Hacker News Reader

Comment by mushufasa | Hacker News Reader

This seems like it's needed and (dareisay) overdue?

Integrating sponsorship subscriptions into the core experience is sure to increase payments, a la twitch subscriptions/payments (which Youtube is just now copying).

I imagine this will change the fundamental dynamics around OSS projects, but not sure how, nor whether it is all positive.

- If maintainers can see who donated, do they prioritize issues / pull requests? (I think that could be a good thing actually).

- Do companies use GitHub sponsorships to judge the health of dependencies? Will they create budgets to support their dependencies systematically?

- Does this hurt FOSS contributions, because now people start to expect to be paid rather than doing it for inherent motivations? Will this generate toxic politics among project contributors regarding who gets credit + gets paid?

- Will this mean that microsoft gets a bunch of PII on top-notch developers (have to enter name + address info to receive or send payments), and get much more value from that data than I can imagine?

View on HN

> This seems like it's needed and (dareisay) overdue?

Seems what they are planning to offer is not better nor different than what others already are providing (see OpenCollective or LiberaPay).

In fact, it seems less than the existing options. The existing options are open platforms with open source code. What GitHub is introducing, seems to be a loss-leader (they give free cash away) for the sole purpose of getting attention. It's obvious the feature they are now introducing is not for making the ecosystem better, but to lock the ecosystem harder to GitHub.

> Seems what they are planning to offer is not better nor different than what others already are providing (see OpenCollective or LiberaPay).

It's got a major company with deep and signficant expertise in security, payments, and accouting. A name that people and companies already trust with a raft of compliance all handled already. It might just be me, but if I were to speculate I would guess that OpenCollective and LiberaPay can't quite claim the same. I know that if I want to, I can get a SOC 2 report from GitHub.

These are nor minor administrative details to be brushed aside idly. They matter, particularly to a company keen to ensure that they never have to apologize for a partner fucking up credit card handling or to someone with a corporate card who has to be careful how they use it. These things are major features.

You make a good point. I sponsor a couple of projects on opencollective, but it took an hour or so of reading before I trusted it enough to use. I think if it had been built into GitHub, I would have been much quicker to sponsor.

I agree with diggan’s point too, but the reality is this is likely to get more people paying more open source maintainers. I just wish it could be on an open platform.

> I just wish it could be on an open platform.

It could be. Letting GitHub get away with this without criticism feels like a failure of imagination. They could have done integration of an open platform (heck, even one they created) if they gave a fuck :(

The way I see it, it isn't an alternative to Open Collective that they're after. They've seen that it's fashionable for people to give money based on parasocial interaction. It's sort of like gambling, where there's a dopamine hit, but where the behavior doesn't get you meaningfully more involved with the community, whether it be Twitch, YouTube, or Facebook (just like gambling doesn't make you wealthier). I fell into that trap with Twitch for a while but cancelled all my subscriptions after realizing that my rationalizations for subscribing didn't hold up, and the real reason was the excitement of feeling like I was hanging out with a chess champion. I think there will probably be backlash after some stories of people spending more they can afford on Twitch subscriptions get out. https://en.wikipedia.org/wiki/Parasocial_interaction

It is nice to see people make money doing what they love, but I wonder how much they can really make if people aren't influenced by parasocial interaction.

The motivation for Open Collective of giving back to say thanks is a much more pure one than paying $5/mo on Twitch, of which Amazon gets a huge cut, to get a sense of belonging bolstered by custom emoji and subscriber-only programming.

> It's got a major company with deep and signficant expertise in security, payments, and accouting. A name that people and companies already trust with a raft of compliance all handled already.

Yes, and they are absolutely _robbing_ the opportunity from others to build in this space, when there are already some really capable players who would have gotten somewhere great. This is a total asshole, closed source company approach. The "loss leader" thing feels totally malicious, and designed to starve the open competition. This is classic Microsoft and rolls back all the positive feelings that had been growing about their growing in the right direction. Amazon does the same shit, to starve competition: "Yeah, you've a spot on our system, but we're going to steal every feature and embed our deeper and drive you out."

For a real example of how OPEN companies work together: Balanced Payments was a daring effort to run an open source payment processor. When they wanted a way to fund and support Gratipay, they went in and submitted a pull request to incorporate their own open source payment processor into the Gratipay platform. If GitHub were in the true spirit of open source, it would have engaged OpenCollective in such a capacity.

I am really disappointed about the hooray optimism and lack of criticism in this thread. I feel like we're all failing to engage in critical engagement with this idea and premise.

What kind of critical engagement do you think we are failing to offer? What kind of response would leave you thinking "This person engaged critically with the issue at hand, but still came away with a strongly positive position"?

For my own part, I don't think anybody is owed a position in a space. I also don't think the existence of small players that get displaced by a big player means that the small players were destined to become big players. It's worth considering that LiberaPay and OpenCollective would never have gotten somewhere great. Perhaps they would always have been doomed to be small and essentially irrelevant. We'll never know, obviously, but it's worth considering.

But let's talk about OpenCollective and how Github could have worked with them. Do you think OpenCollective would have passed a security audit? Are they SOC compliant? Could they have handle the scale?

An even more interesting question: has Github ever claimed to be an OPEN company? I'm certainly not aware of such, though of course my knowledge is less than comprehensive. Charging them with failing to be something that they've never claimed to be seems odd.

Yes. Your charge is correct in an important detail. Github isn't an open source company. As far as I can tell they never have been. It's perhaps somewhat less than maximally reasonable to expect them to become one.

For my own part, this enhances my positive feelings about Microsoft running Github. They're making changes to popularize the idea that it's OK to pay developers to do open source, and doing so in a way that lets developers get paid in a manner of their choice.

It could still be an open platform, of course. Someone just needs to be able to do it better than Github. As Dependabot shows, that's absolutely possible.

> I also don't think the existence of small players that get displaced by a big player means that the small players were destined to become big players. It's worth considering that LiberaPay and OpenCollective would never have gotten somewhere great. Perhaps they would always have been doomed to be small and essentially irrelevant.

I think the difference between small and big players depends also on what their goals are. If the goals of (first Gratipay and then) Liberapay are to fund cool people and cool work, it doesn't matter how much of the funding space they take up as long as they're paying the bills and surviving. If the goal of GitHub is to make $$$ on fees, then yeah, they're going to feel like every other platform is a threat to that goal.

IMHO, there is much more space for different multiple funding platforms than people realize.

> It could still be an open platform, of course. Someone just needs to be able to do it better than Github. As Dependabot shows, that's absolutely possible.

Awkward, this literally happened today: https://dependabot.com/blog/hello-github/

(I agree with the thrust of your comment; I just think the timing here is funny.)

That's actually exactly my point. Dependabot did Github security alerts so much better than Github did, that Github gave up on trying to compete entirely.

Which is to say that it's incontrovertibly possible to beat Github at their own game and on their own platform. To the point where even Github agrees they've been beat.

Your comment reads that you're angry at Github for not taking a more open source approach. That's a fine opinion to have, but it doesn't make sense to demonize them for being a for-profit company. They are not robbing anyone of anything.

Starving the competition with loss-leader tactics is not an unbeatable strategy. If, however, you don't have anything to offer other than a run of the mill payment processing platform, then yea, you're going to have a tough time beating someone who can cut costs. They have a feature you don't, you should lose.

> That's a fine opinion to have, but it doesn't make sense to demonize them for being a for-profit company.

Because some people are just born as for-profit companies?

Labels are useful to classify behaviour, but that doesn't automatically excuse that behaviour.

I guess our perspectives are different. You seem to see this from GitHubs point of view, I'm seeing it from the view of open source developers. Both perspectives are equally valuable.

I agree that our perspectives are different.

I see this from the perspective of someone who wants to see developers get paid. Safely and securely, in a way that makes it easy for them to get paid the next time too.

I'm also looking at this from the angle of "What non-nefarious reasons would GitHub have for making these decisions?". One of the first that sprang to mind is credit card security, which touches on quite a few issues at once.

Further, my experience is that most of the time decisions that can be interpreted as being done for nefarious reasons were rarely actually made that way. I am willing to extend the HN-guideline principle of charity to GitHub, especially because I can see clear, real, valid reasons for standing up their own service over a partnership with a third-party service. I understand that some people will find these unconvincing or decide they are just a ploy.

I haven't even touched on AML or KYC issues!

You are definitely right about the importance of infrastructure made entirely of open source software. My perspective is, in essence, that there are other features that matter that may not fully live in code.

   What non-nefarious reasons would GitHub have for making these decisions?

GitHub is owned by Microsoft now- they can afford to do this at a loss / zero sum amount because Microsoft thinks it's a good idea.

As long as Microsoft is being altruistic here, we should be fine.

I think.

I think the key perspective here is that of “the average GitHub user who mostly ends up there in the process of attempting to fetch a library” (a.k.a. to use GitHub as the ecosystem-library package manager of last resort, for libraries nobody bothered to put into an actual package; or for special feature-branches or tracking bleeding-edge development.)

If such users will be more attracted to donating to developers via GitHub itself, than via other systems linked to through the GitHub README they land on, then donations will spike.

And if, at some point, this program becomes opt-out instead of opt-in, then these users might decide to donate to all sorts of people who never considered themselves “open-source developers” but who just happen to slap code up on the internet for free, mostly as a way of proving the provenance of the binary releases they make. For example, developers in the game-console homebrew community, or the Hackintosh driver community, might suddenly see financial support.

And yet the open alternatives don’t seem to have amounted to anyone making a living from open source. Centralizing it offers a nicer UX - it’s not just about feature parity.

I am, using Patreon.

Doing this took ten years of operating as a commercial entity earning respect, and then ramping up my productivity hugely to compensate for earning about a quarter what I'd be making as a commercial entity. On the other hand, it's predictable and steady, whereas operating as the commercial entity proved wildly unpredictable and stressful in a whole different, darker way.

UX is fine but the platform will never give people a survivable income by itself. You need to build a business like any other, and then be able to take a MASSIVE hit to your income for the sake of your principles.

I'm happy with my choices but other people really can't do likewise. Certainly not from scratch: you wouldn't gain enough traction. I work in the music business. There's a saying, how do you earn a million dollars running a recording studio? Start with ten million. It's a lot like that, and no payment platform is really going to help.

So, for me that indicates that the problem is not that there is any service for making payments, but rather that open source developers who lives on donations, needs to be paid more by more people.

It would be cool if GitHub integrated with existing platforms and helped that to happen. Instead, they signal nothing about this problem and shipped yet-another platform.

They could have easily have contributed to solving the problem for real, but instead go their own way.

From GH’s perspective, why would they create a dependency on an open service (that could disappear at any moment) when they could roll their own? Especially with all the trust issues that come around payments.

Are there any guarantees that Liberapay could even handle an integration at GH scale without it falling over? They opened 900 accounts last month.

GitHub’s promise is something akin to ‘it just works’ - which means that they take care of this stuff rather than give you yet another tool to integrate with.

GH can’t win in this scenario with some people. GH invest in Liberapay, give it a coat of paint, these same people will then complain that Liberapay has ‘sold out’ / gone ‘too enterprise’ (see Chef, Docker) (or the Microsoft variant - Oh noes, MSFT is working with open source tech it must be EEE) and demand that GH integrate with the next half-baked service with a Bootstrap website.

> why would they create a dependency on an open service (that could disappear at any moment) when they could roll their own?

Because by creating the dependency on an open service and collaborating with them, they help them survive long term and to not disappear at any moment.

Yes, it's nice that "it just works" but sometimes the easiest way of doing something doesn't mean it's the right way. Especially when it comes to hard things like "How do we ensure open source developers can get paid?"

Having worked with human beings before, I would say that it is considerably easier and more predictable if you just do some things yourself.

Working with folks outside of your employ (even if you pay them good money to do the work) will fail you far more often than working with one or more of your own employees.

I can't blame GitHub for doing this completely in-house.

Sure, the easy way is easier. But more often than not, the easiest way is not the best way for the entire ecosystem.

Rather than saying "How can we get money moving around on our platform as soon as possible?" they should have asked "How can we make open source work sustainable?".

But who can blame them really, it's a for-profit and closed source company on every level.

> It would be cool if GitHub integrated with existing platforms and helped that to happen

They did that as well today today with support for a .github/FUNDING.yml. This file lets people provide links to Open Collective, Patreon, Community Bridge, Tidelift, Ko-Fi, a custom link and they show up as alternative sponsoring options for a repo: https://github.blog/2019-05-23-announcing-github-sponsors-a-....

Money movements are not just calls to some external API - there's a lot of legal regulations around money movements.

Yeah, but they are Github, so they will clearly win out over those companies I’ve never heard of.

Everyone with a big report for your OSS project is already on your Github page. Its perfect.

The Patreon product is 10% payment processing and 90% the marketing/branding/placement/ease-of-use/trust/normalisation, or whatever it is that makes people open their wallets.

If GitHub Sponsors is stronger at whatever-it-is-that-makes-people-donate, that would be their advantage.

That's the scary part!

OpenCollective for example, being developed via their own platform, need to make sure the platform is sustainable, and can't just throw cash wherever they want to gain marketshare.

The result is a sustainable funding platform that will survive for as long as people fund it.

GitHub on the other hand, can develop the wrong features, spend too much, give cash away and a whole bunch of other things, while not actually achieving sustainability in itself in the long-term. Microsoft will cover all of this, until they wont.

But GH in this space will mean OSS developers will start to get paid for real, the phenomenon will grow and become standard and expected, and if GH stops doing it, the need for it will be so clear and people's expectation of having such a product so strong, that any drop in replacement service will instantly convert most users to their platform.

GH right now is growing the market by bringing millions of eyes onto this problem. The same as Patreon did. And if Patreon dies today, do you think no one will bring up an alternative? And that supporters won't transition with creators to that platform?

It's the same idea as Paypal creating and growing the e-payment system. Down the line, the market of e-payment has grown enough and is legitimized enough that if Paypal was to stop service, there'd be plenty of alternatives, and people are already using plenty of alternatives.

OpenCollective and the likes haven't been growing this market the way GH will be doing, and the result is only a net positive for OSS and developers.

I have never heard of OpenCollective, but I have been using Github for 10 years. And “collective” in the name scares me because it makes me feel like it’s a bunch of street artists squatting in a warehouse in Oakland — perhaps fun and nice people, but not the type of people I’d want to trust with distributing money and compliance.

More options is better in this case.

> Does this hurt FOSS contributions, because now people start to expect to be paid rather than doing it for inherent motivations? Will this generate toxic politics among project contributors regarding who gets credit + gets paid?

I'd also be concerned about features being implemented because there's money behind it, forgoing more important technical reasons.

Of course there are many projects that already implement this 'quid pro quo' development strategy, and open source projects with big corporate backers. How do these projects currently handle monetary influence in their decision making?

> Do companies use GitHub sponsorships to judge the health of dependencies? Will they create budgets to support their dependencies systematically?

In my past I've worked with multiple places that absolutely loved open-source. Because to them it was "free". Something they could use in their products and then charge customers for. Often these opportunistic parasites would never contribute anything back; going out of their way to work around missing features or bugs rather than trying to fix or contribute towards the codebase.

I doubt that these companies now, despite depending on such OS, would pay paying money/contribute; no matter how administratively trivial it became.

I've also worked at multiple companies where they were afraid of open source because the project might be abandoned.

They would happily pay thousands for a closed source dependency because they could guarantee it would be supported.

This could offer a nice medium where a company can be pretty sure that it will stick around (based on funding) and contribute to make sure that it does.

I like open source software projects and use them extensively on behalf of my employer. I care that they are healthy.

That said, there is a huge difference between getting authorization to spend company money on a subscription or support contract (easy), vs. getting authorization to donate company money to a person, informal group or nonprofit (extremely difficult).

A license or support contract is easy for the lawyers to understand, easy for procurement to understand, easy for finance to understand. That's how work gets done at a corporation, and they do those types of deals all day. Depending on the amount, I can sometimes turn around approval in hours.

A donation is not "how work gets done". It has no strings attached, which looks scary to lawyers and finance and PR folks. In my company at least, donations have a separate approval path that loops in the PR and corporate citizenship folks... and they want to see that money go to something fuzzy and feel good, like a charity. "Donations" is a line in the budget; it's not a big one and it's not mine.

So, I still think that the way forward for open source projects who want financial support from companies is to organize somehow (incorporate, nonprofit, etc) and sell support subscriptions. This aligns very well with how the corporation manages other dependencies, like office space, phone service, etc.

> Often these opportunistic parasites would never contribute anything back

So a user of open source to make money is a parasite? Are people that use LibreOffice to type legal documents they charge money for considered parasites if they don’t contribute to source code or financially to LibreOffice? If that’s the case, there is an incentive to use closed source software and just pay for it so as to avoid having to be called parasites and incur the pontifications. How many people here use Postgres but never contribute to it? I might guess it’s 99.99%. If I am running a business and there is an expectation that I pay for open source either in time or money, then that makes it no different from a cost perspective than paying for closed source — which lowers the incentive to use open source in the first place. “It’s free software, but if you use it for free, you’ll be called a parasite.” Sure. That’s a great way to promote open source. If open source people want to get paid for open source, then charge money for it, don’t simply use a passive-aggressive guilt trip, just be upfront.

Yeah I disagree that the users have to contribute something back. Half the value of a project comes from the users. The other half comes from the developers. If no one uses your software then it's worthless and it wouldn't matter if you spent all day playing video games instead. If someone else does end up using your software and builds a business around it and you don't like it then you should either start a business yourself or alternatively think of your work as returning the favor to all the other open source developers who have worked for free and will benefit from your project directly or indirectly by making proprietary software cheaper.

> Does this hurt FOSS contributions, because now people start to expect to be paid rather than doing it for inherent motivations?

I think having donatiom payments integrated with the platform will shift the motivation of programmers from intrinsic to extrinsic one. The design seems to show a call to action to 'sponsor' right in the github profile. That's a big emphasis.

Will such shift 'hurt' the FOSS contribution? I'm not sure because the answer depends what we mean by 'hurt'. But I fear that it's not going to be quite the same.

Interesting. I agree that it's not going to be the same, but I welcome that. Currently open source is just a tool for big tech to advance their agenda.

I think this is a brilliant move from MS. They gain goodwill and at the same time help shift expectations of OSS developers towards being paid for work. Given that both of Azure rivals are using FOSS extensively, while MS is not (much?), this could help weaken the rivals.

The reason I welcome this is that too often OSS is simply not good enough and would be (imho) much better if developers were paid for their work.

It wouldn't surprise me if maintainers suddenly start ignoring issues from non-sponsors because they can't handle all of them.

> If maintainers can see who donated, do they prioritize issues / pull requests? (I think that could be a good thing actually).

This is one step away from consumers being able to put bug bounties on issues too

> If maintainers can see who donated, do they prioritize issues / pull requests? (I think that could be a good thing actually).

This actually seems like it would be terrible. Contributions should be evaluated on merit, not on bribes.

The overall concept seemed good at first but you raised some real concerns.

Sometimes fine PR'S just sit without review or merging because the maintainer is busy with their life. If some money rewards them to look, great.

How so? If anything, it would be cool to have issue bounties to put your money to get the stuff you want solved.

For the same reason lobbying is harmful. The many should be served, not just those who can pay.

Reply on news.ycombinator.com