Hacker News Reader

> Why does one have to make money with open source? Why does that have to be a goal in and of itself

Money is air... without money good luck competing against other technologies.

I find that the OSS community is insanely naive about where OSS comes from.

There's this assumption that it just comes for free like manna from heaven.

I seem HN geeks (saying that in a good way) say how they want to use Firefox vs Chrome because Firefox is somehow less evil.

But where does Firefox get its money from? Google. Google gets its money from ads.

If you track down the source of all the OSS we're using there's some root source that most HN people would not be too happy about.

And the flip side is also true too.

I often hear people complaining about how they don't want to pay for apps and expect things to come for free.

This REALLY screws over a lot of ISVs that are literally just trying to build cool apps.

This is really a tragedy of the commons that we don't address very often.

Most billionaires have figured out some way to exploit this issue - much to our collective disadvantage.

So much this!

At first the huge corporations saw OSS as a threat. Their model had been to spend money building software, then charge people for that software. Competing with $0 software scared them and caught them off guard.

Now the corporations and VCs figured out how to use OSS as a weapon. And it’s a deadly one!

The developer insistence on everything being open source means that it’s very easy for a large corporation to destroy a whole lot of ISVs by just releasing an OSS equivalent. VCs know this too.

OSS is used as a PR tool. Projects like React and Angular go a long way to making the parent companies look developer-friendly, even though many developers would normally consider those company’s missions against their values.

OSS is also a powerful way for corporations to commodotise their complements. You see this with the cloud vendors jumping behind Kubernetes to ensure Docker wouldn’t be the next Oracle.

Developers expect everything to be free and open source. We’ll end up in a world where the only programming jobs left will be at the corporations who weaponise OSS the best.

>Developers expect everything to be free and open source.

Considering that before "OSS" was big as it is now, many companies would refuse to fix their proprietary shit even if we were paying, fuck them. Even now the proprietary software I have to integrate is often basement level outsourced to 200 consultants trash. If anything, open source filters companies out those that are at least proud of showing their work.

Just because Mozilla and Google are both predominantly funded by ads doesn’t make them equivalent. It’s not naïveté that leads OSS supporters to believe that, it’s a focus on multiple factors, money is an important factor but it’s not everything.

There’s a reason Linux has been so successful even when Microsoft was vehemently against it with incomparable funds.

"But where does Firefox get its money from? Google. Google gets its money from ads."

That's so overly simplistic. Google tries to spy on everything you do. Mozilla limits their ad revenue to an activity where people are actually looking for something by giving info to a third-party, surveillance (err search) service. They also let you easily change it with a private one built in. They're also owned by a foundation aimed at doing good vs a publicly-traded company that seems to get more evil over time.

So, using and investing in Firefox exposes you to less risk, creates less evil in short/long term, and possibly does more social good. It's an objectively better choice for folks concerned about surveillance-based businesses.

> I seem HN geeks (saying that in a good way) say how they want to use Firefox vs Chrome because Firefox is somehow less evil.

> But where does Firefox get its money from? Google. Google gets its money from ads.

> If you track down the source of all the OSS we're using there's some root source that most HN people would not be too happy about.

I use Konqueror, most of whose money comes from EU grants. I consider that a better source, and (not coincidentally IMO) it seems to result in a higher-quality codebase and a nicer program.

Who do you think pays for Debian? More generally it seems like while most US projects are corporate-funded, this isn't true for European OSS. A lot of OSS originates in (usually publicly-funded) academic projects and/or direct volunteering. Of course, those projects don't have the advertising budgets of corporation-in-all-but-name style OSS.

Why does one have to make money with open source?

Making money is really a shorthand for sustainability. If developers aren't paid, their code can easily fall into disrepair which hurts all their users.

Out of curiosity would the GPLv3 at least force providers like Amazon to release any modifications they make to FOSS stuff to turn it into a hosted/managed service?

They may not make any modifications and those modifications wouldn't contribute to sustainability anyway. Developers can't eat contributions, so if a project is going to have any full-time developers then money needs to enter the system somewhere.

If all their users are threatening to switch to some AWS managed service because it is better for them, then perhaps the software should fall into disrepair and the developers should get other jobs. There isn't anything wrong with this, it happens all the time.

It's probably true that Amazon is able to accomplish this only through strong-arm tactics, but it also seems unfortunate that Redis Labs feels the need to resort to similar strong-arm tactics in retaliation. It doesn't invite anything besides more pressure from Amazon and companies like it. Nobody wins in this in this scenario, especially not the customers who now have no refuge because both competitive offerings are trying to rope them into participating in a turf war.

What jobs? How can the developers get other jobs if no one is paying for their open source software in the first place?

I don't understand, there are still lots of companies that fund FOSS. Publishing FOSS doesn't mean you can't go out of business, it means customers get an additional layer of protection from you going out of business or deciding you don't want to be in a certain market anymore, as Redis Labs has clearly done here.

Sure, those companies make money, ergo why people want to be able to make money while working on FOSS.

It's a free-rider problem - if large cloud companies fork every successful open source infrastructure project, don't contribute back, and pull away a significant chunk of users, then there's a lot less incentive for other companies to invest in future open source development, because they'll have fewer users and get fewer code contributions.

Potentially that shifts things from a good equilibrium where everyone reaps the benefit of many people contributing to the same projects, to a bad equilibrium where every major cloud player develops closed-source products separately.

I don't think it affects all open-source projects, particularly not small ones or ones where some is scratching their own it. But it's hard to build certain types of complex production-quality infrastructure without full-time employed developers working on it.

> If developers aren't paid, their code can easily fall into disrepair which hurts all their users.

I agree with you, but I also work in a place where we operate 35 year old medical software that hasn’t needed a change in more than two decades.

I know that’s unique and most of the stuff we build today will be out of rotation and obsolete in 5 years, but maybe we should have a conversation about the sustainability of modern software?

I work in the public sector by the way, we operate around 10 different open source projects where I work, and we generally want them build to need as few changes as possible because developers are expensive. We do build for the web, as so many others, but we’ve actually achieved a ton of sustainable by using old slow moving techs like Django rather than more modern stuff.

The simple truth is that we wouldn’t be able to afford open source software if we build it like most people build software these days.

> Making money is really a shorthand for sustainability. If developers aren't paid, their code can easily fall into disrepair which hurts all their users.

I agree, for many, though not all, developers and projects. Crucially, a lot of folks who can't currently afford to do free work for reputation or personal edification can't currently afford to release open source.

But I also think the money point emphasizes how unfortunate the term "sustainability" is. Typical software businesses don't seek sustainability. They seek profitability. Why should the developers they depend on settle for getting by?

"Profit" has a corporate, rent-seeking connotation to it. In my own side projects and writing, I've come to prefer "gainful", as in "gainful open software development".

> Out of curiosity would the GPLv3 at least force providers like Amazon to release any modifications they make to FOSS stuff to turn it into a hosted/managed service? With things like Apache/BSD/MIT, does AWS currently mod stuff without releasing the results as FOSS? (Is Aurora DB really modified MySql or MariaDB under its core?)

Aurora is absolutely a fork of MySQL; they're careful never to explicitly admit this in most of their documentation and marketing but their CTO's blog[1] links to a paper that mentions "obtaining significant throughput improvements over the base MySQL code base from which we started," and given how tightly they mirror MySQL with things like version numbers and goofy configuration flags that only exist for backwards-compatibility reasons, it would be hard to believe they built it from scratch.

GPLv2 and v3 both allow this because they only require source modifications to be made available when the resulting program is distributed outside one's organization. Since the public only ever talks to an interface and never obtains the binary, Amazon doesn't have to redistribute. This is not true of the AGPL, which has additional redistribution requirements meant to prevent (what copyleft activists perceive as) this kind of abuse.

There's an argument that since Amazon's changes are focused around integrating the storage layer with their particular infrastructure, the general public would find their changes useless even if they were to be distributed. Personally don't think this is terribly relevant to the larger discussion around licensing, even if it's true.

[1] https://www.allthingsdistributed.com/2017/05/amazon-aurora-d...

Good points. But regarding:

> This is not true of the AGPL, which has additional redistribution requirements meant to prevent (what copyleft activists perceive as) this kind of abuse.

It's important to note that the "kind of abuse" AGPL is fighting is denying the end user the four freedoms. Eg freedom zero: if Amazon shuts down aurora, you lose the right to run the program.

Upstreaming of modifications is kind of orthogonal to the GPL licenses - sure if A sells a program to B under the gpl, B modifies it and sells it to C, C will have the [ed: new and modified] source and may give it to anyone - including back to A.

But the main thing gpl tries to enforce is that C will be able to use and improve the program as needed.

The AGPL is a reaction to the rise of rent-a-program (SaaS etc) - where the user has very few of the four freedoms guaranteed - both if the provider goes bankrupt, and if the provider makes changes.

> Upstreaming of modifications is kind of orthogonal to the GPL licenses

Correct. And well put.

> It's important to note that the "kind of abuse" AGPL is fighting is denying the end user the four freedoms.

But which end user would that be? The end user of the licensed program is Amazon. They're the ones running the program and using it to provide database services to their customers. Those customers are end users of Amazon's database services, not a particular piece of software.

There are generally useful software projects that require initial investment of time and expertise that exceed what can be realistically achieved as a hobby for a first version. Most of the gaps in open source are software systems of this type.

If you need a type of software system that requires 100k LoC of high-expertise code to get to a Version 1.0, you will need to spend millions of dollars. You can neither recruit non-experts to do a credible job, severely limiting the pool of people that could contribute in practice, and most people with a day job will be reluctant to spend the additional time required to write tens of kLoC of difficult, production-quality code -- man-years essentially.

And this ignores that most "high-expertise" software designers are prohibited from working on open source versions of what they do separate from their paying job. This is the reason, for example, that the myriad exotic high-performance database engines don't have open source equivalents -- only a handful of people know how to design those systems and their closed source work precludes participation in open source. But even if they could, the level of individual effort required will exceed what they are likely to want to do for free.

My dream for how to make money with open source is to create some software that is useful to people and then have a subset of my users pay me to implement, modify or maintain it for their specific purposes (example: "My accounting department would like quick books integration I'll pay you to add it in"). Given that i'd be the creator I should be the worlds foremost expert on it by default. Maybe that's naive?

I did this for 10 years, 2 years as a freelancer (barely getting by) and 8 years as an employee. The project has now completed its lifecycle.

You don't have to be a founder, you just need to be an expert. In terms of career development, I think the ROI is better on joining an existing project. But "progress depends on the unreasonable" and some people become founders nevertheless.

I did this -- working on open source founded by other people, from Bugilla to GNOME -- for two decades, and my experience is similar. Contract work is available for customizing open source broadly, and pays well, but it has all the common downsides of contract work. Notably, it conflicts with the growth-driven VC model which is where open source has ironically become a cornerstone.

This is possible. Folks have done it. But consider that by releasing the open source under permissive terms, like MIT, anyone else can come by and do integration/adaptation work, too.

That leads to a kind of cross-purpose incentives. It won't be in your interest to make the code easy to understand or adapt. It won't be in your interest to document how you go about fulfilling those needs. You may face conflict in promoting the availability of your own services through documentation or other materials about the open source project.

These Redis modules were originally using the AGPL. From what I understand the issue wasn't that they didn't have access to the modifications but that they provided it as a service on AWS which is what Redis Labs also offers.

> Why does one have to make money with open source? Why does that have to be a goal in and of itself.

Because we need money to live in our society right now.

I don't think GPLv3 will help, You need AGPL or even more aggressive licensing.

GPLv3 prevents TiVo, AGPL prevents AWS.

Puppet has an Apache licensed community edition, and they make money just fine. RedHat, Canonical, and so on.

AGPL doesn't prevent AWS, AGPL forces AWS to be open with their changes.

Which I think is better. You might not enable FOSS devs to make much off their work, but you at least force companies to contribute.

I think AWS would still rather do what they did with DocumentDB.

> AGPL forces AWS to be open with their changes.

Unfortunately, AGPL is full of loopholes, which are emerging now, because large enterprises with access to specialist legal talent are putting the microscope on licenses for projects like AGPL MongoDB.

https://writing.kemitchell.com/2018/11/04/Copyleft-Bust-Up.h...

MongoDB's counsel mentioned this directly in their statement submitting SSPL to OSI.