one, a common one or a custom one. If you don't prefer the terms of the default license, attempt to negotiate a different one. You can always negotiate. If you expect more, expect to pay more.
There is no clause in any license (that I've ever seen) that says if this project is more popular or shows up more often in search results then the license grants the recipients more support. That's not how it works. Read the license, that's what you get, nothing more.
Obviously they should be careful when picking the license, but with any of the standard licenses, they should be fine?
… PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
I think it’s particularly clear, and that part is even in all capitals.
"AS IS"
If you have a specific project in mind, have you read the license under which that project has been made available to you?
If it is under most of the common open source licenses, you will find that it already states very clearly what applicability and support you can expect (none).
You are free to pay for a support contract if you need anything beyond what the free license guarantees you.
Take it or leave it. Which works for the other side complainers too. The worm is available to be used for free by companies, because license said so.
But commercially this is unpopular because it means that companies have to actually account for the cost of maintaining a complex software stack instead of pretending all the open source dependencies maintain themselves.
Long ago at Sun the practice was that all code had to have an internal team maintaining it. If the code was brought in from outside that's fine, but some team internally still had to be where the buck stops for fixes. If all bugs can be fixed by bringing in updated version from open source, that's great. But if not, there's still a customer with a bug and it must be fixed by the internal team if that's what it takes.
Of course, this wasn't too popular with some management, since they wanted to bring in all the free code but offload all the work to unpaid volunteers, instead of budgeting for maintenance.
And I agree with you, that these people as their software ascends in use & importance, need support.
The term professionalization is dangerous to apply here though. There's a lot of baggage & constraint, power/hieraechy dynamics, employer/employee relationships that are no fun, are against the spirit of the thing. To have this vibrant, radical, free spirited altermative, & to turn around & try to consume the spirit of the thing, digest it into the the dun, boring, mundane mediocre shit-show world is a sure & sad way to wreck the thing. Yet these people deserve & need support somehow. Finding innovative ways to support those doing vast social good without binding & restricting them, without entailing them into your projects & curtailing their potential.
That all said, at this point, we just need to start funding these people far far better, step 1. These concerns about whether professionalization see destroys our golden vibrancy are abstract when so few (& only such select industrially useful) projects garner any support at all.
Do you like working for free? Do you like people making unreasonable demands?
How would you like spending the weekend like the log4j people trying to solve a Prio 0 bug?
I don't like doing free tech support for entitled mean people on GitHub, which is what you're really asking about, but I'm perfectly happy to throw code over the fence for the general public to use if they don't bother me about it.
What happens if the log4j developers just... don't fix the bug? Other people who rely on the library fork it, development continues with more funding, the world keeps turning, and maybe a few tens of millions of dollars of additional economic damage are inflicted in a diffuse fashion across the global tech industry.
It's entirely your prerogative to say no.
I’ve always found people are reasonably happy when I send them big reports — though I always either send a fix or, if I can’t figure it out on my own, a test program that demonstrates the problem.
The last time was for some random library I was writing a python wrapper for and the author seemed way too happy to be getting a bug report for the code he based his master’s thesis on. Pretty amusing to be perfectly honest.
Some people still idolized the hell out of me
Contrast that to FOSDEM, which is completely different. This isn't just an offspring of early hacker culture. This is as offspring of how "socialist" european university systems were.
A lot of bigger OSS projects were started during peoples university time and what's so fundamentally different between how universities in Europe were before? You didn't have care about graduating. Some people stayed in University for 10 years, it was free and sometimes even had some benefits, like cheaper healthcare.
Now studying forever subsidized isn't always a good thing, but it has some nice side effects, like being able to work on your side project without having to worry about your livelihood(something that is unthinkable in the US).
The European higher ed systems has gotten more and more close to the US system with the Bologna process[1].
Most Americans immediately think about how to monetize things, and don't get me wrong, being able to live off of your open source project is nice, but it wasn't the focus in the past.
[1] Free Software originated with GNU which was started by Richard Stallman, an American at MIT. Open Source originated in Palo Alto, CA as an alternative (less political, more business friendly) approach to Free Software. There was freely available software prior to the formalization of terminology and licenses from organizations like FSF and OSI, but even then most of it was from developers in the U.S.
[2] Prior to the Internet, most open source projects were heavily concentrated in the U.S. as large scale distributed projects weren't a thing until the 90's with widespread availability of Internet access.
both sides of this odd couple had different motivations and restrictions, but they cooperated in building the network and the software that ran the network. People here have complained, but I claim, TCP/IP was not the only network game in town then, and the massive scaling that you see today was not done yet, and did not work for lots of reasons. Many OSS projects related to the network itself, the signals across the network, and math/science. The media world was largely influenced by commercial print and Hollywood, and was less influential in the early days, as they stuck to the commercial distribution mechanisms. Network media tended to be odd, music-oriented, or sick things, in those early days. Also note that single, massive source code repos were not a thing, so people traded "tarballs" with important releases of whatever.
Which, by the way, took 8 years... typical length for European's who really don't feel like graduating (back in the day).
It's a bit out there, but I do believe there is some truth to op's points.
But open source projects still need a roadmap, focus and maintenance, regardless of how they are funded.
If you just want to share code, that's fine as well, but that's not an OSS project (sure, it can be an open source "project" - but not a project that grows)
Why is sharing code (as long as an OSS license is attached) not open source?
Under what circumstances am I allowed to call things I do open source, under what circumstances not?
outside of a few specific areas; like compilers but that's mainly because hardware is constantly evolving.
If you don't care about control over the downstream of your project, or funding, no one is forcing you to professionalize! I just want that to be available as an option to those who do.
Proprietary and corporate players are equally useless at securing their supply chains; I don't love that (from my perspective) they're now blaming and trying to coerce open source to become more like them to ostensibly fix the same problems they propagate themselves.
I'm not a security nihilist: I think improvement is possible. But in my experience, not many corporate managers or project sponsors ask for removal of features and reduction of attack surface.
Perhaps; some financial statistics that I'd suggest to consider would be:
- As of June 2018, U.S. households in the 0-40% income-level group had $0 median savings[1]
- From the same source: the median savings for a household in the U.S. is approximately $11k. There are approximately 120m households in the U.S. according to the U.S. Government census[2].
- As of 2022, thirteen firms from within the S&P 500 hold a combined $1 trillion in cash-on-reserve[3]
And yep, it'd be sensible to debate whether individuals or companies would be more likely to influence the direction of software; it's a disingenuous comparison to draw in that regard.
But even if we consider only individual citizens, there would still be significant disenfranchisement in dollar-voting ability.
[1] - https://www.cnbc.com/2018/09/27/heres-how-much-money-america...
[2] - https://www.census.gov/quickfacts/fact/table/US/HSD410219
[3] - https://www.investors.com/etfs-and-funds/sectors/sp500-compa...
The entrepreneur in me will never understand this problem: "programmer creates world famous software used by Microsoft and NASA and doesn't make any money and is burning out from all the work."
Here are your solutions:
1) If the users want support, charge them for it. Split the proceeds with someone who will actually do the support. If it's still too much work, raise the price.
2) If the users want features, charge them money to put those features on your roadmap. If they're asking for features you don't want to add, just raise the price or say no until they go away.
Here is what will happen when you ask for money: people you don't want to deal with will disappear. Also you'll have more money, and you will work less.
Do you need to think about business a bit somewhere in there, sure, but probably a lot less than most people think. The "business side" for the Grunt guy could probably be "register an LLC online then get an Upwork account and let them handle the other shit like your payments and tax forms for 5%." Yes, fucking Upwork.
I don't see the non-profit model scaling to the whole industry, and the examples we have today of non-profit foundations mostly don't pay maintainers. For example, Log4j is under the Apache Foundation but none of the developers on its committee were being paid.
Apache's model is the traditional one which isn't aggressive enough. Linux foundation is more aggressive about offering lessons as products etc. I'm not as happy with LF' model as the hippie model but it is better than devolving into no new work causing no one to donate because ex-maintainers are supposed to have vesting future stock, etc.
Companies that heavily rely on one specific FOSS project and have well-defined requests naturally get more invested in them one way or another. But even for these, which tend to be bigger tech companies with more cash, "just pay the maintainer" is a tough sell when they can just either come up with their own project (even FOSS and recoup the "losses" in proprietary IP with hiring marketing) or fork it if PRs from employees are not well-received by the maintainer.
Also "just pay the maintainer" doesn't contribute towards most managers' primary goal of empire-building. In my experience even getting individual contractors paid for work can be a tough sell, managers want headcount and the opportunity to abuse their minions.
A "maintainer" receiving funds somewhere on the internet to play in their sandbox just looks like enabling escape from management's prison.
I think the disconnect is for devs that don't want to do that. But those same devs probably don't want to incorporate and go through the hassle of running their own business either. For them, who really just want to hack around and make software, I don't know if there's any real path. The whole value proposition of full time employment for a company is that someone else takes care of all that nonsense and you get to just do the thing you're trained for. Trying to extract that narrow piece out onto its own doesn't work well, and I honestly don't know if your solution really solves for that.
For the last decades it has been coopted by corporations and especially SaaS.
Now a lot of FOSS is either corporate-driven or... unpaid labor for SaaS companies.
Actually it does have a parallel in most sciences and engineering, academic publishing
In particular the fact that often when a publication turns out to have industry value, a company is formed around it to commercialize it: both to extract profit from it, and to make it accessible and legible by companies. Companies by and large don't take academic papers off arXiv and implement them.
The rest are funded through grants, which have the side effect of directing a sizeable chunk of the academics time to writing grant applications rather than science. I think that would be a regrettable outcome for Open Source.
That's not a consequence of grant funding itself. The traditional academic career path jumps directly from a trainee to a manager, and managers have to do what managers do.
Larger research institutes have positions for professional researchers. Those researchers don't have to spend that much time on grant writing, unless they want to become managers or they are trying to remain competitive for positions in the traditional PI-centric academia.
That's a key lesson for FOSS. If the development is funded by grants and donations, the organization should be large enough that every senior developer doesn't have to become a manager.
For example, I'm already a freelance developer with (my countries equivalent of) an LLC and I send invoices to my clients for my work. I'm also in the process of writing a few libraries in the mobile/desktop/web shared-code space that I want to release as open source. Should I just mention this on the projects Github and website properties? A simple "contact me for an invoice" link and process the invoices/payments manually? Is there a platform a la Github sponsors/Patreon that is compatible with this workflow?
Eventually I hope there will be social norms (like how you advertise the option), tools (like payment rails and platforms, hopefully not like Patreon, but more like those lawyers use to invoice clients), resources, and even training. I hope it will become a standard transaction, that companies have processes for approving with no ad-hoc work.
But for now, whoever wants to try this is in uncharted territory, will have to discover what works by trial and error, will have to teach companies how to think about them, and will need some significant leverage to spend (such as personal networks, visible projects, and savings).
I don't quite get the moaning. If you are unhappy with FOSS, don't do it?
Nobody is entitled to a FOSS developers time. But on the other hand, FOSS developers are also not entitled to anything.
But just saying no for many people is still a non-trivial skill.
Also, just saying no in the face of consistent and repeated demands while mixing that with a desire that many creators have to be responsive to the people who use their software and to satisfy those people to some extent, compounds the difficulties creators face.
I definitely think it's an obvious opportunity to bring more order and structure to these currently ambiguously defined exchanges. I believe we can do better than stress and ambiguity on either side of that.
Sure, one solution is creators just saying, "I don't want to do this right now," so just shut it down, close it, block them whatever, heh. I actually think that that's not as much of a general purpose solution as it looks like at first because creators do actually want to help people with their stuff, and they also want to get rewarded for doing so (because you know they need to eat and everything), and doing so actually takes a lot of time, and they also want to control their taskflow to some extent.
> Open Source volunteerism is the result of the early hacking culture
I don't agree with that take. There was not, to my knowledge, a "volunteerism" component of either early open source or early hacking culture (though my roots only go back to about the mid-80s). The "volunteer" part came later, as there was an explicit effort to emphasize open source as free as in free labor. What I used to see was openness in the sense of knowing what the code did and being able to make changes if you want. It was more of scratching your own itch and letting others play with the code if they wanted.
No other industry had a large portion of its R&D done by people scratching their own itch and sharing the results freely. That led to relying on that freely available work, which led to volunteerism.
I would suggest something more distributed, like giving each citizen €100 a month they can allocate to FOSS.
We’d get a lot more of “things that qualify for the €100”, but it’s not clear that we’d get a lot more useful FOSS.
So most likely most people would not give anything because they don't know/care, and a few marketable projects (like VLC) would get most of the rest, way more than they need.
FOSS could be funded by global (non-national) consortium
They would probably use that 100 on food or fuel.
Now, you might have the mistaken idea that science or other R&D funding is easy to access like ticking a box on a tax form. No, you need lots of bureaucratic support and so to work under government funding is to get a job in a university or other research lab that is equipped to chase, win, and collect government funding. Your position is "soft money" and depends on either you (as a principal investigator) or your boss engaging this constant struggle to win the next contract that keeps you from losing funding and your position. Some of this money splashes around to student workers, graduate students, postdocs, or interns. A lot is spent on more permanent, full-time faculty and staff as well as other infrastructure and administration.
The big shift I have seen in my ~25 year career is that the industrial participants in this environment have shifted from being primarily government-contract focused to being consumer-focused. The whole cloud/internet revolution has brought these new corporations who no longer depend first and foremost on government grants from the science or defense research complex. Earlier, we also saw shifts with enterprise, B2B-focused corporations and vendors, but I think they often had more overlap with the traditional government funding sources and also blended in a little more.
NLNet also do grants, but the paperwork is minimal, just a short web form describing the idea.
Privatised OSes or other platform software is an absurd and insane proposition
However, it's not a sustainable, fair, or effective foundation for an industry with the responsibility to power modern society. We need the critical role of Open Source maintainer to professionalize. This is most likely to happen through capture by large intermediaries, but I wish to see it happen through the formation of a serious professional role, organized independently or in small firms, like lawyers.
This will require changes both from the maintainers [1] (become legible, get a LLC, send real invoices, offer guarantees) and from companies [2] (pay the maintainers, pay them real money, pay for maintenance, and keep paying them).
[1] https://words.filippo.io/professional-maintainers/
[2] https://words.filippo.io/pay-maintainers/