Hacker News Reader

Comment by hooande | Hacker News Reader

Someone should write a package that goes through your existing codebase to see which open source projects you make the most use of (however that is measured). Then a company could run it once a year, say around tax write off time, and build a list to donate to

I would have happily given to log4j, but I didn't know that they were in need. Someone has to make it easy to keep track of this because it's never going to be a priority for businesses

View on HN

An incremental way to get to this would be to standardize the format for payment info in package.json (or equivalent). Then you could build donation into yarn, pip, cargo, etc. Just run ‘yarn donate’ and choose the amount to spread over the packages you use.

This is a half-baked idea right now, but I think there’s something to it. A lot of the issues with open source stem from the friction of donating. Reducing that would incentivize people to work on libraries that are popular but neglected. It would also help devs capture some of the value they create.

Or they could get a list of deps, and just get their engineers to occasionally keep tabs on a few random deps. Random would be almost as good as systematic if a few companies did it.

Check the security of the infrastructure (is it one guy?), check whether some the code is correct (either randomly or systematically, not just checking the first file you see), etc.

What's the incentive? Well, checking your dependencies is a way to upskill. You learn as much reading code (especially the code you are relying on) as you do writing code, and most of a programmer's job is learning.

Stuff like that already exists. Companies barely donate. In my opinion, more packages should require licensing fees from companies.

I like opening the code I write. I don't plan on having two customers paying me $5/mo each for my super obscure piece of code.

Are we really going to blame log4j2 authors who, for all we know, don't care if someone else is using their project?

Because the corporate purchasing system works so well....

I mean, `npm donate` is a thing, I'm pretty sure. Just need to build it for other ecosystems.

More money doesn't always make for better software.

Would millions of dollars of donations over the last decade have caused log4j to not have the vulnerability?

Reply on news.ycombinator.com