> Donating to someone's Patreon does NOT improve the stability of a product
>> Saying this more forcibly doesn't make it true.
Sorry, my intention was to emphasize some basic economic logic, not enforce it.
Let me try again. Unless there is agreement between the financial donor and the recipient that the donation will be reciprocated with demonstrably more fitting outputs for the donor, do not expect to see any positive correlation between levels of funding and product stability.
Apache already has the model for log4j... and I'm not being facetious here, but for the sake of clarity only they call it 'governance' which is a comprehensive regime of massive corporate sponsorship, and volunteer 'PMCs' who are drawn from elite engineering backgrounds and participate mainly for social status, not money.
This is because people like myself, and people that like 'The Apache Way' see individual philanthropy and good science as a very complex relationship... and people like me would say... 'bad relationship'. Good science tends to be funded socially... through government organizations and civic institutions, Apache Foundation is one such institution. They accept private donations but it just goes into general funds AFAIK, most of the work done there is sponsored by Big Tech. We can argue that, if you want?
So, underfunding of log4j was not the issue at all. Apache projects I believe are generally well resourced and well managed. No?
> ...the reason we have these hot takes coming out corporate mouths is because they recognize that bugs do impact stability and they're interested in trying to make that into someone else's problem.
So, no... the reason is because corporate mouths are connected to corporate hands, and they have been dishing out money to Apache from the beginning. They believe they are owed something... and to some extent they are. You don't sh*t on your donors. That's the rule in the third sector.
This is why the log4j team are being held accountable. They trade off Apache reputation and the foundation they work for takes the money off many big corporate sponsors.
When you see the history of these issues it all makes sense and although your sentiment might appeal to lots of people, that is all it is... just like 'we shouldn't feck with cats'. That is the sort of argument you are involving yourself with. Sure, in an ideal world no one would feck with cats, but my argument is... when you see someone fecking with a cat, you don't just let them do it, sure, lock them up and rehabilitate them or get them to do some community service or whatever but mainly you want to be thinking about making sure that cats aren't so vulnerable... so you do stuff like make sure breeders are registered, make sure owners look after them properly and don't let their cats stray and so on.
You don't seem to have a very good grasp of the what The Open Source community actually is... it's about big corporates. All the millions of individuals, small and medium sized developers and end users are basically bystanders.
It might be worth coming back once you've got a clearer picture of the landscape. It's not what you think it is. It's not a pastoral idyll of happy, flourishing code crofters, it's a highly industrialized and monstrous tyranny dominated by surveillance capital...
When you see that, tell me if you still care if some prestigious Apache PMC engineer who chooses to work on something for free is really surprised when additional demands or complaints come in to the Brand he is trading off.
That's the deal here.
The systemic level is elite engineers on good salaries and high social standing working on high profile projects on the understanding that their reputation rides on being professional.
For them, it is not about overthrowing Capitalism or reworking our entire economic system, quite the reverse. Open Source for these people is about working to extend that system around the world. I'm using linux now and am under no illusion that almost all of it has been commodified... made alien to the people that worked on it... in the exact same way proprietary software is... the kernel included.
Open Source is capitalist, not Anarchist. I hope that much has been made obvious.
You misstate my position, I said big tech only cares about stability as far as it impacts on profits. Very often it will seek to make a product less stable in order to make money. Dishonesty is not a bug, it's a feature of all corporates.
Open Source is one big corporate hussle. Maybe you will want to look into that a bit more before you assume that Open Source is anything else? Thanks.
> it's in the shareholder interest to figure out how to support the work so their stuff doesn't break.
100% incorrect. The motivation is to make as much money as possible which could mean anything... mothballing an investment, firing workers, outsourcing, making code proprietary, buying out competitors... whatever it takes to make money. You really have a very naive view of the profit at any cost rule that makes a corporate run.
Donating to someone's Patreon does NOT improve the stability of a product, so it is not in a company's interest. What they are more likely to do is hire the lead developer.
The corporates motivation is not to make a product more secure/reliable, it's to make their profits more secure and reliable, and very often this comes at a cost to product reliability and stability.
The entire Big Tech model is about creating artificial scarcity in tech and premature product obsolescence.
More money is made from financialization of the company than from products at the highest level. You need to look at that.
My understanding is your position is that Open Source isn't broken, it's all the free riding that's the problem.
The trouble with that is it is an argument from proximate cause. It seeks to eliminate the negligence on behalf of FOSS developers, the negligence of NOT fixing their work to a licensing regime that deters free riders.
> The log4j devs didn't wake up in the morning with their house on fire.
No, but they woke up everyday with a house they made from tinder, and built it in a dry and overheated climate, so how responsible is that?
> I don't understand why it's the job of people working for free to not only give people their code for free, but also to figure out the entire social/economic structure for how to get companies to contribute to the ecosystem.
You need to understand. That's what you need to do.
Not really. Payments made to maintainers of business-critical upstreams are only sanctioned at board level if the failure to pay could result in identifiable additional risk to the business. As a general rule, this plays out as a kind of high level socialist monopolizing for big tech, and low level capitalist competition for everyone else.
You don't seem to understand the dialectical shape of this argument. You would have to try to understand better how two things that seem opposite could both be true.
For example, Microsoft could pay Red Hat for whatever they like, but this does not contradict the general law of profit maximization. It is possible for a large tech company to achieve both these goals together (support for open source and undermining open source) without undermining the general law, which is to reduce costs wherever possible and maximize profits for shareholders however possible.
You need to think a bit more about the motivations and rules operating here, and if you do, you can't fail to come down on the conclusion that it is open source that is broken, because it reproduces the free rider problem as a well documented and persistent market failure.
The law that mandates that companies can't donate to someone on Patreon or help triage bugs or dedicate QA/security time to identifying issues is the requirement for CEO's to demonstrate good judgment in managing the company by maximizing profit for shareholders. The law that mandates that companies have to ignore maintainer burdens is similar, but much more obtuse, mainly concerning commercial and workplace agenda issues founded on aversion to risk.
The mistake I'm trying to point out is your analogy is wrecked, it's only a very small, but well scoped rebuttal. Your analogy, granted it has been taken out of the context of the comment, but it's important that analogies used to make a point actually map on to the concrete situation, and your analogy clearly doesn't achieve that. Anyway, let's move on to the substance of your comment. You want to shift the burden of fixing what is a very well documented and well understood market failure (free riding) on to corporates. I get that. You want to do that by shifting the burden of the fix to them. What you fail to grasp are the free market maxims which rule these companies. You are, in effect, asking people to stop writing articles about (say) wearing a face mask in public when faced with a public health epidemic and instead write articles about how animal husbandry practices in a small market in Wuhan is the real story. What your comment fails to capture is the systemic failure of Open Source. In the same way, an article about how a virus that is harmful to human health that focuses on hygeine ina market in Wuhan won't help anyone stay safe once it becomes an epidenic. You are, mistaking an epidemic for a malpractice suit. You don't solve an epidemic by suing the market traders in Wuhan, you write articles about wearing face coverings and public helath policy programmes like vaccines.
So, your argument is bogus.
Open source is broken, as a system, it is meant to be broken, it was designed to be broken in the same way Windows is designed to be broken, because it suits people that promote it.
If you are making FOSS you are perpetuating a broken system and are accountable for that.
If you design your house with no doors or windows and then proudly announce the fact it has no doors and windows and everyone is welcome to take a look around you don't get to blame people who wander in from time to time and take a look around.
The rest of your comment here seemd to flip flop between whether the problem is systemic or not based on ideas of what the system is, and what it is not.
I am not convinced by that analysis because the systemic failure is self-evident here and so to discuss whether open source software production is a system or not, or it is interacts with other systems or not seems naive.
Your point about Minecraft seems to show some naivety around the way production systems interact with economic systems.
Some form of interpretation from either the history of the industrial revolution or the economics corpus would probably be enough to disabuse you of your reluctance to admit the interplay between economic and technological systems.
Your opinions suffer from a widespread tendency for peoples opinions to be wrong. I include mine in that category too, but at least readers may benefit from beinga given a choice as to how wrong they wish to be.
Sorry, I didn't mean 'mandate' as in 'legal', I meant more like 'Social License to Operate' (SLO) which is more at the social/cultural level, although there are of course legal ways to keep corporations away from code... AGPL/Copyleft/Ethical Source/Noncommercial licening and Social Domain licenses all seem to be pointing to a new economic future that, despite outr differences in opinion here, I think we can both agree on, would be more desirable than the current situation?
That analogy is a false one. Duck hunting is a self-selecting, non-mandated recreational activity for privileged people, not an activity that forms a critical role in a global pro-business economy.
The correct analogy is:
If the law mandates the indiscriminate killing of animals, you don’t title an article that some animals have become extinct, you say that the indiscriminate killing of animals has caused the extinction event.
The given analogy misattributes the source of the harm based on proximate factors… in effect it’s saying ‘i didn’t kill the animal… the bullet from the gun I fired caused the animals heart to stop’ - it’s a VERY shoddy argument.
>> Saying this more forcibly doesn't make it true.
Sorry, my intention was to emphasize some basic economic logic, not enforce it.
Let me try again. Unless there is agreement between the financial donor and the recipient that the donation will be reciprocated with demonstrably more fitting outputs for the donor, do not expect to see any positive correlation between levels of funding and product stability.
Apache already has the model for log4j... and I'm not being facetious here, but for the sake of clarity only they call it 'governance' which is a comprehensive regime of massive corporate sponsorship, and volunteer 'PMCs' who are drawn from elite engineering backgrounds and participate mainly for social status, not money.
This is because people like myself, and people that like 'The Apache Way' see individual philanthropy and good science as a very complex relationship... and people like me would say... 'bad relationship'. Good science tends to be funded socially... through government organizations and civic institutions, Apache Foundation is one such institution. They accept private donations but it just goes into general funds AFAIK, most of the work done there is sponsored by Big Tech. We can argue that, if you want?
So, underfunding of log4j was not the issue at all. Apache projects I believe are generally well resourced and well managed. No?
> ...the reason we have these hot takes coming out corporate mouths is because they recognize that bugs do impact stability and they're interested in trying to make that into someone else's problem.
So, no... the reason is because corporate mouths are connected to corporate hands, and they have been dishing out money to Apache from the beginning. They believe they are owed something... and to some extent they are. You don't sh*t on your donors. That's the rule in the third sector.
This is why the log4j team are being held accountable. They trade off Apache reputation and the foundation they work for takes the money off many big corporate sponsors.
When you see the history of these issues it all makes sense and although your sentiment might appeal to lots of people, that is all it is... just like 'we shouldn't feck with cats'. That is the sort of argument you are involving yourself with. Sure, in an ideal world no one would feck with cats, but my argument is... when you see someone fecking with a cat, you don't just let them do it, sure, lock them up and rehabilitate them or get them to do some community service or whatever but mainly you want to be thinking about making sure that cats aren't so vulnerable... so you do stuff like make sure breeders are registered, make sure owners look after them properly and don't let their cats stray and so on.
You don't seem to have a very good grasp of the what The Open Source community actually is... it's about big corporates. All the millions of individuals, small and medium sized developers and end users are basically bystanders.
It might be worth coming back once you've got a clearer picture of the landscape. It's not what you think it is. It's not a pastoral idyll of happy, flourishing code crofters, it's a highly industrialized and monstrous tyranny dominated by surveillance capital...
When you see that, tell me if you still care if some prestigious Apache PMC engineer who chooses to work on something for free is really surprised when additional demands or complaints come in to the Brand he is trading off.
That's the deal here.
The systemic level is elite engineers on good salaries and high social standing working on high profile projects on the understanding that their reputation rides on being professional.
For them, it is not about overthrowing Capitalism or reworking our entire economic system, quite the reverse. Open Source for these people is about working to extend that system around the world. I'm using linux now and am under no illusion that almost all of it has been commodified... made alien to the people that worked on it... in the exact same way proprietary software is... the kernel included.
Open Source is capitalist, not Anarchist. I hope that much has been made obvious.
You misstate my position, I said big tech only cares about stability as far as it impacts on profits. Very often it will seek to make a product less stable in order to make money. Dishonesty is not a bug, it's a feature of all corporates.
Open Source is one big corporate hussle. Maybe you will want to look into that a bit more before you assume that Open Source is anything else? Thanks.