Hacker News Reader

Comment by RcouF1uZ4gsC | Hacker News Reader

> To date, he said he had received "no communications whatsoever" about taking over the project. Perhaps, once the word gets out more widely, a qualified maintainer will step forward to take PCRE2 into the future.

I think more and more open source projects will be targeted by intelligence services.

Open source maintainer is a stressful, thankless job which pays peanuts compared to what you could get for the skills and time.

Driven, talented individual who feels they are sacrificing for the good of society and are not being properly appreciated is the stereotype for a person who can be turned.

View on HN

As the person that authored and maintained a fairly important (but obscure) project, for ten years, before handing it off, I can relate to this chap.

For my part, I suspect no intelligence service would really be interested in the project, and, even if they were, I'd not "turn."

Personal Integrity seems to be considered a quaint anachronism, these days, but I do run into folks, here and there, that seem to have it.

But how would you know?

The FSB (say) dont send you a bunch of flowers and a pull request from fsb.gov.ru. We saw from the xz situation that this class of attacker can start out genuinely helpful and use sockpuppets and social engineering over a long period of time to infiltrate projects.

For all we know, (put on tinfoil hat now) there could be committers in major projects now who have spent years acting "normally" to earn trust but are sleepers.

Fair point.

Not so sure that I'd call it "tinfoil." Probably quite realistic.

It's easy for me to say. I write software to support a fairly small, tight-knit, demographic. We all tend to know each other, so trust (or lack, thereof) is fairly established.

Yeah no tinfoil needed, xz was exactly that, except sloppy. We won’t hear about a second attempt for a long time after it’s happened.

For all we know, intelligence services might have already had multiple successful attempts prior to xz so they just got complacent on that particular one.

The problem we have is you can’t prove the absence of something.

Struggling to find it now, but one of the crazier scams I’ve seen was for an NFT company who was making, IIRC, cards.

A person joined their Discord claiming to be a former Ubisoft 3D designer and was confirmed by other former coworkers. They began to ship actual, high quality 3D work as a contractor and earned the trust of the channel.

…and then ultimately tried to drain their wallet at the end. Best they could guess was that the scammer(s) paid freelancers and then presented the work.

Vetting people online is really hard.

> Vetting people online is really hard.

This may ultimately turn out to be a real valid reason for management's "back to the office" push, even if they don't know how to express it or quantify the benefits.

Maybe a suitably talented person can assess strangers skilfully and well face-to-face, but whatever poorly-identified skills they use to do so, they can't do it via a video call or something. And this is without deepfakes and so on.

I'll agree with thankless. But I'm confused about "pays peanuts," because unless you get hired by a company paying you to work on open source software, or have somehow cracked the code to acquiring extremely generous patrons (donations), I would say being an open source maintainer typically pays nothing at all. Which is fine for a lot of us who consider it a hobby and would never _want_ to be paid for it.

I also have to believe that if it's a true open source project (meaning, without commercial aspirations), then any stress must be self-induced. FLOSS authors don't owe anyone features, bug fixes, or explanations. And any that are delivered are totally voluntary.

I totally agree with this but haven’t actually maintained any open source projects. Have you?

For me at least, it is easy to say the, I’m quite sure, objectively correct thing. Open source hobby projects have no obligation to anybody, just release code for fun, and anybody who expects more is the problem and should be ignored.

But there are lots of reports of burnout and stress. So I think there must be strong social pressure that people fall to, despite not having any legal or ethical obligations.

I mean for most of time, all of pre-history, humans got by with informal social structures and a feeling of wanting to provide their friends continued help, despite a lack of a real state or legal framework, and mostly informal ethics. So it isn’t that surprising that people feel like they have a real obligation to users when they’ve been working on a project for a while, right? Helping others is a human instinct.

> [...] individual who feels they are sacrificing for the good of society [...] is the stereotype for a person who can be turned.

Turned towards... something that sounds consistent with the values for which they're sacrificing?

Or is the theory about more of an "f-word these ingrates; I might as well get paid" reaction? Or towards a role that makes them feel important or appreciated?

Would this theory distinguish people doing open source mainly because it's technically interesting to them, from those who are in it more for the community, from those who are strongly motivated by principles?

"Turned" may be the wrong word. "Cozened" might be more correct. There may be no good way for an individual to identify someone who is being paid to take over their project from someone with a genuine interest.

> Open source maintainer is a stressful, thankless job which pays peanuts compared to what you could get for the skills and time

Precisely why Open Source must fund itself with things like freemium. Otherwise its impossible to justify the effort it requires in the long run. Like how the freemium format has been very successful in the WordPress ecosystem and many individual devs have made a very good living by developing their themes/plugins/services and creating sustainable communities around their software - independently without any kind of VC money. It is a good pattern that keeps the control of projects in the community's hands.

>Open source maintainer is a stressful, thankless job which pays peanuts compared to what you could get for the skills and time.

Well, it needs to be something of interest to a company that will pay someone to be a maintainer as part of their day job. Or it needs to be something that someone has built a business around--but, as you suggest, their job is now a lot more than just being a maintainer and, in many cases, they make a lot less than just taking a job at a company.

Reply on news.ycombinator.com