Post #2340678

2026-05-06 13:34 UTC

So what am I actually arguing here? This is not 1995 and the expectations surrounding publicly distributed code are very different now. Some of those expectations are reasonable. If an author knows their code is dangerously broken, it should be fixed or be pulled from distribution. You need to be better than Matt from Matt's Script Archive. You should not be publishing to npm or PyPi or CRAN or CPAN or any of the public repositories unless you accept the minimal responsibility for fixing or retiring your code. _RETIRING CODE IS ALWAYS AN OPTION, EVEN IN A PUBLIC REPOSITORY_ But let's take npm as a bad example. What happens when an author decides to retire their code and stops distributing it and pulling it from a public archive breaks other people's applications that rely on code from that public archive? Do we accept the breakage that results from our naïve expectations of the public archive or does the archive continue to distribute the retired code against the author's wishes without forking the code and taking responsibility for it? I was on call the night of Friday, December 31, 1999. The right answer is that organizationally, you take responsibility for your code _AND ALL ITS DEPENDENCIES_ and you factor in that the public repository is not guaranteed to be there when you need it and that any code you pulled in from the internet is your responsibility. You own those dependencies once you start relying on them. Unless you have an explicit agreement with the original author, they owe you _NOTHING_. That is apparently not the modern expectation. The modern expectation is that authors who make their code public owe free maintenance, development, and security fixes to corporations for free forever and if you ever try to extract yourself from this implicit serfdom by retiring your code, some asshole organization will keep distributing your retired code under your name and keep you yoked to that millstone. Am I arguing to have it both ways? No. It's reasonable to distribute code of average quality and maintain it on one's own schedule. It's also reasonable to retire code for any reason but specifically because you no longer have the time or interest to maintain it at an average or (personally) acceptable level of quality. Mark it as archived and unsupported so it's clear to everyone what the project's status is. In an extreme case, stop distributing the code - that's what should have happened with Matt's Script Archive.

Replies (3)

@arclight@oldbytes.space 2026-05-06 14:06

The other obsolete expectation is that one's public code would be used and read by other humans and that attribution was preserved. The vast corpus of code used as training data for commercial LLMs was never intended to be used in that manner. No explicit permission was granted to strip the license and authorship of all that code - it was effectively plagiarized by sampling. How much money did Clyde Stubblefield get from all the songs that sampled Funky Drummer? How much money did Gregory Coleman from The Winstons get from all the songs that sampled his drum break from their 1969 track "Amen, Brother"? https://en.wikipedia.org/wiki/Amen_break Hint: Coleman died homeless and destitute in 2006. When hip-hop was a niche genre of primarily Black artists sampling other Black artists early on, maybe "sample culture" and the same sort of attribution stripping and plagiarism-by-sampling was acceptable. Once the big money started rolling in it wasn't. People like Richard Spencer, Gregory Coleman, and Clyde Stubblefield never got their due and let's not underemphasize this was yet another instance of Black artists being screwed over by White corporations. White people _really_ don't like it when they get treated like Black people have been treated like forever. I can't be upset about AI stripping attribution and stealing code by sampling and remixing without clearly and unambiguously showing the parallels to Black musicians 4 decades ago. Let's just pause and reflect on that for a moment.

Open ##2340679
@dalias@hachyderm.io 2026-05-06 13:38

@arclight@oldbytes.space It sounds like the problem you're addressing is not "publicly distributing code" that might be dangerous, but the catastrophe of LPMs (language package managers) making unvetted code posted by any random author into something that's essentially part of the language's standard library.

Open ##2340696
@graydon@canada.masto.host 2026-05-06 13:40

@arclight@oldbytes.space I think you're entirely correct about this. "The modern expectation" is a process of enclosure; the money has decided to make it impossible for anyone to profit from a computer without paying them rent. (They've been quietly escalating to "use", just in case.) They're not doing well with the open source model in general (e.g., Oracle's Java debacle) but they've got no real need to figure that out to enserf individual people. Enserfing individuals is a solved problem.

Open ##2340700