Hacker News Reader

Comment by mg | Hacker News Reader

It is interesting, that the lack of a feature that would cost $629 to add is significant enough to make it the the HN front page.

Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are.

There are 152 contributors to this project who wrote 21,686 commits. If each commit took an hour of work, and we value each hour at $50, that is $1,084,300 worth of time.

How can a project gather over a million dollars worth of work time, but not $629 for a certification service?

View on HN

> Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are.

Simple: there is no business model. Open Source is not a business. It is a philosophy and hobby, where people help each other and give away their labor with no expectation of a return.

(Some youngsters that have grown up in the social media age have developed a kind of entitlement complex where they focus more on the popularity of their contribution than its utility; they may be developing it just to see a lot of stars on a GitHub page. But largely it's a community driven by people who just needed some code to exist and then released it for free when it worked)

(Some businesses do release code with an open source license and even accept some contributions from the public, but largely they are doing so for various business reasons and the project is more a reflection of the business than the needs of a community. Since those projects are financed and organized by the business, they tend to end when the business abandons them; whereas a grassroots community project is often just maintained by a new stranger on the internet if the old maintainer gives it up)

I'm not sure whether or not there's an issue of entitlement, but there's certainly incentives to develop a popular package (even if superficially). One big one is career development. For people early in their career, it's something they can proactively invest in, as where they can't magically materialize years of experience overnight.

There is definitely an argument to be made that open source should be viewed and treated as a business model, particularly if there are financial costs involved which must be paid one way or another.

Dogma and fervor don't pay the bills.

Still, high profile projects should be able to raise this type of money with ease.

If they would say “Would match our ‘donation’ and donate $10 each year that we put in $1k in labor to this project?” that sounds like some commercial users would accept. But the first problem with medium scale OSS like this is that it’s no one’s hobby to manage projects or beg for money.

It’s also a problem that OSS contribution/sponsorship isn’t normalized in corporations. I could much easier get permission to buy a $5k piece of software than donate $5 to an OSS project that powers out largest project and has been maintained for 10 years by a single person.

But why should they raise this money?

The unspoken assumption here is that code signing is a good thing. I question this assumption, particularly with how this works today. Microsoft, the cert issuers, and other companies involved in this are trying to create a reality in which software must always be attached to a specific legal entity, and then that entity must be vetted through the "corporate web of trust". That $629 (per year?) isn't paying to access/license a feature. It's a membership fee in that "corporate web of trust".

It's a nice way to disempower users and individual developers, while effectively commercializing the entire Open Source space. "Want to have your open source project to have any users (on proprietary OS-es)? You need to start a company and sign a contract with one of our approved business friends."

As the comments on the issue suggests, $629 is not the minimum price tag. It can be much cheaper without being more complicated.

But I agree Microsoft could probably make it easier and cheaper but I can’t see why they would want that given they want to drive apps to stores and not self publishing. They want the bad method of publishing to have bad ergonomics.

A letsencrypt style signing process would be possible and would let people base the trust on the ownership of company.com instead of a regular cert. And for most use cases this seems good enough.

> A letsencrypt style signing process would be possible and would let people base the trust on the ownership of company.com instead of a regular cert. And for most use cases this seems good enough.

Except it seems that's not what they want at all.

LetsEncrypt works because we've worked out it's sufficient for purposes of HTTPS to attest that "you" own the domain company.com, which is verified by making you do something that can be done only when "you" are in control of what company.com DNS points at. The nature of "you" is immaterial, out of scope - only demonstrating control over a domain matters. This lends itself to automation.

What they want to do with code signing is to pin the code to a specific legal entity. That's crossing from data integrity/provenance straight to KYC/legal space - for users to be allowed to run your code, you must become an entity that can be easily served a lawsuit should the need arise. You can't automate that, for the same reason you can't automate renewing your national ID/passport or automate starting a company.

> I could much easier get permission to buy a $5k piece of software than donate $5 to an OSS project that powers out largest project and has been maintained for 10 years by a single person.

Because business has it's own logic. If you invest $5k in a product, you are expecting the return to be customer support, quality control, timely bug fixing, "enterprise" features, feature request priority, legal indemnification / due diligence, etc. You make a business case to justify the expense, with the expectation that this is going to provide a return (eventually) in the form of revenue, time/cost savings, etc.

Donations in and of themselves don't provide any obvious return. If the project kept a "business case" page that includes what the donation goes to and shows the direct benefits that come from donation, it's much easier to justify the cost. And you might think "can't they just write off the donation?", but the project would need 501(c)(3) status, and it's apparently quite[1] hard[2] to get OSS approved as such.

[1] https://web.archive.org/web/20221201141451/https://opensourc... [2] https://www.mill.law/blog/more-501c3-rejections-open-source-...

When the sole OSS maintainer says “I only got $23 in donations last year so I can’t spend as much time on bug fixes this year” that should be a case for donating $25. Especially if the end of maintenance would instantly cost five or six figures. The thing is that it’s hope that you get support for your $25. Not a contract guaranteeing it.

In the end the easiest option for me is to donate a $25 personally on my employers behalf and be done with it.

> How can a project gather over a million dollars worth of work time, but not $629 for a certification service?

Because the certification 'service' is a protection racket (as in criminal[0] racketeering) by Microsoft.

Millions for defence (or in this case infrastucture), but not a cent for tribute.

0: Since I'm sure some pedant will nitpick this: yes, I'm aware that large corporations have likely purchased legislation misclassifying this as not officially a crime; you know perfectly well what I mean.

By that logic, reading a classic novel such as Anna Karenina would set you back $720. [1]

[1] https://www.readinglength.com/book/isbn-0143035002

Only a very small number of people are ordinarily paid to read Russian literature. The typical observation with OSS is that we would otherwise pay large amounts of money for equivalent labor in the software market.

That’s why you hire a 10x reader at $200/hour.

(Contributions amounting to $1e6 over 33 years, assuming there is no history-losing VCS migration in the statistics you quoted, and a service that costs $630 per year. While 2% of development cost is still not a lot, it’s not vanishingly small, either.)

The economics are probably pretty simple: you can have fun contributing your time to a project, but you can’t have fun contributing money. It’s also easier to get your employer to okay your spending time to upstream bugfixes or even features than to get them to pay money to what’s likely a very vaguely defined organization for a very fuzzily defined service as opposed to straightforwardly buying a thing. (The money itself would be negligible—the accountants’ and lawyers’ time will cost more.)

The classic thing is that "nobody uses Windows". The real thing of course is that many people contributing to various projects end up using some *nix setup. So despite Windows being a big part of many userbases, ultimately maintainers often don't even have a Windows machine, let alone the knowledge to deal with some Windows-specific issues or bugs.

Though here it seems to be mostly a money thing ($629/year is a real amount of "pocket change").

> If each commit took an hour of work

> we value each hour at $50

If you start with fantasy hypotheses like these, you're going to obtain fantasy conclusions.

In this specific case the estimate is likely a vast underestimation of the cost of work.

The cost of work is based on the cost of finding someone to do the work. These people did the work for free. This specific work cost $0. The value the work provides may be higher, and I'd wager that ImageMagick has provided far more than $1,000,000 in value.

Because the contributers do the work (the coding) for fun. If they would need to pay $50 so someone else does the work (the fun part) they wouldn't do it.

It’s principle. A fundamental of the hacker mentality. A hacker will jump through hoops to do something based on principle. Something others legitimately have a hard time understanding. That being said why the HELL is it 629 dollars!?

Reply on news.ycombinator.com