I've Soured on Open Source
greaterdanorequalto.com
greaterdanorequalto.com
The concern is not theoretical, as protesters in Hong Kong discovered when "their" phones refused to run software they used to organize: https://www.reuters.com/article/us-hongkong-protests-apple-i...
The FSF is clear on the motivations: A proprietary program puts its developer or owner in a position of power over its users. This power is in itself an injustice. - https://www.gnu.org/proprietary/proprietary.html
The links on that page give many other examples of why free software is necessary.
The secret (IMHO) is keep it simple, so people know what they're getting and can figure out how to be successful.
70M downloads of my oldest project, Ruby unaccent port: https://github.com/sixarm/sixarm_ruby_unaccent
200K downloads of my newest project, Rust testing macros: https://github.com/sixarm/assertables-rust-crate
Open source authors inspire me every day to create, improve, and share. The point isn't money; the point is helping each other learn, explore, and grow.
I personally think open source works the best when it is created by developers working for a company who are writing software that supports, but is not core, to the company’s actual product.
A company decides to allow the developers to open source it so they get free, outside, collaboration and the prestige and publicity of having open source projects.
Ideally, a majority of the contributions will be from developers working on the clock at their main jobs, where they use the open source project.
It is fine if some people contribute on their own time, but the bulk of the work should ideally be paid for by an employer.
I am in the fortunate position where Open Source has been a true life changing community for me. I benefited greatly over the years from it, in both life experiences, jobs and opportunities. However the moment in which a project turns from great and fun to a massive pain in the butt is years after you have first created it and the motivation that originally brought you to it might not be applying at the present day any more.
For me the only sane way out was to pass the helm and recognize that there is no path for the things I have created to be compatible with a business model that makes sense to me. (I built libraries and frameworks)
That itself takes a lot of life experience. With all the experiences I gained about this, I would never go and tell someone that their attitude of feelings are wrong.
That's what I did.
The good news is, the folks that took it over, have added so much good stuff, that my original code is almost gone.
I've written software that was still in use, 25 years later. It gets "stepped on," along the way, and that's actually great. It can be ego-deflating, but I've found the cure is to walk away, and work on something new.
For me, it is.
But YMMV. I write native Swift apps, or Web stuff for a pretty small demographic.
No one will get rich from my stuff.
The only thing required for you to make something FOSS is to make the code public with a FOSS-compatible license. Your responsibility as the author ends there, unless you take it further yourself. You don't owe anyone bugfixes or implementing new features. If they want those, they can implement them yourself.
I don't think it's really morally wrong to just walk away. No different than if you got hit by a bus.
On the other hand, you maybe did create something that people now depend on and walking away is probably causing a lot of anxious moments, possible security breaches, and downtime.
Not sure of the right answer. You did something for free. But shutting everything down one day can cause harm.
This is the mistake of the people who depend on something out of their control, not the person who made some code public, with the promise that there is no warranty, the software is "as-is" and more, which is fairly common in FOSS licenses.
The right answer is for people to start understanding the license of the things they use and depend on, and if "no warranties what so ever" isn't good enough for them, it's up to them to find a project using a license they do agree with.
In the context of FOSS, it's almost always given away "as-is" without any sort of warranties or guarantees. If people end up shooting themselves in the foot even with those warnings, it's hard to feel sad for them.
Yes, those remedies are pretty much non-existent for an open source project but you seem to be making a case that no one should ever use unsupported open source for anything important given how risky it is. There have certainly been companies that would be happy to take that side. I don't personally but you should go in with eyes wide open.
Depends on the country. The countries I've lived in (Spain & Sweden) both have "Small claims court" which you (as a individual) can go through for relatively speedy (and free) resolutions to minor things, and avoids the traditional (slow) court procedures. This might be EU wide, not sure.
> you seem to be making a case that no one should ever use unsupported open source for anything important
No, I'm trying to make the case that people and businesses need to be more aware of what the license of the software they're using, is under.
If the software license says "THE SOFTWARE IS PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND" but you need some sort of warranty, then either find an entity willing to provide that for this specific piece of software, chose another project, or fork it and provide your own warranty yourself.
>but you need some sort of warranty, then either find an entity willing to provide that for this specific piece of software, chose another project, or fork it and provide your own warranty yourself.
Totally agree with this though. As someone who worked for a commercial open source vendor for a number of years, if you're dependent on Linux, Kubernetes, etc. for your business you should have a commercial subscription.
>or fork it and provide your own warranty yourself.
Realizing you're now on the hook to do your own development/support ad infinitum which is usually a bad idea.
If we rely on them so heavily that it'll affect our finances significantly, I'm sure the contract has plenty of penalties if we don't get that support.
But yes, for small one off deals, you could be screwed. And guess what - it's still your job to fix it, just as with open source. Your employer cares for the end results. They expect you to say "OK, vendor X screwed us. Here is plan B."
I really could care less about some corporation's security. If some company being cheap enough to use my software without compensation or testing has it open their systems to people without proper corporate authorization, I see that as a plus. I release software as is, and if they want to try to get blood from a stone and sue me any how, so be it.
Security breaches and downtime are the responsibility of people using the SW - not of the developers.
I rely on a lot of open source libraries for my job. It's 100% my responsibility to pick libraries that I think are well maintained, and find alternatives when there are important bugs that aren't being fixed (that I myself cannot fix).
So what?
There is NO WARRANTY, to the extent permitted by law.
Spreading yourself thin because of some imagined responsibility you're not compensated for causes even more harm. The whole point of FLOSS is to provide everyone enough freedom to let them care about the stuff they use themselves.
Many OSS projects have a community around them that help each other, talk about things, and are cool places to learn about specific things. Of course many used to, and they do not anymore. Things do change over time and that's OK as well.
That's fine. Not everyone has to do OSS. It's similar to volunteering for charity (weak analogy).
Having a project that is all mine, and not being limited by managers, is really important. If I want to learn a new technology, I just write a library to support it [0 - 1].
If it takes off, I find some folks that would be interested in running it, and hand it over to them. I don't really mind, however, if my stuff never gets any GH stars. I write software for myself.
It is not an obligation to maintain the project: Read the license terms.
It is not an invitation for others to contribute, though many projects welcome bug reports, feature requests, and contributions.
Rich Hickey's "Open Source is Not About You" provides some great thoughts about it: https://gist.github.com/richhickey/1563cddea1002958f96e7ba95...
I do question the kind of "open source project takes over the world" model, the GCCs, the Apaches, the Linuxes. Those projects are of great importance, so even if you have a small group of contributors the responsibility is still large and weighty. It's even more so if you've suddenly got a huge community to manage. That kind of thing feels a lot less like a hobby and more like either a job or a lifestyle (e.g. you hang out in an IRC/email window all day and manage the community, and you like it), and I'm not sure how sustainable a lifestyle it is. So maybe I agree with OP here.
I wonder if there's something to like, creating some kind of barrier to interact. Like, if I want to file an OpenBSD bug I have to work pretty hard, so some filtering is happening. Filing a bug on GitHub is very easy, so anyone can jump on there and demand whatever they want.
Just let that sink in.
That is indeed a sour take. What about in-between, where me and lots of other people are happily sitting?
> if that code becomes too useful, you have somehow fucked up because you now have a second job
It only becomes a second job if you allow it to. You can tell people "No, I don't want that feature" or "No, please don't send any unsolicited PRs", and no one can do anything (to you) about it.
The world is rarely black and white with clear lines, and same with open source. No, it won't solve capitalism, and no my code isn't exactly the holy grail, but neither I or users of the code I wrote expect that either. And that's fine.
You're free to not respond or read requests at all.
Compared to the alternative of saying "Yes", at least it takes less time :)
> You're free to not respond or read requests at all.
Absolutely! GitHub kind of ruins this by not allowing us to turn of Issues/Pull Requests (not sure which one you cannot disable, but one of them), but ignoring is a valid strategy too.
If you don't want your projects to be important, there are well-trodden ways to send that message to companies that attempt to extract wealth from your free labor: you can close and ignore their issues, send them nastygrams, etc. But if you do put effort into making your projects easily adoptable, I don't think it's crazy that companies do in fact come knocking.
(This is a non-normative position: I don't think any of this is particularly fair. But I think it's telling that there is a huge pool of OSS that companies mostly ignore, since it gives of "go away and don't rely on me" signals.)
"If you release your code under the GPL, large companies won't touch it."
"The GPL isn't as free as these corporate-friendly licenses."
It's too bad the corporate talking points took hold and convinced so many people that open source means "free as in free labor". I've seen people berated for choosing the GPL. Use the GPL if your goal is to contribute to the open source ecosystem. Choose another license if your goal is the honor of having a company with billions in revenue using your software for free.
But it's also true that it is easy to buy into some strange ideas like "sharing is caring" and end up going past reciprocal altruism and into territory where you are working for free.
Forking is a thing. People don't do it enough. GitHub doesn't make it easy to find active forks.
Yeah, it's called a "license" typically and my favorite one includes "THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND" which you can refer people to if they are trying to "force" you to implement some feature/fix.
FFS if you don't like it, just don't do it. You don't owe anyone anything.
If you want to get paid, find a business model that works for you. Open source is not a business model.
If I had a dime for every time someone complains they can't make a living volunteering, it'd fund my own open source efforts.
What do you mean there? That I cannot choose my tasks, my hours, my responsibilities, my involvement... and my salary as well?
The world must be coming to an end!
"Open source" puts narrow emphasis on the code itself, downplaying how that code is actually used, and the resulting abilities of its users. In the "open source" paradigm it makes perfect sense that you can study a piece of source code and even modify and run it locally, but then when you want to actually practically use that software, often to interact with other people, you're strongly incentivized to use the centrally controlled (aka proprietary) SaaS instance/copy/fork. This dynamic of stripping user agency and providing a canned product in its place is what allows businesses to view your project and your effort as a raw materials to be mined.
"Libre software" keeps the emphasis on user freedom. Having the ability to modify and run the code is a necessary, but not sufficient part of that. SaaS is an attack on user freedom from shortcomings of the GPL3, just the way Tivoization was an attack on user freedom from (perceived and commonly held) shortcomings of the GPL2. By keeping the emphasis on user freedom, we can easily perceive these types of attacks as taking away user freedom. Whereas by focusing on one mechanism "open source" encourages identifying with operations of the attackers - eg that common fallacious refrain that you can always make your own centrally-controlled clone of a given site.
Disclaimer: I'm one of the people behind that model.
[1]: https://fair.io/
Agree that if non-lawyers (or corporate lawyers with no experience in open source licensing) craft something, they might regret it down the road. Better to pick and choose between now plethora of available options.
I would just prefer to have more liability protection.
Would be curious what you have in mind. The FSL comes with a default no warranty disclaimer.
For why, see questions 33-36 at https://yzena.com/yzena-noncommercial-license-faq/ .
(Also the fact that this license was not written by a lawyer in itself seems … less than ideal)
But I have actually gotten halfway with a lawyer. A lawyer actually wrote the No Duty clause.
I agree that there shouldn't be a stigma against licenses that aren't FOSS. There's no shame producing software that's not open source, and if you're open about it (ie not calling it FOSS if it isn't), sharing it under a different license (such as the SAMS licenses you mentioned).
Today "open source" is often a marketing term (if any proof is needed, see LLama :), often "let's build a community of users on our discord as a loss leader into our startup sales funnel" term, and ... in a very few cases .. "let's build together, rising tide lifts all boats" thing.
(I wrote I about about my challenges with the AGPL recently here: https://lucumr.pocoo.org/2024/9/23/fsl-agpl-open-source-busi...)
Open source is how software developers are conditioned and socialized into participating in their own exploitation under capitalism.
Feel free to expand on this, as I don't understand how putting a MIT license on my projects contribute to "my own exploitation under capitalism", and I'd generally call myself an anti-capitalist so I'm missing something here.
The scenario is something like: I wrote a library, put a MIT license on it and made the code public. A corporation found this library, built something with it and earns a billion dollars every month, and somehow this is exploiting me?
I explicitly gave code away, for free, for people to use for whatever they want, so what happens beyond the code I wrote, I couldn't care less about.
To me it sounds like a bunch of people got sour about something they did, but didn't fully understand the scope of. I mean, you gave something away for free without asking for anything back, but then you see companies make money from it so now you want a piece?
You mean Big Tech and startups? Totally liberated. Yeah. So much that now they are developing AI tools to remove developers from the equation using open source software :)
Firefox, Debian, Linux, GNU stack, Python, Django, Nginx ... all are open source (and so are hundreds or thousands of other software parts I use daily).
I, personally, have immensely benefted from open source and free software. So have uncounted millions of other people, including, most likely, you.
Not everyone chooses to be liberated but I do
There are plenty of regular users who use open source software to avoid monopolies and abuse.
Open source is just fine. Your expectations around it were not.
> but y'all, capitalism is winning, and Open Source isn't changing that fact by an appreciable margin.
Open Source was a capitulation to capitalism. That's what differentiates it from the Free Software movement. The whole point was to woo business interests.
> you have somehow fucked up because you now have a second job. A second job that doesn't pay,
That's a classic case of "Don't do that." Charge people money to write and maintain software, of course! That is valuable economic activity.
Don't charge people to copy software that is already written. That is regressive and holds back human progress and economic wealth creation.
The entire point of computers and software is that it makes wealth easy to duplicate! You write a machine and then everyone can use it for free (technically there is a cost but it's so incredibly tiny that it's negligible.)
We should take advantage of this to reconfigure the economic system to take care of everybody (and the global ecology) and live happily ever after.
Second comment now stating this or something similar. I don't understand where the connection of "My projects are MIT" <> "Donation of labor" comes from, is it my own labor that is being donated to myself? The public? Something is missing in these arguments y'all are making.
No, this is not something that in inherent in "free software", and you don't have to do that for any of your projects unless you want to. And that doesn't make the software any less FOSS.
Yes it does. It makes for an useless unreachable repository without even a README that nobody knows about. That's not open source/free software. Developing free software successfully means managing all the things around distributing, documentation and community management and it is that what makes people sour as the benefit of it goes to big corps and startup pockets.
Putting your code into www.mywebsitenobodyknows.com isn't open source/free software
FOSS means the code is licensed under a FOSS-compatible license, nothing more, nothing less.
I'm not sure who is trying to change this definition, or why, but that's what it meant from the beginning, and it's also the understanding of the majority of people I'm interacting with.
You might want to do yourself a favor and read through some of the FOSS licenses you come across in the wild, none of them contain anything that you wrote about.
Edit: I made something just for you, this is FOSS with no extra bells and whistles, and the only thing you need: Code + License https://mywebsitenobodyknows.com/
Nope. They don't need to do any of those things.
When people open source their code they usually think people like them would benefit from it and appreciate it. Like I made this project, I might as well share it. But in many popular projects, you have a sole maintainer struggling to keep a roof over their head, while issues from companies (disguised as individual employees) requesting features and reporting bugs pile up, taking advantage of their labor and keeping them busy till they burn out.
The main issue is the majority of companies often don't contribute back, they just consume, they're a burden leeching off free labor.
But how is that the companies fault that people are unable to say no? At one point, individuals need to be strong enough to say "No, I can't help you with that" just like if someone asked you for money on the street and you don't have enough yourself. Is it the beggars fault that you're unable to ration your own money?
> The main issue is the majority of companies often don't contribute back, they just consume, they're a burden leeching off free labor.
The companies aren't "consuming" anything just as much as digital piracy isn't "stealing". The code is there, they can use it if they want. If something doesn't fit their use case, they can change it themselves, or ask someone else. Then it's up to that "someone" to say yes or no.
Are we seriously blaming the victims now that they're not strong enough to stand up for themselves? Do you go to people who got bullied or fallen for a scam and tell them you could have said no at any moment, it's their fault completely? The offender just asked nicely for your credit card information, they did nothing wrong, you just had to say no. Sorry, they played a fair game, you lost.
> The companies aren't "consuming"
What? what do you call companies who only come to a project to ask for features requests and then take that feature and disappear?
> The code is there, they can use it if they want.
But.. no one is complaining that they simply used some open source code that was published online. Why do you make up ridiculous arguments by yourself and then proceed to mock them? I'd understand if you misinterpreted my point but are you really oblivious to the struggles of open source maintainers? Or you're just downplaying it or something else? What's going on here?
Yes, they could have said no. They could have not released the code to begin with. But that doesn't change that they were taken advantage of.
Not sure how much strength is required to have when a AWS employee asks for a feature in your issue tracker and you either ignore them, or just say "Nope".
> What? what do you call companies who only come to a project to ask for features requests and then take that feature and disappear?
They can ask for features all night long if they want to, if there is no interest from maintainers to implement something, then it won't happen. The company can fork the repository if they want, and that wouldn't be wrong.
Assuming that big/profitable users of FOSS libraries are required to contribute back (with time or money) just muddles the waters further, as no one is required to do anything, as a producer of code or consumer.
> But.. no one is complaining that they simply used some open source code that was published online. Why do you make up ridiculous arguments by yourself and then proceed to mock them? I'd understand if you misinterpreted my point but are you really oblivious to the struggles of open source maintainers? Or you're just downplaying it?
You and others seem to constantly misrepresent what FOSS explicitly means, and start involving some implicit rules about what FOSS means and should be, like you have to build a community, or you have to accept patches from others, or you have to reply to feature requests. None of those things are required, and it hurts the community further by pretending those things are needed to call a piece of code FOSS.
What do you call the state that indie open source maintainers are in right now? Lack of business mindset? Skill issue?
> You and others seem to constantly misrepresent what FOSS explicitly means, and start involving some implicit rules about what FOSS means and should be
I thought "the vision" and a major corner of open source is others contributing and building on top of each other? Which of the following is more FOSS:
- Putting your code online and saying no to requests
- Collaborating together and contributing back?
Why do you refuse to promote the second option? How does it go against FOSS? To me, it sounds much healthier for the ecosystem and more along the spirit of FOSS. I'm not sure what definition of FOSS make you blame those frustrated with the lack of contribution and trying to promote it.
If I had to call it something, I guess it would be something along the lines of "Not realizing the control they have over their projects".
If you're writing FOSS not to earn money or build a business, and AWS employees approaches you asking for features, you as a maintainer has the power and control to say "Nope", and no one would bat an eye, because that's the contract they implicitly signed by using your software in the first place.
> Which of the following is more FOSS
Neither, as neither are actually related to FOSS at all.
The first is a process you can apply in order to remain sane if there is pressure to implement features you don't care about and don't want to implement.
The second is something you can do on top of FOSS if you want, or not. Choosing one over the other isn't more/less FOSS.
> Why do you refuse to promote the second one?
I don't refuse that, I promote plenty of communities around FOSS projects, and probably wouldn't had a career in software at all if it wasn't for FOSS, and most of my time daily is spent doing FOSS.
> How does it go against FOSS?
It doesn't go against, but people need to appreciate there is a difference between "Building a community" and "Publishing FOSS". One does not mean the other is required, either way.