Post #1118198
2022-12-31 22:18 UTC
Replies (16)
-
@pnathan@social.seattle.wa.us 2023-01-01 02:02
@Di4na this is true, but also I think it portends a massive sea change in how software is used and delivered, as requirements and demands start cascading up the chain. I don't know what it looks like in 10 years. can easily imagine that volunteer software and corporate used software become two different codebases again where today there's a commingling.
-
@hook@toot.si 2023-01-01 07:56
@Di4na, great post and I agree with the basic gist of it. One tiny thing that bothers me in the narrative is that also most of the paid software licenses include an "as is" clause. Depending on the relationship and negotiations there may be some warranties and other obligations though, yes. In any case, business should not be imposing obligations on (volunteer) #FOSS projects. They should contribute/support them.
-
@tfheen@snabelen.no 2023-01-01 09:10
@Di4na I agree with what you write and find myself in a similar situation, but we diverge on the last bit: I’m not at all sure I want to be a supplier. I’m quite happy to work on open source, but I don’t want to handle the liability aspect, somebody else can do that.
-
@boud@framapiaf.org 2023-01-01 09:32
@Di4na The 2016 Eghbal report [1] is very good; pp 120+121 are interesting about GitHub before the MS #EEE. @forgefed #ForgeFed [2] - could you remind us of a good URL on ForgeFed funding (NLNet?) as a real-world example of funding FOSS? @khinsen @civodul might have some good links on the current status of other EU-based initiatives towards sustainable incomes for FOSS developers/maintainers. [1] https://www.fordfoundation.org/work/learning/research-reports/roads-and-bridges-the-unseen-labor-behind-our-digital-infrastructure (pdf archive: https://web.archive.org/web/20221225103314/https://www.fordfoundation.org/media/2976/roads-and-bridges-the-unseen-labor-behind-our-digital-infrastructure.pdf) [2] https://forgefed.org
-
@dirkriehle@mastodon.social 2023-01-01 09:37
@Di4na True, you are not a supplier, but the packager of your code is. Your article conflates the dependency graph with the supply chain, which hides this distinction. Happy new year!
-
@bert_hubert@fosstodon.org 2023-01-01 10:04
@Di4na Very good, thank you! I wrote a weaker story on people's expectations of open source developers, but it does add some context: https://bert-hubert.blogspot.com/2015/07/developing-open-source-dont-listen-to.html
-
@abergmeier@fosstodon.org 2023-01-01 10:14
@Di4na I do disagree a bit. If you provide prebuilt software or packages, then IMO you de-facto act as a kind of "Supplier". It would be really good to have a way of expressing on GitHub and friends which kind of Services one is prepared to provide - say "Prebuilt software", "Reaction to Issues in x days", .... I feel like it needs to be more transparent in the software chain, which services one can expect - if any.
-
@alexinshandon@mastodon.scot 2023-01-01 10:58
Thanks for the thoughtful blog @Di4na (and @kushal). I think there's more to say about quality in OSS. For sure, licenses say "AS IS", although that doesn't automatically imply the code has been thrown open without some thought to its downstream use. Some projects scrutinise the chain of dependencies and have mature communications channels about security vulnerabilities. And I wonder if this is associated with size, funding or governance structure of the open source project?
-
@chainq@mastodon.social 2023-01-01 11:07
@Di4na Great summary of the problem from the lone maintainer perspective, but I think it misses one point - corporations (and startups) hijacked the concept of open source, they just release their code and software for free, in the hope that it will end in someone's supply chain and indeed, they can become suppliers and have monetary benefits from it. This was largely considered a good thing, until being a "supplier" became implied for all open source projects, including lone maintainers.
-
@juandesant@astrodon.social 2023-01-01 11:25
@Di4na @foosel truer words have probably not been spoken yet this year 😉 Now, in all seriousness, this is spot on. Organizations that use FOSS must become part of the mesh, either by owning some of the work that needs to be done, or directly funding it, and preferably both.
-
@chrisjhorn@mastodon.ie 2023-01-01 12:00
@Di4na Hi Thomas, do you have any views on the EU's proposed "Cyber Resiliency Act" which require all software (including FOSS...) used in the EU (for the internet and web) to meet specific quality standards and carry a "CE" mark? See eg https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/13410-Cyber-resilience-act-new-cybersecurity-rules-for-digital-products-and-ancillary-services_en For what its worth, I wrote some views about it at https://www.irishtimes.com/business/innovation/2022/12/01/cyber-resilience-act-signals-big-change-in-commercial-software-development/
-
@webology@mastodon.social 2023-01-01 13:55
@Di4na thank you for writing this. I have been struggling with this for a while but I wasn't quite able to wrap my arms around it. I knew it was yet another land grab in the open source gold rush, but I couldn't put a finger on why I found "securing the supply chain" so repulsive.
-
@jugmac00@fosstodon.org 2023-01-01 15:14
@Di4na Thanks so much for sharing your thoughts. P.S.: We need! stickers! 🙂 "I am not your supplier" gives me goosebumps.
-
@alan@mindly.social 2023-01-01 15:16
@Di4na On a few occasions when faced with a user who demanded a feature/training/etc. I have expressed regret that it hasn't worked out and offered them a full refund... if they could be so kind as to send a copy of their receipt I'd be happy to send the refund out straight away.
-
@corfiot@pleroma.elementality.org 2023-01-01 16:03
@Di4na lol good luck on those vendors forcing rules on volunteer OSS developers without paying them. They can't so what they usually do is take over the libraries/projects with paying devs of their own, thus displacing hobbyists and even the original creators. On the other hand, "as is" means you don't get to control what people do with your work once it's out, so you're powerless, too. This model overall leans in favor of those with the money, unfortunately. This is why it's so successful, because it allows money-making entities to profit from work for free. Then the maintenance is shit, because they don't wanna pay for that, so in the end we ALSO get substandard software and market fragmentation instead of competition. It's very complicated, I'm getting a headache
-
@KlavsKlavsen@fosstodon.org 2023-01-01 16:07
@Di4na IMHO this is where distributions cover our asses, for most of us. All software we use can be run on that, and developers can typicly handle using latest vetsion included in Ubuntu as dependency. 1/2