The Cathedral, the Megachurch, and the Bazaar
opensourcesecurity.io
opensourcesecurity.io
This hides essential detail that would seem to very much weaken the argument. You have the Linux Foundation and the Mozilla Foundation that "make hundreds of millions of dollars", and then everyone else is orders of magnitude smaller. Python might be in third place, for all I know (or maybe it's Apache).
> It shows how most open source projects aren’t some giant megachurch like group. These projects are one person.
> It’s easy to assume everyone else is also a megachurch member, even if they are not. The church members are pretty noisy and get a lot of attention.
I suspect most of those random bazaar vendors would like to have a respectable church-sized building. Or at least a proper stall.
> If you look at modern day open source, it sometimes feels like the megachurch open source is better because they have a nice parking lot, give out donation receipts, and it doesn’t smell like kabobs.
Well, no; it has more to do with the sense that outsiders are taking the bazaar seriously.
I believe the analogy breaks down here some. That is, actual bazaar vendors may want this (I suppose), but FOSS maintainers may or may not want an organization to form around them. They may be content with the way things are; or they may just want a co-maintainer.
A quick check implies Apache is on the order of half the size, though. When I wrote the other comment it was just the only other name that came to mind.
I didn’t start programming until a few years later, but for sure by 2002, it seemed to me a given that compilers were free. It was my impression that stuff like Borland was niche and that serious stuff like Java and C were free.
Not saying you are wrong, just your comment surprised me. Maybe I have a revisionist memory or maybe those intervening 3 years were quite transformational in the industry.
Commercial access to Unix source was still many thousands of dollars, the whole SCO debacle was an attempt to stop free OSs from being a thing
Many of us who had grown up from the mainframe era wanted to write compilers, work on OS's etc etc it was a hard thing to do (esp. outside the US) before the late 80s, cheap commodity hardware let a thousand flowers bloom
But yeah imo you're closer to right than not, though Microsoft licenses were still fairly expensive.
As MSFT partner, we also started our voyage to port the GUI frontends into the newly introduced .NET.
We used Red-Hat Linux internally for our CVS server, MP3 music shares and Quake lan parties.
That is how seriously we look at Linux in 2002.
Does Perl and Apache (as in httpd, not the foundation) counts?
They are shipped in many enterprisy software at those time.
., and BIND. NTP, Sendmail. They are all opensource and predates that.
Prices also varied around OS features used. Vendors loved to nickel-and-dime you (separate *-user client licenses for file services, print services, remote access, etc), generally to drive you towards bigger packages that seemed like a better deal.
(That's not the biggest flaw in the essay, of course. It made predictions, some of which turned out to be comically wrong. The true parts of it weren't new, and the new parts of it weren't true.)
If you take the goal as inspiring people, i think it achieved its goals and then some. I'm pretty sure that CATB brought more people into FOSS than the GNU manifesto ever did.
(2) You may have missed the link to ~1,000 words of detailed criticism of CATB, on which I support my claim here that CATB is bad.
There’s nothing I’m seeing in the text as it is written that suggests this to be the case. There are just a lot of comments I see that amount to: “I don’t like this,” which can be an interesting signal by itself but not if users refuse to elaborate on it, which is what I (erroneously) thought was happening here.
> You may have missed the link to ~1,000 words of detailed criticism of CATB, on which I support my claim here that CATB is bad.
I did miss it, sorry. I clicked through and didn’t notice that the top comment was yours. I assumed you were just linking to a past discussion.
I’m sure you already know this, but on the off chance you don’t, you can click on a comment’s timestamp to get a permalink to the specific comment, like this:
But yeah, the big thing here is that the substance of my critique is on a different thread. It's disfavored to retype things you can just link to. I'd be irritated with me too if I just said "CATB is bad!" and left it at that.
This author seems to have some kind of attitude about organization in general—anything with people and process, that happens to exist around some project, that might require at least a small commitment to be a part of. Like complaining that a flea market has a form to sign.
The ability for people to functionally collaborate, with some kind of structure, is the key thing that enables building large things together.
OpenPrinting is listed as a funded project:
https://www.sovereign.tech/tech/openprinting
yet 7 days ago someone who works on OpenPrinting was here and stated:
"The whole printing stack is supported by 4 people, 2 of whom are doing that since the inception of CUPS in 1999. Scanning is maintained by a single person."
https://news.ycombinator.com/item?id=46579361
Isn't this the situation the Sovereign Tech Agency is trying to avoid?
This makes me wonder - is there some platform on which people who maintain important (or arguably-important) facilities can post Wanted ads for volunteer co-maintainers?
I realize that the number of people who would actually be crazy enough to browse that platform and answer such ads is pretty small... but - it may be noticeably above Zero.
We're seeing ever-increasing supply chain attacks. All these bazaar projects are vulnerable to that.
It's going to take some serious funding to get the kind of oversight we actually need to secure this stuff properly.
And the clock's ticking - those maintainers from the 90's are going to retire, and we need to have some way of replacing them
The same person who vets people who approach you as a project maintainer today and offer to participate in maintaining your FOSS project.
That is to say, what I've asked about is not intended to solve security problems, just a lack of exposure / connecting interest-with-need problem.
There are still a lot of space for projects without much structure- if you have NSA codenames that aren’t public yet (and you are not subject to US laws) you can contribute with the nsaname tool and have cool names for your servers and containers. If you want to help adding glyphs to my 3278 font, you can. You can do that to millions of small projects that are small enough to not require much structure.
This is trolling right?
Yes, and well done as well. Unlike the other two unmentionables, Linus very much worthy of remembrance. Sure he was extra grumpy for a long time but that's about the only bad thing you can say about the man.
Hell, I think with the later (since all major cloud providers deploy their own version of spark on their respective data processing cluster services), people don't even know that they aren't in fact using open source software. Hell, eventually you get to a point where companies that choose not to use these third party services eventually just open source their own improvements or abstractions as again separate open source projects that never make it into the upstream project (which are often times heavily influenced by profit making entities).
This has been the model for a very long time, going back to at least the likes of redhat. And certainly will be going forward with countless future projects. Maybe there needs to be new models of open source governance, but I have no clue how successful such a thing would even be.
Very unlikely for GPL2 projects
Thing is, when they misbehave, someone has to have the money to bring them to court.
"Sovereign Tech Agency. They are funding open source with no strings attached. It’s likely there are other things similar I don’t know about yet (do let me know)." checkout NLNet
Is this a perfect metaphor? I think its a rigid way of looking at software on either side. I think it is more grey. I like the merits of both sides.
GNUnix was developed using the Cathedral-style, Linux was developed using the bazaar-style. How Linux development was coordinated was thought to be impossible for something that had to be as solid as an operating system. The essay is a deep dive, exploring the conditions that the Linux project needed to ship an OS.
This does seem very bazaar to me, but this would all be deemed Not Open Source by the [cathedral/megachurch?] community, correct? Do people take issue with npm using the term open source?
I'm writing an article on a similar topic, but it's a critique on a popular development style that imports a huge dependency supply chain (without concern on if they are cathedral, bazaar, or megachurches), and what the benefits of building your thing bottom-up has.
If this sounds interesting to you, hacker news reader, you can leave a comment and I'll reply with a link once it's published.
When something is obviously wrong, perhaps learn to ask yourself if it's trying to be funny. Is dead Python funny?
In particular:
> A bazaar or souk is a marketplace consisting of multiple small stalls or shops [...] They are traditionally located in vaulted or covered streets that have doors on each end and served as a city's central marketplace.
> Merchants specialized in each trade were also organized into guilds, which provided support to merchants but also to clients. The exact details of the organizations varied from region to region. Each guild had rules that members were expected to follow, but they were loose enough to allow for competition. Guilds also fulfilled some functions similar to trade unions and were able to negotiate with the government on behalf of merchants or represent their interests when needed.
> Historically, in Islamic cities, the muḥtasib was the official in charge of regulating and policing the bazaar and other aspects of urban life. They monitored things such as weights and measures, pricing, cleanliness, noise, and traffic circulation, as well as being responsible for other issues of public morality. They also investigated complaints about cheating or the quality of goods.
( https://en.wikipedia.org/wiki/Bazaar )
So not quite the anarchocapitalist, self-organizing utopia that tech people seem to imagine there - in fact, they have a lot of organization, both between merchants as well as on the bazaar as a whole.
Seems to me, this model is more similar to the "privately-owned marketplaces" we see increasingly in the digital world: App stores, merchant sites like Amazon, etc.
In that sense, "most of open-source" being on Github which is now owned by Microsoft is ironically more similar to a real bazaar.
With one difference: At least the administrators of real bazaars were public officials with a mandate to keep the market fair - and there was organization among the vendors in form of guilds. With digital marketplaces, the markets themselves are private assets and the administrators are blatantly self-interested. And there doesn't seem to be any kind if higher-order organization across different open source projects, everyone is fighting on their own.
So maybe it would do the open source community good to become more like an actual bazaar.
>In that sense, "most of open-source" being on Github which is now owned by Microsoft is ironically more similar to a real bazaar.
Id put it that this is incorrect insofar - as the bazaar was/is a public commons with a dual regulatory environment city(state) and the guilds , which would enforce/regulate as needed.
The digital marketplaces we have would be more anologous to feudal plantations ,where each coder(sharecropper) survives at the whim of their particluar feudal lord , who have total control within that space and the state via lobbying mostly keeps off.Theer are no guild equivalent so when Playstore/Github makes a ruling like the recent hike of dev fees or ci runner. Theres no state or user leverage that can force a reversal other than complaints.
Paradoxically id say they are more megachurch than bazaars.
its essence is a perspective on the legitimate use of force, on what principles should govern the use of force. and your quotes don't discuss any of that in the context of the bazaar prior to your offhand dismissal of the concept.
i.e. we don't know how close the organization and enforcement of the bazaar was to ancap priciples.
if e.g. all the enforcement were that you were simply not allowed to enter the bazaar until you complied, then it's fully compatible.
Love it
Their positive influence on open source is real; that doesn't make them, as people, role models.
I'm annoyed at the arc these discussions invariably take into Raymond's backstory or whatever, because I think CATB fails objectively, on its own merits (or lack thereof) and we don't need to wade into this other stuff. But if we're having the discussion: seems like kind of a wild statement to say he's any reasonable person's role model.
There's also an article about HURD vs Linux by RMS (origin seems to be 1996, last update 2009/2012): https://www.gnu.org/software/hurd/hurd-and-linux.html
It's a joke
I didn't make it past the tldr lol is this some kind of poisoned data for GPT 6?
“We should tax everyone to fund open source” they say
“Google should pay a percentage of their gross revenue to the Rust Software Foundation” they say
All this is because it’s enough for the bazaar to create but the author has correctly identified that the purpose of the megachurches is to receive tithes.
The Rust megachurch is one of the biggest proponents of this and its adherents are always trying to take our money by force because we won’t give it by will https://news.ycombinator.com/item?id=46048954
Rust delenda est.
It's going to happen and I know what side I'd rather be on.
This is different from taxing big tech's income and capital gains, which I would leave basically intact, but my taxation philosophy would have significant downward effect on overpriced market capitalization of tech giants and would redirect economic rent that otherwise would be accumulated by big tech to the government in order to be reinvested into infrastructure for public benefits.
Primarily, I want the redirected economic rent from tech monopolies to be used to support software related initiative, whether that's supporting open source software infrastructure, support for training and starting businesses, and so forth.
A lot of FOSS people think this but it's not really true. It was a thorn in the side of MS executives as a competitor, sure, but I never met anyone in the rank and file that could be bothered to hate Linux. More than a few of my colleagues played with Linux at home in the '00s. I cut my teeth on the commercial UNIXes so there wasn't anything interesting about Linux to me until it had caught up with them around 2010 or so.
https://www.theregister.com/2001/06/02/ballmer_linux_is_a_ca...
Microsoft messaging was very clear at the time