Comment by glangdale | Hacker News Reader

Comment by glangdale | Hacker News Reader

It's true. Companies are amazingly reluctant to pay developers to support open source that is absolutely critical to their business operations. As a result they don't have a leg to stand on when code that they rely on - but don't pay for - doesn't work. You know all those crazy disclaimers about how this code MAY NOT BE FIT FOR ANY PURPOSE WHATSOEVER IN PERPETUITY PLEASE DON'T CALL US IF IT KILLS YOUR DOG AND BURNS DOWN YOUR HOUSE? That's the level of support that a lot of companies are willing to go for.

We developed a library for regex matching used in a lot of security products, and I was always blown away by how little support people seemed to want/need once it was open sourced. Support contracts? Follow-up? Feedback of any kind? "Nah, we're good".

As a corollary of this, companies that don't even acknowledge the open source that they use or provide feedback have only themselves to blame if the developers of those projects aren't recognized for their work. If you do OSS development at a BigCo, and no-one bothers to tell your management that they are using your stuff, it's pretty hard to make the claim that the development is still worth funding.

It is possible to look at this from a different perspective. Paying a grant to a couple of developers may be a nice thing to do, but you still don't get a contract with any guarantees.

Paying a shitton of money to established company like Red Hat, on another hand, gives you a contract with liabilities and all other stuff that you'll be able to lean on - and cover your ass with, if need arises.

> Paying a grant to a couple of developers may be a nice thing to do, but you still don't get a contract with any guarantees.

We started polyglot.network for exactly this reason. It's an external development agency that works on the FOSS features/bugfixes that you care about. By having multiple customers, it can distribute the costs (which would not be possible if you tried doing the same work in-house).

So, you essentially pay 1/3rd for a developer seat but get 2/3rd of a developer's output. The buffer exists because open-source projects have some inherent risks. You might want a library/framework to implement a feature, but the upstream may not be willing to merge their PR: Either to protect their commercial interests, or philosophical differences.

We've been working with a few companies and have started contributing to a few Clojure, Python projects already. We work with a community of developers working remotely, and hence, have talent available at almost all languages/frameworks (hence, "polyglot.network").

Fair enough, but we floated the idea of support contracts (with a large company, not a tip or grant to a couple of developers) and still didn't get much interest. As far as I can tell companies are not offering contracts or asking for guarantees either.

There are clearly exceptions. Red Hat is obviously one, as are many successful OSS companies. But a lot of those companies play hardball with dual-licensing - so if you want it for free, you better love GPLv3! :-)

You were blown away by companies not wanting to enter a support contract with every little library they use?

And remember you are talking there about software, not infra. Software companies have tons of developers in-house. They probably don't need your support when they can figure out stuff themselves.

Maybe it was simply a bad business decision to open source a regex library and expect to get paid for giving "support".

You seem to know a surprising amount about (a) the significance of a regex library to security companies and (b) the business reasons for open sourcing it. Perhaps you were there at Intel, or one of our customers, and I just don't recognize your Hacker News id?

To fill in: many security products put almost every packet on the wire past our library, sometimes multiple times. This wasn't a product used to, I dunno, validate user fields or something. Companies used to build hardware to do this, many of which are now pushing up the daisies (I like to think in part due to our work), and we got quite a nice acquisition out of it (while still open source).

I actually expected $0 from open sourcing it and was not surprised - the business reasons had absolutely nothing to do with direct revenue (which honestly would have been an enormous hassle to collect). I was still wowed at how standoffish a lot of our customers were (to the point of having 'secret' customers we found with detective work). My real complaint wasn't about money, it was about companies giving pretty much zero recognition to OSS groups at other companies upon use of their s/w - they shouldn't be surprised when, as a result, the infrastructure they depend on rots away.

But hey, they can "figure stuff out themselves". Maybe...

Your point is well taken, and what I suspect is the issue is something that I learned quite a while ago: people just cannot value what they get for free.

That’s not a statement of moral or ethical anything, just a impartial statement of a basic generalized truth.

> it was about companies giving pretty much zero recognition to OSS groups at other companies upon use of their s/w - they shouldn't be surprised when, as a result, the infrastructure they depend on rots away

Why would they care? Businesses were happy to pay these hardware companies that you deride for their devices, they're more than happy to use your library as long as it is gratis, and they'd be perfectly happy to pay other companies for replacement software if your library stopped functioning or ceased to exist.

The broad adoption of FOSS has nothing to do with ideology or community and it never did. FOSS is widely used primarily because it is gratis and frees up money to be spent on something else.

Uh, so they will be perfectly happy to pay for something (not to mention change their code and go through the fun of dealing with contracts) they were previously getting for free - rather than, say, send a nice email to a private address or some relationship manager. Yes, this makes total sense.

There sure are a lot of HN folks out there who apparently understand the ins and outs of corporate OSS way better than I do. Apparently I'm a wide-eyed naif who thought that OSS was all about community, and need to be set straight by one HN cynic after another.

Reply on news.ycombinator.com