News for hackers. Stuff that matters.
Re:Krita fund has 0 corporate support by zoogeny on Thursday October 05, 2023 @11:54AM (#37780234)
I think the devil is in the details. As others have pointed out, this would drastically change the incentive structure of OSS. You would attract actors whose entire purpose would be to get listed on as many SBOMs as possible to maximize their revenue potential. I'm envisioning a world of `padLeft` controversies.

That is to say, I don't think a pure "frequency of use" metric is sufficient to fairly distribute such a pool. And if you have a large and growing pool of available money then the incentive to game the distribution scheme becomes more attractive than making truly awesome software. And I very much doubt that we have any reliable ways of aligning such a money distribution scheme with the goal of creating amazing software.

Re:Krita fund has 0 corporate support by bee_rider on Thursday October 05, 2023 @12:28PM (#37780655)
I wonder if it would be enough to just recursively pay out to each dependency.

You pick a % to keep and a % to pass along to each of your your dependencies, and then they split up that % that you passed along to them, so on and so forth.

Of course people could choose to pass 0% along to their dependencies. But that seems fine; people can adjust and just not send greedy projects a very big split.

Trying to enforce some fairness on the outside will probably just result in silly behavior from greedy people (ie, if every project gets an equal split out and somebody doesn’t want to hand any money down to their dependencies, then they can just create a bunch of tiny projects to dilute their out-split).

Re:Krita fund has 0 corporate support by orblivion on Thursday October 05, 2023 @12:11PM (#37780447)
`padLeft` can't just inject itself into a software stack right? So there's an incentive to be valuable enough to be included.
Re:Krita fund has 0 corporate support by VyseofArcadia on Thursday October 05, 2023 @12:27PM (#37780641)
Depends on how you do the accounting. "Well, you don't use padLeft, but 15 packages you depend on do, and 68 packages tjat those packages depend on do... Altogether you're looking at 348 instances of padLeft."
Re:Krita fund has 0 corporate support by orblivion on Thursday October 05, 2023 @12:31PM (#37780700)
If there were a metric that would make each instance of padLeft worth a tiny amount of money (for such a tiny library), that sounds like a reasonable outcome to me.

EDIT: I may be missing part of the point

Re:Krita fund has 0 corporate support by bee_rider on Thursday October 05, 2023 @12:47PM (#37780902)
A trivial way to exploit this kind of system, I think, would be to write LegitimatelyUsefulLibrary, then write 1,000 PadLeft projects, and make LegitimatelyUsefulLibrary depend on all of them.

Since you are the one marking the dependency of LegitimatelyUsefulLibrary on your PadLeft projects, you can game the metrics however you’d like when making it.

Re:Krita fund has 0 corporate support by noworriesnate on Thursday October 05, 2023 @09:00PM (#37786114)
But why would I, as a developer, use such a library? It would cut me out of profits unnecessarily. In fact when I’m picking my dependencies I will deliberately avoid those that take a larger slice of the pie than is worth it for me.
Re:Krita fund has 0 corporate support by kybernetikos on Friday October 06, 2023 @02:59AM (#37787902)
If I remember the story correctly the padLeft dev was actually pretty notorious for submitting patches to open source projects that 'coincidentally' added dependencies on his code.
Re:Krita fund has 0 corporate support by stolsvik on Friday October 06, 2023 @10:13AM (#37791046)
Sources?
Re:Krita fund has 0 corporate support by Clamchop on Thursday October 05, 2023 @04:41PM (#37784027)
Only enumerate and pay for top-level tools and dependencies, none of which are probably padLeft. Those downstream recipients can further "pay it forward" to their top-level dependencies. Everyone has an incentive to not pull in superfluous bullshit so they can hold onto as much of their pitance as possible.

Trickle down economics? Ronald, is that you?

Re:Krita fund has 0 corporate support by lars_francke on Friday October 06, 2023 @02:55AM (#37787884)
Everything you say is correct. I still want this. It's better than what we have today.

We can work on improving things later.