Hacker News Reader

I'd be willing to guess that the vast majority of applications (if not all) dependent on core-js are pulling it in as a transitive dependency of something else-- most via either a direct dependency on `@babel/preset-env` or indirect dependencies on the same through scaffolding projects like create-react-app.

That leaves core-js in a position where it's kind of invisible-- projects like Babel are very visible and pull in a decent chunk of cash via developer donations and corporate sponsorships. Core-js, on the other hand, isn't something most developers ever deal with directly-- if you don't go and dig through your dependency tree, you may never even know it's there. Until it starts making noise in your console on 'npm install', at least-- and then it looks indistinguishable from spam, from something you never even explicitly installed, no less.

>It's not like when a company the size of Spotify uses core-js they just add it to their project without thinking. No, they know how important the project is.

The devs at Spotify know how important that project is. But the people who control the money, middle and upper management, might now even know what Javascript is. Why would they spend money for something that's free? They're under pressure to cut costs anyway.

Throwing dollars at MS or Oracle, on the other hand, is nice for managers because you get service, accountability, responsibility, guarantees, and lawyers to talk to for that money. Money is paranoid. Open source can't give you that, it's always only one poor coder.

> Why would they spend money for something that's free? They're under pressure to cut costs anyway.

But isn't this like saying, "what's an AWS? Why do we need that thing?"

Is there really no one technical saying, "look we need to offer support to core-js because core-js is the software that ensures our website works for everyone using it".

And you're a large company who project depends on core-js (like Spotify) it just seems sensible to offer a little support to the project to ensure it continues to be well maintained, and also so if you need anything the maintainers will prioritise you.

Even if your only concern is money, then it probably pays to ensure your software works and isn't dependent on some guy in Russia continuing to make his life a living hell just so your product is functional.

> look we need to offer support to core-js because core-js is the software that ensures our website works for everyone using it

But that's demonstrably not true. In fact, nobody supports core-js and all the big websites keep on working.

It's a bit like 'whoever moves first loses', isn't it? So many big corpos who could pay, but if one would pay, it might be enough. So why should it be your corpo?

AWS provides an invoice structure that accountants understand how to navigate. Open Source mostly doesn't.

I know this is why some of the "contribution bundling" approaches seem to have good merit for big Enterprise that treat Open Source a bit like a "stock portfolio" and bundle a number of open source sponsorships into a single invoice that you can present to upper management as "IT says we need to pay this bill each month because it somehow helps keep all the software lights on" without needing to get into the specifics of which software does what or how much you rely on it (or the complexity of your dependency trees).

I've heard it's a priority for parts of GitHub to make such "automated open source sponsorship bundles" easier to sell to upper management and smarter in how they manage their funds for the good of the open source community and wish them luck in those endeavors.

> I mean, how is this that possible?

The Node.JS library ecosystem (for better or worse) is modeled as small libraries which do only one thing, and often have dozens of dependencies. And those in turn, have their own dependencies.

So when you import a library, you're bringing in a lot of other libraries as well. Some large companies have stringent audits (for licenses etc), but most care (or are aware) only about the library they imported. core-js is probably a dependency for many others, and especially transpiler toolchains which are common in JS.

I completely understand this reasoning for smaller companies, but a company like Spotify will care deeply about the dependencies in their project. Just because core-js is a dependency of a dependency simply doesn't matter and if anything, makes it even more essential. Unless they're extremely incompetent, any 3rd party code that's to be deployed to their entire user base is presumably being reviewed in detail.

And I guess I'm not even sure I buy the argument that most developers don't know about core-js. I know I'd be extremely concerned if I was hiring an experienced frontend dev who didn't know what core-js was. Anyone who's thought about browser capability before should have had to think about polyfills, and naturally their use of core-js. It also comes up a lot when trying to optimise bundle size given the size of core-js.

Your estimate of the competence and thoroughness of various actors in this industry is significantly higher than mine.

> That one guy can contribute code that is used on thousands of the top websites worldwide and not one of the numerous multi-billion dollar companies that use his code are even willing to donate an amount equivalent to an average developer's salary?

Well, every multi-billion-dollar company has a mechanism for paying for commercial software. If they need Windows or Photoshop or Solidworks they're more than happy to pay the asking price.

The problem with open source software is the asking price is zero.

Most multi-billion-dollar companies also engage in some charitable giving. They probably use their entire charity budget every year - maybe they're supporting food banks, or earthquake victims, or cancer research.

But getting the Russian polyfill guy out of jail probably isn't a registered charity. And even if it was - there's a lot of charities out there.

Some multi-billion-dollar companies have budgets to sponsor open source projects. Apple, Microsoft, Google and others donate >$125k/year to the Apache foundation, for example [1].

But that money is spread very thinly - how many developers do you think contributed to, say, a basic Ubuntu installation? And plenty of companies don't budget for this at all.

Some open source projects use options like 'dual licensing' where you have to pay to use them in closed source projects (Qt, for example) or offer support contracts or paid add-on products (Ubuntu Pro, for example)

But it's not like Qt are rolling in cash - or that the community had any great love for Ubuntu Pro.

As you'll note, all these options sound a lot more difficult than just getting a job at one of these big corporations.

[1] https://www.apache.org/foundation/thanks

The problem that a lot of people don't get is that corporations can't just donate money to things like that to be nice. They have accounting and legal obligations, they can't just throw money around for funsies. If you phrase things their way, like selling them a product on contract, you can easily get tens of thousands from them. But a "please donate" link on your site won't get anything.

> they can't just throw money around for funsies.

And yet a single bad/pointless/redundant meeting can easily cost 5k or more in time alone.

Companies throw money away constantly.

Because civilization is a myth and most people are trash. The primary operating principal is exploitation.