Hacker News Reader

Comment by beervirus | Hacker News Reader

And when the Nebraskan sells the project to a scammer, we’re all in trouble.

Can you do that? I'd be open to selling an open source project that gets over 1M monthly downloads. I can't seem to monetize it otherwise.

EDIT>> "Can you do that?" meaning, "Can you sell an open source project?" Not "Can I sell to a scammer?", for people accusing me of planning to commit a crime.

Please don't... we already had our scare in the past when someone handed over the JS project for something to a third party and broke the internet.

"please don't" doesn't pay the bills. You want those people to avoid transferring the reigns for cash? Find some sustainable way to pay them. No amount of feel good platitudes will do that.

Crime isn't supposed to pay the bills either. You have no right to give away a gift and the bulglarize anyone who accepts it. If you don't want to give your work away, put a protective license on it.

While the above case is (arguably) crime. In general crime is unrelated to this issue.

As for licensing: totally agreed. I would like to see more projects with protective licensing.

Too many projects are basically donations to Amazon.

I think daenz was asking about how to sell an open-source project in general, not in a criminal way.

Could you fork it to a closed source "premium" version and implement some high-demand features?

In case you missed it, https://news.ycombinator.com/item?id=23613719 talks about github sponsors

A while back, the node event-stream package was compromised when the author passed ownership to a hacker. Not for money afaik: https://gist.github.com/dominictarr/9fd9c1024c94592bc7268d36...

Ownership was passed to a contributor who showed no signs of being a hacker until they were added as a maintainer on the project, unfortunately.

Publicly announcing your intention to commit fraud is ill-advised.

See the updated comment addressing this bad-faith accusation.

Before your edit, it was not at all clear that you were talking about selling to people who aren't scammers.

I think there is a market for selling rights to browser extensions. Someone I know with a mildly popular extension got offered $10K by a buyer to completely take over.

This market might be one of the reasons why extension API powers have been scaled down.

Yep, it happened quite a lot. The most famous example probably is Stylish.

> EDIT>> "Can you do that?" meaning, "Can you sell an open source project?" Not "Can I sell to a scammer?", for people accusing me of planning to commit a crime.

Probably not. I can only think of two reasons someone would buy it: to do something not allowed by the license or to distribute malware.

If you have say copyright on an AGPL-licensed piece of software that a proprietary vendor wants to use/sell, maybe you have a shot at the former. I don't have any experience with this but it's an above board thing to do anyway.

Otherwise, I can't think of a legitimate reason for someone to be willing to buy it for a significant sum. They can always fork for free if they just want to make improvements and distribute them. If it's important to them to take over the existing name/url/credentials it's probably to put in something that users don't want...

Haven't heard of people selling successful open-source projects, as it's kind of a contradiction.

If you don't want it and stop maintaining it, motivated people could presumably fork it and maintain it themselves rather than pay for it... but I guess you're also buying the community

You can sell access to the update mechanism, repo, and domain name (and any trademarks you have registered), and any rights to relicense the software you have (not necessarily those of other contributers). For most intents and purposes this is selling the project. You can't rescind an open-source license retroactively, so the value of trying to buy such a project and turn it into a system with a proprietary license is probably low. Most users (and especially contributers) of open-source projects would see such an action as a breach of trust, so such an action is likely to result in a hostile fork even if the new 'owner' does not do anything actively malicious.

In practice, that doesn't happen often enough to be something I actively worry about. I scan my dependency's source code each time I upgrade, and that's enough for me.

The number of dependencies I've had fail in that manner is currently 0. Also, all my open source dependencies have their source-code reviewed regularly by distro maintiners (like debian's), and the last version's source code is available in source control, or at worst in a distro's src tarball mirrors.

However, on the flip side, the number of dependencies I've had break because they're maintained by a large company, and that company pivoted in some way, or reworked everything, or in some cases had the code calling into their proprietary backend via some api and broke their api... that number is in the dozens to hundreds.

Using a dependency maintained by an entire company vs by a single contributor doing it in their spare time... Well, the company-maintained ones have a much worse track record for me so far.

>> Well, the company-maintained ones have a much worse track record for me so far.

This made me want laugh, then cry. Both because it's often true.

version 10.0.0.1: local config and data files backed up to cloud

(this actually happened to an ios app I had years ago - gas cubby - one day all the local data about your car - vin number, insurance info, mileage and more became cloud based overnight)

Reply on news.ycombinator.com