Hacker News Reader

Comment by rubymamis | Hacker News Reader

It baffles me how such an important package that so many Linux servers use every day is unmaintained by the original author due to insufficient funds. Something gotta change in OSS. I think one solution could be in licenses that force companies/business of certain sizes to pay maintenance fees. One idea from the top of my head.

View on HN

> I think one solution could be in licenses that force companies/business of certain sizes to pay maintenance fees. One idea from the top of my head.

Yet people have huge opposition for those licenses. The big scream of "not free anymore" starts and the entity gets cancelled.

I think focusing on big organizations (e.g. above certain revenue/profit should help).

There must be some sweet spot, after all, the organizations that rely on it should want it to be maintained as well.

tragedy of the commons.

If someone else can pay to maintain it, but you get the benefits, then it's the obvious strategy to use.

And also, there's zero evidence that proprietary software won't have these backdoors. In fact, you can't even check them for it!

That's why I think such OSS packages should use licenses that force large companies to pay (moderate) fees for maintenance. I assume such sums of money won't even tickle them.

Imagine 10 large companies, each pay $1000 a month for critical packages they use. For each developer, that's $10,000 they can either use to quit their current job or hire another person to share the burden.

We need to normalize this.

You may as well just slap a "no commercial use" restriction on it. It takes months to go through procurement at the average big company, and still would if the package cost $1. Developers at these companies will find something else without the friction.

Maybe we need a platform to make this easier?

There is already GitHub Sponsors, for example. What we need to change from that?

I’m not an expert on this. if it ticks all the legal and other issues big companies need to deal with in a frictionless manner, then that’s good. If not, maybe a different solution is needed.

You are conflating convenience with necessity. Currently large companies also use xz simply because it is configured to be the default in many distributions. If it charges them money, they will just move to zstd, brottoli, gzip or 7z. The first two are backed by large companies themselves who will not adopt these kind of licenses ever.

Not really. Just make your software AGPLv3. It's literally the most free license GNU and the FSF have ever come up with. It ensures your freedom so hard the corporations cannot tolerate it. Now you have leverage. If the corporations want it so bad, they can have it. They just gotta ask for permission to use it under different terms. Then they gotta pay for it.

https://www.gnu.org/philosophy/selling-exceptions.html

All you have to do is not MIT or BSD license the software. When you do that, you're essentially transferring your intellectual property to the corporations at zero cost. Can't think of a bigger wealth transfer in history. From well meaning individual programmers and straight to the billionaires.

The problem is, there will be almost zero packages that (very few) "corporations want so bad". The only exception might be cloud providers, that want to host your mildly-popular open-source message queue, but, again, if you are Amazon, you'll soon just re-implement that message queue, drop the "original" one, and after a couple of years your mildly-popular project will become not popular at all.

In that case we'll simply end up exactly where we started. There's a twist though. This time around we're not being taken for fools and exploited.

Better to have a completely irrelevant forgotten project than a massively popular one that makes us zero dollars while CEOs make billions off of it.

This post always comes to mind every time this topic comes up:

https://web.archive.org/web/20120620103603/http://zedshaw.co...

> I want people to appreciate the work I’ve done and the value of what I’ve made.

> Not pass on by waving “sucker” as they drive their fancy cars.

That is a really good post from 15? years ago, and still very relevant to this day.

Yeah, I've never forgotten it.

He hasn't stopped blogging either.

https://zedshaw.com/blog/2022-02-05-the-beggar-barons/

https://zedshaw.com/blog/2018-03-25-the-billionaires-vs-bran...

That last link is about this place and covers some abuse he got here on HN over that GPL article. All the way back from 2009.

> It baffles me how such an important package that so many Linux servers use every day is unmaintained by the original author due to insufficient funds.

Is it actually insufficient funds or is it burnout?

I'm not sure. I know from working on OSS projects personally that insufficient funds can easily lead to burnout as well. You gotta find other sources of revenue while STILL maintaining your OSS project.

In the case of XZ it was more akin to burnout based on the literature around the time Jia Tan was instated.

same thing; if you have money you can hire people to spread the burden

The proposed EU Cyber resilience Act positions itself to be a solution. To put it simply, vendors are responsible for vulnerabilities throughout the lifetime of their products, whether that is a firewall or a toaster. Thus, the vendors are incentives to keep OSS secure, whether that means paying maintainers, commissioning code audits or hiring FTEs to contribute.

There's a difference between important and necessary. The package is necessary not important.

It baffles me why something as complex as xz is apparently needed. The code for bzip2 is tiny and would need a small fraction of one person to maintain.

Reply on news.ycombinator.com