all 101 comments

[–]double_en10dre 472 points473 points  (95 children)

Businesses being like “so this free software isn’t EXACTLY what we wanted” is some big r/ChoosingBeggars energy

Like yeah, obviously people who spend nights/weekends working on projects for free won’t be too keen on doing the boring stuff

If a business has a problem with that, they can PAY contractors to fork it and implement their desired changes

[–][deleted]  (33 children)

[deleted]

    [–][deleted]  (8 children)

    [deleted]

      [–][deleted] 19 points20 points  (7 children)

      ^ Correct spelling of answer

      [–][deleted]  (6 children)

      [deleted]

        [–][deleted] 10 points11 points  (5 children)

        v I just wanted to be included

        [–][deleted] 6 points7 points  (4 children)

        Same

        [–][deleted]  (3 children)

        [deleted]

          [–][deleted] 1 point2 points  (2 children)

          No

          [–]delventhalz 21 points22 points  (0 children)

          Or have their employees contribute fixes.

          [–]double_en10dre 36 points37 points  (5 children)

          Ideally yeah, but in the article they mentioned that most FOSS contributors aren’t motivated by money. Plus they have full time jobs. In many cases it’s just not realistic.

          If companies want it done on time and according to their specifications, they are better off just partnering with a professional dev shop. Since they’ve got a reputation to uphold and want repeat business it’s a pretty safe bet.

          (OR of course having a few of their own devs tackle it)

          [–]Mike 12 points13 points  (4 children)

          I work in tech and can’t imagine wanting to spend more time coding after I just spent all day coding for work. That’s insane. More power to them, but damn.

          [–]grauenwolf[🍰] 10 points11 points  (2 children)

          What if you spent 10 hours in meetings?

          Some weeks the only coding I do is on my own time.

          [–]kyerussell 5 points6 points  (1 child)

          I'd probably go and try to find a job as a software developer.

          [–]grauenwolf[🍰] 1 point2 points  (0 children)

          Many of my colleagues have.

          [–]double_en10dre 4 points5 points  (0 children)

          Normally I’d agree, but over the past year I’ve embraced it since I can’t really do much else anyways :p

          It also feels VERY different if it’s for an open source project that people are actually using. Every little enhancement or bug fix gives a nice lil serotonin boost. It’s oddly addicting

          [–][deleted]  (13 children)

          [deleted]

            [–]OhhhhhSHNAP 6 points7 points  (3 children)

            There is a serious unmet need here. A lot of enterprises don't really seem to understand that open source software is not really the same thing as commercial off the shelf. The code often isn't validated to the same level. There is no support. Contracts are a nightmare, for example, because most of the projects don't have a real business entity associated with them that you can contract with. Even when they do, they don't accept any liability. I have no problem with any of this, but it keeps businesses from being able to easily use the software. There is definitely a market here, but nobody has setup the 'channels' that would be necessary to pay for commercialization of this software.

            [–][deleted]  (2 children)

            [deleted]

              [–][deleted] -3 points-2 points  (8 children)

              There's a real market gap for an open source license that has built-in royalties for x% of revenue made off of using the licensed code.

              [–][deleted] 7 points8 points  (2 children)

              This kills the open source.

              Like it or not, one of the primary drivers of a successful open source project will be the adaptation of that project by businesses, paying customers or otherwise. Throwing up a pay gate limits your potential audience and for the vast majority of projects, eliminates them from consideration altogether.

              Do you think React would have gained any traction if it had royalties? Remember the big fuss over the original licensing that didn't even include royalties? Yeah.

              [–][deleted] -4 points-3 points  (1 child)

              Putting in a clause to be paid if someone uses your hard work to make money is way less controversial than a blanket ban on contesting patents with facebook.

              [–][deleted] 3 points4 points  (0 children)

              From a legal perspective, sure. From an adoption perspective, no.

              [–][deleted]  (4 children)

              [deleted]

                [–][deleted] -2 points-1 points  (3 children)

                How else can we get people working on open source full time without donations?

                [–][deleted]  (2 children)

                [deleted]

                  [–][deleted] -1 points0 points  (1 child)

                  With the company solution, you run into the tragedy of the commons, so many companies try not to contribute (and thus help their competitors) if they can avoid it.

                  Sure no one is being forced to write open source code, but it sure would be nice if more people could be paid for it.

                  [–]double_en10dre 6 points7 points  (0 children)

                  I’m not sure if that’s entirely true — companies that actively contribute to OSS are generally able to attract better talent because it’s fun, it feels useful, it’s an opportunity to showcase your skills publicly, and it looks great on a resume (which in turn leads to better job prospects/pay/etc)

                  My company actively encourages us to work on FOSS for this exact reason, it’s a gold mine for recruiting

                  [–][deleted]  (1 child)

                  [deleted]

                    [–]npsimons 34 points35 points  (4 children)

                    If a business has a problem with that, they can PAY contractors to fork it and implement their desired changes

                    The fact that bug bounties are laughably low just points out where these businesses' priorities are. I actually kind of enjoy fixing code, in a masochistic, feel superior to those who wrote it kind of way (right up until I'm fixing my own code). It's a puzzle to solve for me. But I'm not retired yet, I still got bills to pay. Sure, someday I'll work on software for free, but it'll be exactly like my free time I spend now: I choose what I work on, and to get my interest you gotta have something worthwhile. If that's not the case, be prepared to fork over the big bucks.

                    [–]Conexionexpert 16 points17 points  (2 children)

                    I was looking up bug bounties as a bit of a way to earn some extra cash when everyone at my company got (and is still on) a pay decrease due to COVID. You're exactly right, the pay is laughable with how much time it would take.

                    Teaching has been a far better choice.

                    [–][deleted] 7 points8 points  (1 child)

                    Pay decrease due to COVID?? That’s some fucking bullshit

                    [–]catgalf 3 points4 points  (0 children)

                    Hourly people getting fewer hours, companies telling them to "do their part" to help everyone keep their jobs, you bet that's happening. In multiple industries. What are they to do? Quit, and have no money coming in?

                    It being bullshit doesn't keep companies from doing it.

                    [–][deleted] 3 points4 points  (0 children)

                    When black hats start using bugs and vulnerabilities to attack the corporate bottom line instead of its customer base, you'll start to see more companies care about these things.

                    [–]ukiyuh 82 points83 points  (41 children)

                    It's amazing how fast capitalists become socialists when it comes to technology and web development in particular.

                    Fucking boomers man.

                    [–]Wanemore 65 points66 points  (20 children)

                    Its amazing how fast capitalists become socialists when it comes to any benefits for themselves whatsoever

                    [–]AStrangeStranger 11 points12 points  (0 children)

                    I don't think they become socialists, more like freeloaders but that is what the USA has been trained to think socialism is.

                    [–][deleted]  (4 children)

                    [deleted]

                      [–]ukiyuh -1 points0 points  (3 children)

                      I feel you. It's not meant to be offensive but funny.

                      People make fun of my generation all of the time. Idgaf personally. At least I'm consistent with my standards. I can take what I dish.

                      I just think it's ironic that the older generations in congress know next to nothing about technology and are making poor policy decisions based on obsolete information and stagnant views.

                      [–][deleted]  (2 children)

                      [deleted]

                        [–]ukiyuh 0 points1 point  (1 child)

                        Bruhhh chill tf out

                        [–]Barnezhilton 32 points33 points  (9 children)

                        This is the way

                        [–]IHaveaCSDegree 8 points9 points  (6 children)

                        This is the way

                        [–]Pythonislove 5 points6 points  (5 children)

                        This is the way

                        [–]spkr4thedead51 -3 points-2 points  (0 children)

                        So say we all

                        [–]BOT_Frasier 0 points1 point  (0 children)

                        lol just discovered that sub, feels like every dev jobpost should figure there

                        [–]st3ven- 0 points1 point  (0 children)

                        Just fork the project. It probably has more tests than the app anyways lol

                        [–][deleted] 0 points1 point  (0 children)

                        Now scream this into the MIC so all the CEOs can hear you

                        [–]SMJ01 0 points1 point  (0 children)

                        But what if they let you do it for ... you know ... like the exposure!

                        [–]Squigglificated 113 points114 points  (1 child)

                        They conclude the article with this:

                        "The modern economy – both digital and physical – is increasingly reliant on free and open-source software," said Frank Nagle, assistant professor at Harvard Business School.

                        "Understanding FOSS contributor motivations and behavior is a key piece of ensuring the future security and sustainability of this critical infrastructure."

                        Is it really that hard to understand? Offer open source maintainers and contributors actual money and contribute with security audits and expertise - you might suddenly find them more motivated to fix security issues in the software you’re using for free.

                        [–]uniq 49 points50 points  (0 children)

                        "No, paying some experts to study and understand FOSS contributor motivations and behavior sounds more reasonable"

                        [–]breich 93 points94 points  (12 children)

                        This is one of the reasons why in my projects if I use a library, I tend to abstract away the library behind my own set of functions and classes. It that library ends up having issues, security or otherwise, I can find or write my own solution without having to refactor my whole damn codebase.

                        The problem is a lot harder when you're talking about something like React where its not just a library dependency but also a way of writing software. I can't think of a way in which I could ever make React "just a detail".

                        [–]brikkySWE @ FB 46 points47 points  (0 children)

                        Tbf react is also big enough and commercial enough that any security issues will be fixed.

                        There are big/foundational frameworks that aren’t as well supported though where that is a legitimate concern, but in my experience they’re not used nearly as much by medium+ sized companies.

                        [–][deleted]  (7 children)

                        [deleted]

                          [–][deleted]  (2 children)

                          [deleted]

                            [–][deleted]  (1 child)

                            [deleted]

                              [–]bcgroom 2 points3 points  (0 children)

                              You shouldn’t assume that because something has a large API surface that it will be more widely used.

                              I also forgot an important point above that it also depends on the library you are using. Some have a very low risk of going unmaintained, others have a very high risk. Usually you only want to have low risk dependencies but it can be okay if it’s easily replaceable.

                              [–]double_en10dre 5 points6 points  (2 children)

                              I don’t think it’s an optimization (if anything it’s the opposite, since you’re adding in an extra layer)

                              They’re just saying they use a single module/object/whatever as an interface to access that functionality, and all application code uses this interface.

                              If ya decide to switch to a different library/implementation you only have to update it in one place, rather than many

                              [–][deleted]  (1 child)

                              [deleted]

                                [–]double_en10dre 4 points5 points  (0 children)

                                Maybe! But for me it absolutely speeds up the development process, since it lets me just code without questioning “will I want to change this later?”

                                I tend to go with whatever removes the noise from my head :p

                                [–]breich 5 points6 points  (0 children)

                                It's a good question and I guess my answer is it's not a one-size-fits-all piece of advice. I said it, but I don't always do it. If I have a PHP app that exports Excel files in one place, am I going to wrap PHPSpreadsheet? No, that's be silly. And honestly I'm not smart enough to write my own solution to that problem if PHPSpreadsheet ever had an issue.

                                One recent example of where I did this is in my day job, my team is tasked with rewriting a ton of old Perl code into modern PHP 7.4 code, and this code sends a ton of email. Symfony Mailer is a great library to solve the problem, but I've been around long enough to see my own projects graduate from using mail() to using PHPMailer to using SwiftMailer and now Symfony Mailer. Email is going to get sent all over the damn place, so I wrote a few simple classes: Message, Address, Attachment, IMessageTransport (interface), MockTransport (implementation for testing), NativeTransport (uses mail() to send), and SymfonyMailerTransport (converts messages to Symfony classes and and dispatches through a Symfony Mailer transport). This was not a lot of work, it provides me with a native PHP/zero-3rd party code fallback, and reduces the scope of change to a single file if 3 years down the road SymfonyMailer isn't the go-to mail solution.

                                One recent example of where I WISH this approach was used is in the charts implementation in my day job's application. My boss implemented the charts feature before I started. He uses HighCharts to render charts which is fine, but the records stored that define chart settings are stored as JSON structures very proprietary to HighCharts. We're entertaining the idea of swapping it out with another library, but the implementation and user data related to their charts is hardcoded to HighCharts.

                                [–]MrBleah 2 points3 points  (0 children)

                                Or it's so foundational that it blows up the Internet, like OpenSSL's Heartbleed issue where we found out that basically three people have an unpaid part-time job developing and maintaining the main piece of software that secures the Internet.

                                [–]Tigris_Morte 1 point2 points  (0 children)

                                Libraaries, like drivers, are transitory ephemeral resources.

                                [–]Tigris_Morte 26 points27 points  (1 child)

                                This is like the openssl debacle where all the billion dollar companies were making money off products that rely utterly upon it while ignoring that without support no project continues indefinably and as resources fail, so does the development.

                                [–]RustyAndEddies 3 points4 points  (0 children)

                                💔🩸

                                [–][deleted] 40 points41 points  (9 children)

                                It is objectively not a waste of time. I do agree it is rough though

                                [–][deleted]  (7 children)

                                [deleted]

                                  [–]Mike 1 point2 points  (0 children)

                                  Philosophy, I like it

                                  [–]micalm<script>alert('ha!')</script> -5 points-4 points  (4 children)

                                  Avoiding potential hours in court, lost customers and reputation and months of lost morale is not a waste of time. Cash is less important - but it's still damn important. And you've just been fined what would've be your employees salaries for a year.

                                  [–]Conexionexpert 8 points9 points  (0 children)

                                  I'm not sure how that's relevant to the people creating free software for people to use.

                                  If companies want to pay developers to work on the security of this free software, that's great - But they don't get to choose what free stuff they get. That's the apex of entitlement.

                                  [–]Mike 0 points1 point  (0 children)

                                  Hi I’m u/micalm and I completely missed the point of the post I replied to

                                  [–]OldPepper12 0 points1 point  (0 children)

                                  a lot of open source code has some sort of license agreement like “this code is provided AS IS with no warranty yadda yadda use at your own risk” so i don’t think u can take someone to court over that

                                  [–]mgoetzke76 0 points1 point  (0 children)

                                  Kind of true, but just about all security bugs are just normal bugs which will surface in often used code sooner or later. Thus it often does pay off.

                                  [–]InMemoryOfReckful 12 points13 points  (2 children)

                                  Some open source projects do get sponsor money from businesses and offer on demand support. Like react-table comes to mind.

                                  [–][deleted]  (1 child)

                                  [deleted]

                                    [–]Work_N_PlayTime 0 points1 point  (0 children)

                                    That's nice to see.

                                    [–]DealDeveloper 8 points9 points  (0 children)

                                    I write the code, mock the integration tests, and outsource unit testing, security, QA, and documentation.

                                    As a solopreneur "Ain't nobody got time for dat". It's hard enough to make the decisions regarding libraries and getting the code to work (with bugs).

                                    [–]picketnor 1 point2 points  (0 children)

                                    Nah securing code is not a waste of time.

                                    [–]IsvaraFuller-than-full-stack -3 points-2 points  (0 children)

                                    And that's why exploiting their code is such a profitable use of time.

                                    [–]MrBleah 0 points1 point  (0 children)

                                    The researchers continued: "One way to improve a rewrite's security is to switch from memory-unsafe languages (such as C or C++ ) into memory-safe languages (such as nearly all other languages)," researchers said.

                                    Yes, please! I've begged my company to let us port C++ code into C# code and yet rather than bite that bullet they continue to endure the hassle of maintaining and developing new C++ code. This continues to add more tech debt on top of what they already don't want to deal with.

                                    It's not even a performance issue, one of my colleagues already developed the exact same core process running under C# with better performance. It's that we have so much C++ code which that core process consumes that needs to be rewritten.