An Unbelievable Demo | Hacker News Reader

An Unbelievable Demo

brendangregg.com

2,339 pointsSerCe463 comments

Reminds me of when Apple started providing "smaller size updates" to OS X. I was curious about the details since my doctorate had touched on the topic, so I worked my contacts (I had a few in Apple engineering from the FreeBSD / OS X relationship) and after a few months I got back as answer: "We're using a tool called bsdiff, are you familiar with it?" I was indeed, since I was the author of said tool.

(Just to be clear, there was no license violation involved in this case; just a lack of awareness of the provenance of the open source software they were using.)

While I'm not the author of anything, I did on one occasion share Russ Cox' articles on regexes with a fellow developer, only for that developer to reply "that guy is making a mountain out of a molehill, just use re2".

For anybody who's lost: Russ Cox is the original author of re2, a fast C++ library implementing regular expressions that are guaranteed to run in linear-time.

There's a collection of articles they wrote talking about regexes and various pitfalls: https://swtch.com/~rsc/regexp/

This is still relevant today, too. The last several JavaScript vulns. that people at my company have had to upgrade around were because of accidentally quadratic regex in JavaScript. One poor library[1] was attempting to match a header whose grammar was a whoppingly complex,

  1#token

(this is in the HTTP spec's notation: it means 1 or more `token`s, comma separated with optional whitespace around the comma) and hit this, by trying to split the incoming values with,

  / *, */

I was shocked that this wasn't compiled to a DFA. (I checked, too: my JS exhibited the behavior in the bug report.)

This is, I also think, another reason why "simple" text protocols are not really so simple. The grammar above is "trivial", and yet, this is the end result. I don't feel like the library is particularly at fault: I doubt I would have caught this in code review.

[1]: https://www.npmjs.com/advisories/1748

>> "that guy is making a mountain out of a molehill, just use re2"

That's an odd thing about the tech world, it's accessible. As you get better in different areas you are actually more and more likely to make contact with important people (big names? people who did important stuff?). This can creep up on you if you're not aware what level you're operating at. It can be a small world.

yep. i remember asking a question on google groups about some AppEngine query early on a Saturday morning thinking, "this will never be answered".

about 15 minutes later Guido van Rossum answered my question.

Had this happen to me, I was complementing a particular debugger I liked on an IRC channel and some random id said "Thanks, it's a lot of work".

I didn't realise the author of that tool was in the channel - kinda neat that we have such a flat open structure at times.

Google interviewing lore is that there once was a candidate who was asked if they were familiar with MapReduce and replied "MapReduce? Is that like Hadoop?"

Reportedly, this was also a major factor in Google's strategy shift to open-source a lot of their infrastructure (GRPC, Bazel, TensorFlow, LevelDB, etc.)

I used and hacked bsdiff in the past. A very neat concept and tool, many many thanks for making and publishing it!

Yeah, but did you win the Putnam?

That one reply in that flame war is still hilarious so many years later. To anyone who didn't get the reference of Putnam https://news.ycombinator.com/item?id=35079

wow, that’s one helluva response. HN in 2007 seems like a wonderful place

Like the featured article, HN threads - then and now - are pretty low-key in regards to participant introductions. Usernames are just text, no flair or qualifiers so the focus is on the speaker's content itself. `libria` is free to converse with `cperciva` as an equal peer which is nice, because most other IRL forums I'd be acutely aware that's not the case ;)

Interesting this reply and one above are from accounts that is rather new.

tldr;

In 2007, an academic argues with PG and others. After long exchange, academic defensively states their own achievements.

Another user challenges academic with GP question, to which academic provides unexpected affirmative response.

But just the once, though, huh?

I sent an email to a corporate Steam email address, asking whether I’d be allowed to post a screenshot from half-life in a computer graphics shading thesis. Ended up with a response from Gabe Newell, CEO, shortly after, and another engineer who invented skeletal animation, all excited to talk about it with some random kid

I first encountered bsdiff when working on reverse engineering Blizzard MPQs (their proprietary packaging format, long abandoned now in favour of other stuff). They started using it for mpq patches some time in … 2007 I want to say? I was 16, had just started to code.

10-ish years later, I'm doing other stuff but still working with Blizzard-related tooling sometimes. I was talking to a Battle.net engineer about their latest-and-greatest game update protocols. He tells me they're thinking of adopting this great thing called bsdiff for the next version. I giggled a bit.

Anyway, hi! I implemented a version of your algorithm when I still barely knew wtf I was doing. https://github.com/jleclanche/python-ptch

I don't understand what bsdiff does, or is. I am a software developer and I frankly have no clue what I would ever use bsdiff for! I've read what it does (libraries for building and applying patches to binary files) and still don't really have a sense for what the purpose of this tool is.

What are some real life use cases for it? When does a developer need such a tool?

Implementing software updates where you don't want to ship entire binaries again (and only the diff) would be one. In some video games the assets are also packed into massive binaries, so you don't want to ship gigabytes of data because you replaced one icon. Sadly many games do this anyway nowadays.

There are other solutions to this problem that the game industry uses. Binary diff patching is slow, incremental, involves large diffs and has the possibility of corruption. It was used back in the mid 90's (RTPatch was the big name), but really isn't used anymore because of the drawbacks.

Games frequently use an override directory or file. The patch contains only the files that have changed and is loaded after the main index and replaces the entries in the index with the updated ones. This is the most common way of doing a patch if it's not just overwriting the original files.

Some games load their file as a virtual filesystem and then the patch just replaces the entries in the virtual store with new ones. Guild Wars 2 works this way. This is only common in MMOs though.

One of the reasons games do this is the data is compressed, so a "patch" might be indistinguishable from a real update.

Also, as a dev, you have no idea what version your users are updating _from_. You either need to generate some number of patches for every version you could be updating from, and figure out if you should just download the whole thing again in any of those cases anyway.

Speaking from experience, AAA games have quite a bit of architecture behind them that can date back a decade or two. So you end up with some tradeoffs. The code may be well-tuned, resource efficient, and mostly crash proof, but some elements can be a bit dated relative to the size and scale of modern assets.

Ahh, thank you for the explanation. That's an awesome tool!

I actually could really see using it, now that I understand what it does.

I've worked on some firmware projects where we did OTA updates and were guilty of shipping the entire binary. Luckily, even the entire binary was rather small, but still it would have been very cool to be able to create a diff and ship only the diff!

Does it help if I tell you that bsdiff has saved end users somewhere over 10,000 years of waiting for software updates to download?

yea well thats not enough! Xcode should be using it too. They make us download 12GB for every update.

/s end open source entitlement section

Thanks for your great work

Its old now but here's a description from Chromium about something they use called Courgette which is similar/related to bsdiff

https://blog.chromium.org/2009/07/smaller-is-faster-and-safe...

The explanation here is pretty fascinating

https://www.chromium.org/developers/design-documents/softwar...

The really cool TL;DR here is that courgette "disassembles" the binary before diffing. Basically turning internal references into symbolic references. This way adding an extra instruction to a function won't affect all of the relative addresses in surrounding code.

If you have a game, where you have large packs of files (like a 2GB sized textures.pak), and in a patch you want to add 2 small things, you can just ship the differencd between the old anc new pack file, and skip transferring the rest.

They do this, but not as a binary diff. The new files are just shipped as an override of the old files that are loaded after the old files. It's substainally faster than applying a binary diff and file sizes really aren't a concern for the most part.

The game industry really hasn't used binary diffs and patching since the 90s when they used RTPatch.

Chrome and Chromium used bsdiff for updates:

https://www.chromium.org/developers/design-documents/softwar...

The page says they use something called Courgette which is similar to bsdiff

> I don't understand what bsdiff does, or is.

It‘s a binary diff/patch utility.

> What are some real life use cases for it? When does a developer need such a tool?

Incrementally update binary files e.g. assets or runnable binaries instead if having to re-send the entire thing on every update so e.g. games, browsers, package managers, …

The standard diff/patch utilities are text-based and even when they do extend to binary data their algorithms and heuristics tend to be biased towards textual contents.

Bsdiff was built specifically with an eye towards executables.

Nowadays, Apple ships the whole 4GB OS, even when they have to ship 3 point updates in one month for small bugs.

You obviously haven't done macOS updates in many years

Years ago, I interviewed a candidate for a role on my team. As usual, one of the ways I break the ice with candidates is to get them to talk "war stories".

The team he'd worked on had produced a tool that was only ever intended to be used by the team to solve a particular problem they had. It contained proprietary code.

Unknown to the team, word had spread about the tool, and others had started to use it, including solutions architects. Who started shipping it to customers to use, who absolutely loved it.

That'd be fine except one of the core libraries it used was GPLv3 licensed, and there was non-open source proprietary code used in the tool.

The nightmare scenario he found himself in was having to rapidly re-architect the tool around a non-GPLv3 licensed library, without breaking any functionality, all the while having to have regular sync up meetings with a furious CEO and Legal department (who, to be clear, were mad about the situation, not this particular developer or his team, who weren't to blame)

I worked in support and came up with a quick script to check for a very specific issue. It was super simple and really just applied to one customer to find one bug they encountered. It really didn't do much more than look through a bunch of counters and a bunch of if statements ...

Next thing I knew someone had copied it and started running as a rule on every data set / customer they could get their hands on, and of course it was false positive city.

Finally after lots of emails where I would just type "Don't use that script, it doesn't work." some engineer wandered up the stairs to support to talk to me.

They were fielding escalation after escalation for these false positives. Support would run the script, see some flags, and turn their brain off and escalate. Management was so scared of this bug / issue that they would do the same.

So he tells me to use a trick he used with a similar situation.

I announced a new and improved script and management militantly demanded everyone use it, and that all escalation using the 'outdated ' script would be rejected.

The new script just identified if it was the right customer for that script and set a bit if it wasn't. If that bit was set the engineer knew immediately they could ignore the output and would say that their analysis didn't find the problem in question and advised some basic troubleshooting next steps (copy and pasted mostly).

The support soon realized that just running that script wasn't getting them much more than a few minutes of breathing room away from the case, management realized this too and saw all these next steps coming back and the focus switched to 'hey we should do these next steps all the time too'.

That was also one of the ways I started to understand how the engineering team worked and really helped start a good relationship with them.

That was a very valuable anecdote, thank you!

> having to rapidly re-architect the tool around a non-GPLv3 licensed library

... or just go with it and have it be open source? The old version is already open and free for anyone to request the code of. No rush at that point, you can withhold updates for a little while while you rearchitect this or take the situation as it is and have the next few bugfix releases also fall under GPL until you get around to replacing the core component (iff one insists that the future additions must absolutely be proprietary).

Quickly removing the code doesn't change the previously released versions' license.

The license of the previous code didn't magically become the GPL altogether, instead it by default became un-distributable. They were required to (a) stop distribution of the existing code since it at best had no clear license, and (b) if they wanted, going forward remedy the license by clearly making it GPL or doing the rewrite of the dependency. Or even reach out to the library author and ask for an LGPL or other alternative - there is sometimes (often?) some flexibility there.

The built-in conflict resolution in the GPL is no-distribution.

Depends who had rights to the proprietary code. If it was someone else's (for example, if the internal version had used both GPLed code and some proprietary third-party library), open sourcing the whole thing just might not be possible.

> Quickly removing the code doesn't change the previously released versions' license.

But would $BIG_CORP publish source on request for a proprietary product just because they built one version with a GPL library by mistake and later fixed it? Has this been successful, ever?

Isn't this how OpenWRT got started?

Depends on the composition of CORP. If it is comprised of developers with strong respect for OSS or FS community they might not stand for non-disclosure. OTOH, plenty of orgs would be mainly folks without a strong opinion either way and would just follow executive direction.

> ... or just go with it and have it be open source?

They didn't have the legal right to do so.

How is that? The company added code to a GPL project, that means it is a derivative work and also comes with software freedoms, or at least that's how the story reads to me since there is no mention of other claims or parties to the mix. That means the company owns the copyright to the added code and is free to comply with the contract (license).

Company A writes library with commercial license.

Company B uses that library and a GPL library in a product. They distribute the product.

Company B has no right to relive se Company A’s commercially licensed library under the GPL. Hence, stop distribution and replace GPL library.

It does hopefully prevent any of your customers from ever asking for it.

An app so killer they're willing to rewrite a part of it. Nice problem to have!

> one of the core libraries it used was GPLv3 licensed

it's still untested in the real world if gplv3 "taints" derivative work that broadly.

Would they had to open source the entire solution? or just changes made to the library? nobody knows, and there's a lot of FUD to promote BSD licenses instead of sitting down and properly defining the limits in a practical way.

My stories are very minor. I did my PhD in a reasonably well regarded mechanical engineering lab. My area is experimental fluid mechanics. I ended up writing a lot of Matlab code while there and even worked with a spin out company from the lab in the biotech sector for a while.

I'd get a lot of other students coming to me for coding help. Most just wanted me to do their job for them and I was too naive to say no. One wanted to count cells in a microfluidic device using image processing. I sat down with them for a couple of hours and walked them through a few methods they could look into to get started collecting all the examples in a script. Basic stuff so they wouldn't feel overwhelmed. A few months later I see he published my simple introduction as a paper with zero modifications. He had the good grace to at least thank me in the acknowledgments.

Several years later while working a $BIG_TECH lab we interviewed a candidate from my old lab. They presented their work and had performed some data analysis of thermal camera images. Turns out they were using a script I'd written there and it was still actively used to work with the thermal camera. Nobody ever modified or improved the code — many engineering students are terrified of code. I was annoyed because there was no interest in further development the code, I don't think they even read it or understood it.

While at the spinout company I developed a software tool for the PCR optofluidics platform that was being developed. It was considerably faster and more robust than the hacked together script they were using before and had a user friendly UI that I build with feedback from the biologists on the team. A few years later the founder and one of their new students published a paper documenting their amazing tool without any reference or acknowledgment whatsoever. That one pissed me off.

There is a lot of ignorance around code authorship and respect for the developer in physical sciences research. Like I said, many are terrified by code but don't value the time and expertise it requires; once they have it they no longer think about its maintenance or acknowledging the author.

> I'd get a lot of other students coming to me for coding help. Most just wanted me to do their job for them and I was too naive to say no. One wanted to count cells in a microfluidic device using image processing. I sat down with them for a couple of hours and walked them through a few methods they could look into to get started collecting all the examples in a script. Basic stuff so they wouldn't feel overwhelmed. A few months later I see he published my simple introduction as a paper with zero modifications. He had the good grace to at least thank me in the acknowledgments.

That can't be the whole story, surely? You verbally suggested a couple of possibilities for what might work and wrote down a couple of lines of code, and then I imagine the student tried out all of those possibilities and reported what did and didn't work? I mean, what academic journal would want to publish half-working examples with unstudied properties?

Mind you, I agree about your broader point that (especially in academia) a lot of people don't really understand and respect code authorship.

IMO, academia is not better or worse -- often they do apply their citation culture to code.

The overall problem is that people tend to think only in terms of first order consequences. A little copying here and there might have minimal financial or reputational risk. But the second order consequences of that becoming the example and the norm for the junior ranks and the next generation causes larger organizational risk. So got to consider the bigger picture and nip the ethical lapses immediately.

I’ve checked the paper again and there is also some basic CFD analysis performed by a third author.

He had some sample images he had taken and I used them to demonstrate the basic code. The figures in the paper are the ones I generated in my sample code.

I had a friend who worked at Compaq on tools that did desktop imaging. There was one tool he used that had a big splash screen when it started naming the author. Everyone was in awe of that guy so he used the cachet of people knowing his name to move on to bigger and better roles. My friend decided to see if he could replicate that success and when he wrote the next version of the tool he too had a big splash screen with his name up front. Sure enough it worked and for a certain subset of everyone, everyone at Compaq knew his name and he too was able to move on to what he considered a better role.

There were a couple of downsides; he got calls for years after asking for help with the tool, and one boss seemed envious which led to other issues.

I think it is very common for code to outlast its authors in academia for non-CS/EE fields, where programming is seen more as a means to an end rather than its own pursuit. For example, my wife in her Psych PhD inherited a giant hairball of Matlab code for interfacing with an eye tracker and scripting various experiments. She made her own modifications, and I helped too. The last we heard, the code is still being used. There are likely dozens of copies of it under various names, with sections commented out or added to the end.

I'm sorry to hear about you not getting credit, that's inexcusable, in the same way that not accrediting the researchers who did the work in a paper or book (I have heard this story too often) is inexcusable.

Just remembered another recent one. A couple of years after I had left, my former employer closed the regional site. I saw the writing on the wall I guess. A few colleagues from there have set up a new consultancy company, they’re going to build demos as a service apparently. Several of the showcases on their website are my work.

I have a similar experience to this myself.

A long time ago (early 2000s) I wrote a handful of tools to ease physical to virtual (P2V) migration for Windows Server. I was a systems administrator in the UK working for a large American firm.

I wrote the tools in my own time and unlike in other countries my employer had no ownership of them, just to clear that up at the start. I did use these tools at work but never developed them on company time or resources. They were released as open source.

Fast forward 6 months and we had a meeting with a virtualisation consultancy trying to sell us some tools to assist in a wider P2V programme. We had a sales guy and a tech guy visit to show us their stuff. After half an hour of them talking up all they can offer the tech guy fired up a tool and I instantly recognised it was my tool but with some rebranding.

My manager looked at me slightly confused as he recognised it too. I let them continue for a few minutes to properly confirm my suspicions then mentioned that this tool was in fact a tool we already use. They were very confused until I loaded up my version on a remote system to show them.

Needless to say the rest of the presentation was extremely awkward. I believe these two gentlemen thought they were in fact their own tools developed in house. It turned out several of "their" tools were in fact rebranded versions of mine.

I would love to say there was some kind of exciting conclusion but in reality all that happened was they were clearly spooked by this as their/my tools were removed and never included again in their P2V toolkit.

I suspect the moment they left the meeting with us they called to report what happened and rather than risk me following up (not sure how I could do that to be perfectly honest, it was FOSS after all just not used the proper way) they decided it would be safer to just pull these non-critical tools. They were just "nice to haves" anyway.

My boss excitedly share the experience with the team and we had a good laugh about it and how the sales guy went from Mr Confident to stammering and stressed in a matter of seconds.

We never did buy their toolkit.

did you follow up with that company to make sure they granted you recognition and money for your tools?

Recognition - yes, but money - why? It was open source.

This meeting does not sound at all awkward to me if I was the sales person. To me this sounds like how lots of companies work with open source to make a business.

They take some open source tools (maybe they built it themselves, maybe not), package then and maybe sell some cloud service around it or simply just support.

If I was the sales person I would be delighted to meet the person who wrote a part of the package.

The only reason to be embarrassed is if it did not contain the correct attribution and recognition.

Edit: the fact that it happened 2000 could have made it embarrassing though. Many things have changed since then...

Yes the tools were all open source. This was in 2004 and I just zipped up a compiled exe, the src directory and a license.txt (GPL2) and put it on my website. Similar to Nirsoft which is what inspired me.

The reason behind it being awkward was for half an hour the sales guy had talked up how they were the only company developing tools like this, etc, etc. How the 'big players like VMware don't care about these pain points admins have to deal with' or words to that effect (which was true and why I made the tools in the first place).

Then the moment he finished the sales pitch and I see these 'one of a kind tools' they have been developing I respond with "That's my tool, see..."

I believe the sales guy, at least, believed all the tools he was talking about were made in house. Open source wasn't a widely understood thing back then with Microsoft talking about Linux and open source being a "cancer" and such. Really knocked him off course as I guess he had never been in that situation before (I doubt many have?).

As for following up with the company. I did nothing. I was young and while I knew what they did was wrong (they literally removed my name, link to my website, etc. and put their company name but changed no functionality of the tools as far as I could see and certainly no source code was available!) I didn't have the confidence (or desire tbh) to chase up on some little tools I made to learn and make my life a little easier at work. The company disappeared (I don't know why) sometime around 2010 iirc.

Honestly, it sounds like they might have been willing to purchase a license from you to redistribute the code. Had you reached out, you may have received a few bucks and proper attribution for your work (and your work would have reached a broader audience).

> I've learned ... instead to simply say "I have a lot of experience with that technology" and leave it at that.

Shows Brendan's maturity.

I am not sure what should be the appropriate reaction or corrective measure in these situations. We should talk more about handling these unfair situations.

Someone else can become more successful building on top of one's open source project. On a resume, a top contributor and a minor contributor to open source project might have same weightage depending on how you present it - making the situation unfair for a person dedicatedly working on a single project (quality) vs minor contributor to multiple projects (quantity).

But deleting name and credits is wrong. An acknowledgement from the benefitting person (if not the recognition/reward) has far more positive impact on career than justifying to other's that your work was stolen.

It was a bit strange to read some of the initial negative comments. I see Brendan being a sport. I would argue that reading the story as a report against unknown persons at Sun makes more sense. I don't see much sense in blaming victim. And, in my opinion, the VIP had a good run but he isn't the bad guy here.

Thanks. There was a time when many observability products were adding latency heat maps, and at one conference expo floor there were three companies with latency heat maps on their screen at the same time, pitching them as a flagship feature. If I walked near them they'd start trying to explain them to me, and I never figured out an appropriate response. If I said "hey, great to see you added them, I invented these back at Sun" I'd get funny looks.

I think it's a small world, and everything is software, so the chance you'll bump into someone who wrote software you are using I think is pretty high. I was once trying to get my head around Andi Kleen's pmu-tools, and I had the github repo open in my browser on my laptop I was carrying, when the guy sitting next to me on a bus says he's Andi Kleen. (Ok, it was a bus taking Linux conference attendees to an event, not a random bus, but I still found it remarkable timing -- I was studying pmu-tools at that exact time!)

Still, it must be quite rewarding to know that everyone, no matter how big is using your tools. Before i knew anything about open source, i was somewhat surprised to see that even the giant that is Apple had open source licenses on their iPod. I assumed that apple had enough resources to develop all their own software, but no, they go just like everyone else and pick off-the-shelf software.

Thank you for sharing some of what you've learned with everyone in everything that you've published. I've been reading the latest addition of your systems performance book the past few weeks and it is amazing. You're work is pretty awe inspiring.

s/'re/r/g

> If I said "hey, great to see you added them, I invented these back at Sun" I'd get funny looks.

I don't understand. What kind of funny looks were they? Disbelief? Distrust? Fear of your mental health? Realization of having been lied to by their bosses (oops it wasn't really an internal tool)?

Also, what were the impact of those funny looks? How did they make you feel? Was there any longer term consequences of telling them you wrote the thing?

Disbelief and suspicion. And fear of my mental health I guess: What's wrong with this person?

Maybe I just don't look or dress or sound like what one would expect. But there's context here too: At the time it's when these things are flagship features and on the booth monitors, and the booth staff are explaining the virtues of these features to everyone they meet. They are making it a big deal of it at the time, so maybe that makes it even more unbelievable that the inventor would wander by at that moment.

Now imagine what would happen if companies had a thanks page along with the other boilerplate pages (contact us, about us) on their website. If you're making millions from a thing, thank the original person for that thing. (I put thanks pages at the end of my slide decks, it's not hard.) These interactions would go a lot better -- "my name is on your company website" -- and could lead to fruitful discussions and collaboration instead of weird looks.

Years back I was at a deep learning conference and was reading Andrej Karpathy's blog during one of the talks. Demis hassabis had come in slightly late and sat at the last free seat that happened to be next to me.

He leaned over, asked if I liked the blog, and (slightly proudly if I remember correctly) mentioned that deep mind had hired Andrej for an internship starting soon.

> I am not sure what should be the appropriate reaction or corrective measure in these situations. We should talk more about handling these unfair situations.

Start recording; have them, a big multinational with a massive legal department, admit to violating and stripping a license from source code. Then sue them. They should know better, and they're making billions off of other people's work. That in itself is fair enough, if the license permits it, but removing the license is crossing the line.

Oh it needs to be redressed and some knuckles soundly rapped, maybe someone even fired depending on the situation, but suing is a last, last, last resort. "WARNING: Do not feed the Lawyers".

Be extremely careful recording conversations without consent in the US.

Most jurisdictions in the US are one-party-consent. I think the tech crowd tends to have a skewed perception of recording consent rules because California happens to be one of the relatively few two-party-consent states, but it's the exception rather than the rule.

But in most country's you get sued first for illegally recording other peoples, and your proof is nothing worth because it's illegally obtained.

Better make detailed notes, who said what with time and date.

Check the laws first. Some places only require one party (you the recorder) to consent.

I didn't read maturity from this. I read timidness, conflict aversion, lack of standing up for oneself. Someone touring the world making hundreds of thousands of dollars, demoing your own software and claiming its their own? Violating your license setup, the foundation of OSS? I would have spelled it out as clearly as possible, including the legal implications, spelled out my assumption this person was claiming they worked hard on these tools when instead they did minimal stealing, and either talked about legal follow-up action or financial follow-up action. This is a time where anger, frustration, and being stern are justified.

>I am not sure what should be the appropriate reaction or corrective measure in these situations.

When it happens internally, i.e. I catch someone doing it, then either it is a "first time offense" of the clueless, or it is the act of an unethical person who will be unrepentant. For the clueless, it might be that they undervalue themselves, and therefore undervalue assigning credit. The unethical person, however, understands what they are doing and is simply untrustworthy. They will also likely have a lawyer, because they've done this before. So it can be pricey to get rid of them, but get rid of them you must. They are poison to your team.

A colleague of mine was attending a local tech conference just before Covid hit. I believe it was aimed at newcomers and various companies tried to show off exciting tech that interns/new coders could potentially work on.

She couldn't believe what she saw. A major govt. backed logging company (which does do a lot of dev work themselves) were showing off one of our projects as theirs! We were using depth cameras to estimate the volume of wood loaded on a truck as it drives trough a gate. They even used screenshots that I had made!

Now, they were involved in the project. But they were basically clients of our client. They provided us with a place to test the system as their trucks ran trough. They didn't own the software let alone did any work on it. Why they would present it as something interns could potentially work on is beyond me.

People are weird.

I would imagine they would say to an intern once they joined, "yeah you won't work on THAT project, but here's some other thing for you to do". It's like the estate agency putting a listing of a nice place on a website and then when it comes to viewing the place they say "well that one was just taken but let me show you something similar".

Maybe they hunted for some passionate overzealous intern to rewrite it from scratch for them. Kind of "make me a clone of facebook for $10" gigs :)

Maybe they wanted to show something that the interns could try and replicate. I mean, if everything your in house dev team is working on are CRUD applications built on 90s tech, that's not very exciting.

Does logging software have extensive logging?

I did not see that coming, well worth the read if you just came here for the comments. I won't spoil it for you.

Thanks for this heads-up. Wow. What a plot twist...

I was expecting something Theranos-esque

I guessed it right away, but had no one to see my glory

It was quite obvious the way he worded it

I had a similar, smaller scale of that happen, in a sort of reverse direction a few years ago. My director dropped a resume on my desk for someone coming from a company I had worked at ten years prior, thinking I might have met them (it was a small organization). I didn't recognize the name, but skimmed through the resume quickly, and their primary claim on their work history was something I invented just six months before leaving the organization. I couldn't believe it. What were the odds of that resume ending on my desk? Basically zero, but what a huge mistake. And they didn't claim they had maintained and extended it, they claimed they had invented it! He didn't get called in for an interview.

Having conducted technical interviews at FAANG companies for over 10 years, I've gotten to the point where I never believe anything anyone claims on their resumes unless I can independently verify them. I also make it a point to ask probing questions about where they got the idea of "inventing" what they did and what alternatives to "making a brand new thing" they considered at the time.

However one of my favorite questions to ask is, "What don't you like about what you invented?" A true creator of something is always acutely aware of its flaws. They're unsettled about its shortcomings and wants to do better. In describing the flaws they demonstrate deep insight into the problem space, and they explain expertly how things don't go perfectly in certain corner cases or how the code could have been better organized.

The poser will almost always struggle to come up with criticisms of what they "invented" and try to pass it off as a spectacular feat of engineering brilliance.

Your favourite question has some cultural gaps as in many countries in interview settings people downplay weaknesses and flaws. It’s why a lot of weakness questions are often ineffective. Unless you are acutely aware of when a person is doing this BECAUSE it’s an interview you’re going to get some answers that might lead you to reject good candidates.

Honesty is something that never goes down well in an interview when it comes to being critical. (At least in the US)

I've made a lot of foul-ups in the course of my career. When people ask me about mistakes I've made and what I've learned from them during interviews it's generally an easy question to answer because I have this overstuffed mental file folder of examples.

I can't speak for the US but, in the UK, don't misrepresent your work in a job interview. I can't say you'll never miss out on an offer by being honest, though I don't believe I ever have, but would you really want to work for people who'd prefer you to lie or misrepresent mistakes you've made than be open and truthful about them?

To me that's something of a red flag: it's at least indicative of a culture where mistakes are likely to be covered up, leading to a lack of reflection, learning and improvement... and also quite possibly storing up bigger problems for later.

(FWIW, I started as a developer and am now the CTO of a mid-sized multinational market research and insight company. This is nowhere near as grand as it might sound, and isn't meant to be a boast, but hopefully illustrates that being honest doesn't appear to have done my career any long-term harm. Some things that have, if not derailed my career, caused me to take some fairly substantial detours: (i) taking things too personally, (ii) placing too much weight on others' assessments of me, (iii) and I say this as somebody who is wary of people who change jobs too often, but... staying in a job way past the point where there was anything else I could learn/give/progress. I am, of course, but a single data point.)

> Honesty is something that never goes down well in an interview when it comes to being critical. (At least in the US)

I wouldn't paint all tech companies in the U.S. with such broad strokes. In the interview loop for the job I have now in the U.S., every single interviewer asked me a question about "how things could have gone better." I talked about mistakes I made, lessons learned, and how I could do better next time.

I am told the feedback from that loop was across-the-board "outstanding."

Amazon thinks otherwise. This is their Earn Trust Leadership Principal:

"Leaders listen attentively, speak candidly, and treat others respectfully. They are vocally self-critical, even when doing so is awkward or embarrassing. Leaders do not believe their or their team’s body odor smells of perfume. They benchmark themselves and their teams against the best." [1]

[1] https://www.amazon.jobs/en/principles

There is a difference between being self-critical once employed (where I agree it's a useful practice) and being self-critical during an interview (which is often viewed as the process of selling yourself in order to get a job).

Amazon's "principles" is also just that, corporate shpiel. 100% of Amazon employees, including Jeff Bezos, would fail if they were actually tested against their own dogma.

I'm aware of what you're referring to, and I can assure you that this cultural gap can often extend beyond just the interview and into the workplace.

> "What don't you like about what you invented?" A true creator of something is always acutely aware of its flaws.

OH YES.

I've done a lot of things for both work and side, and this is the one thing I can go on and on.

Things that are a choice of the lesser evil, things that are unfortunate, things that we just don't have time for.

I thought this was going in the direction that I experienced. I had a recruiter try to recruit me for the position that I was already in (we were expanding the team, not replacing me).

Great article. Gives me flashbacks to the time someone sent me a link to a newly-released version of Minecraft, and it turned out to be using my own voxel engine. :D

(No credit of course, and the marketing copy around it made it sound like it was all their own code. Welcome to open source I guess!)

I would love more details!

Could you please link the voxel engine? Which version of Minecraft was this?

Annoyingly there's not much to tell. It was a minimal web version, released as a one-off marketing thing and then never updated, and Mojang didn't reply when I tried to get in touch (via contacts at microsoft). So I never really found out anything about it.

The game is still live though: https://classic.minecraft.net - Originally it supported multiplayer, but that stopped working the day after the game launched.

The voxel engine is here: https://github.com/andyhall/noa/tree/develop

> Minecraft Classic - official game from Mojang (I'm as surprised as you are)

lol. Microsoft should just release all the source for this since Minecraft isn't exactly state of the art these days. The brand is nearly all of the value.

Do tell more.

Almost been there. I was once hired and given some sources to work on by a company, and those were the same exact sources I wrote at another company years before, although my name and all recognizable comments were stripped, save for a few almost invisible traces I left like my initials paired with reserved words to make them appear like directives, pragmas, etc. The guy who had given me the "new" sources was without any doubt responsible, since he was PM at the old company having access to everything, but almost certainly he had no right to use them over the old company. It took like 10 seconds to me to recognize them as filenames, function names, network usage, variables and structures all were the same, so it went like. "Hah, no problems, I recall this very well, in fact there should be my name somewhere... oh rats, it got deleted somehow, no probs however, consider it done":=).

I for one wouldn't be so forgiving. Stripping the author's name from source code is an absolute no-go.

Consider GP's position: they wrote some code for their old employer, and therefore had no copyright over it (I hate capitalism). Point is, they had very little stake, beyond personal pride and ethics.

So now they see that their code has been stolen from the previous company, and they're being asked to work on it, what will they do? Refuse to use the code and risk being fired for being too slow? Report the crime and risk being accused of attempted to cover their own tracks? Talk to HR and being hated by one's closest bosses?

I see no way to really win here. At least, not reliably.

Yes, but that code wasn't mine either as I wrote at another company as their product. When I added my "hidden" traces I did that with no intention to claim ownership, but rather to leave a signature just in case. Technically the 1st company should have sued him, but I can't know for sure the details; the old project was then dead, and he could have purchased the sources legally, although I doubt that.

> leave a signature just in case

Just in case what happened? I'm not understanding the work environment that would lead to this practice

I honestly don't know, I for sure couldn't foresee that some years later I would have been called from others to work on the same sources. The work environment was really good and I wished the project lasted more, but alas all good things must come to an end. Anyway I had no explicit reason to leave traces other than maybe some odd reasoning after listening to a ("toxic", as some of us realized later) colleague talking about bad experiences in other places and signing his sources in a similar way, but to me it was mainly a "Kilroy was here" thing.

It's a textbook copyright violation and could earn the author at least four to five figures when he settles.

Only if the copyright was registered before the infraction can you file for punitive damages. Otherwise you’re only eligible for actual damages.

Isn't anything you write automatically copyright?

Interesting, thanks

I personally wouldn't work on code that I knew was stolen from a previous employer, especially if its code I worked on directly. Ethics aside, if you ever get caught you are personally going to be subjected to entirely to many questions and its the kind of thing that could follow you around for the rest of your career even if you really did nothing wrong.

I wouldn't touch it, either. It's a crime.

Thankfully the "DTrace expert" didn't turn out to be Bryan Cantrill. He's a big fan of Scott McNealy's engineering principles for Sun Microsystems, which includes "Don't Cheat", and the behaviour in this story very much seems not in the spirit of that principle. I wonder if this bit of 'cheating' ended up getting someone at Sun in trouble.

You do not know.

It definitely (obviously?) wasn't me. I had introduced Brendan to DTrace in 2004 (over e-mail) when I discovered his earlier psio work[0] (which was based on TNF, a tracing facility that predated DTrace that was better than nothing -- but not by much). I knew that he was going to be very excited to learn about DTrace, and it wasn't long before he was delighting us with some really creative scripts. (His shellsnoop.d[1], in particular, really got people's attention as to what what could do with DTrace!)

While he and I had corresponded a bunch, ironically the first time I met Brendan was in 2005, it was in Sydney, and I was on a tour of Australia talking about Solaris 10 -- but it followed this incident by several months (if I recall correctly). I was excited to meet Brendan, and he was excited to meet me -- especially so after his poor experience several months prior!

[0] http://www.brendangregg.com/psio.html

[1] http://www.brendangregg.com/DTrace/shellsnoop.d

Given that Brenden and Bryan worked together closely and seemed to be very fond of each other; and the article mentions that "the VIP may not have known" I think it's safe to assume it was not Bryan.

As if it had been Bryan, Brenden would have been more sure.

To the extent that the two of them have disagreed about things, they don't seem to have any issue saying so publicly, referring to the other by name: https://news.ycombinator.com/item?id=16382456

It feels like Cantrill being a creator of DTrace earns at least the credibility to be called a 'DTrace expert' without quotation marks.

Specifically: https://news.ycombinator.com/item?id=27391764

Brendan already replied to another comment saying he doesn't remember the VIP's name.

An analogous experience: I once chaired an American Bar Association committee that developed and published "fair and balanced" model software license provisions, extensively annotated. Twice in the following year, in working on client deals, lawyers for The Other Side proposed draft license agreements that were indisputably copied wholesale from the model provisions — but with certain fair-play features omitted.

I had a vaguely similar experience. I was working on virtual reality race car simulators that used sophisticated custom designed and built motion platforms. I had several responsibilities, the first was the software that controlled the motion platform. When it was done, and I proceeded to the sound effects system, my boss turned over my motion platform code to his good friend who he had brought on to the project with no interviews. A month later in a status meeting, the new guy said that he had to replace about 20% of my code to fix defects. I was curious, looked, and saw that there were zero code changes, but the comment blocks were changed replacing my name with his. Kind of sad for him. He literally had done no work.

What made him think that it would fly, especially with you present in the same meeting?

I really don’t know. I did not embarrass him in the meeting but we had a smaller group talk later

There's a long industry history of stealing code, but I'm surprised to hear this story of Sun allegedly doing it.

My impression is that reason for the stealing usually makes sense. For example, a key library that's hard to write that's just copied into the source tree, ignoring licensing. Or an appliance developer didn't want to deal with licensing for Linux or BusyBox. Or an individual developer in over their head quietly copies code.

The time I heard an explainable incident happened with my code, was in mid/late-'90s. An acquaintance, who'd offered to be one of the testers for an unreleased Java desktop application I wrote, then reportedly ran it through a decompiler, and passed it off as his own code, in a demo to investors. He later acknowledged doing this, and said he'd send me a Sun (ha) workstation as compensation. I declined.

Then there are incidents for which the reason isn't obvious, like the one from the article. I speculate that sometimes the explanation might simply be that the perpetrator wasn't quite right in the head at the time, like in some famous cases of journalism fabrication.

An inexplicable one involving my code was when an open source developer took a substantial and novel package that I wrote, stripped out my name and license notices, including out of the main file, and posted the package with themself identified as the author. There were also a couple other incidents with that person that seemed like that hadn't yet learned how to play well with others, in engineering or open source. I asked a mutual acquaintance, in confidence, what was going on with that person. The acquaintance checked, and was also baffled. In that case, I suppose that maybe the perpetrator was going through a difficult time, and not thinking clearly. Or maybe it was a combination of unlikely accidents that looked worse than the intent was (which happens).

In the article's story of the Sun incident, I'm a little surprised that (speculating) an engineer could do this despite all the other people in engineering who might be in a position to notice something funny going on. And Sun had been the dot in some dotcoms by 2005, so presumably they had some strong engineering processes around what goes into product.

Maybe the demo was something put together by a systems engineer, working as part of a small marketing/sales team, rather than under an engineering organization, so a lot fewer engineers were aware of it?

You are very compassionate towards people just literally stealing code. My experience is that a lot of folks just don't care about licenses: they steal and rebrand by any mean necessary, I guess to accumulate reputation.

I wrote a few silly scripts in my lifetime, all small-time stuff (so trivial it never got me hired as a Dev anywhere). No matter whether I marked things as GPL or BSS, I often found them copied on GitHub with my copyright notices stripped. In the case of the BSD license, that's literally the only thing you can't do!

In some cases it was utterly blatant: cloning from my own GitHub repo and then replacing authorship notices in the very first commit. I mean, come on guys, at least try to be smart; you can add your name just fine... When I politely asked to, y'know, respect license terms and reinstate the notices, some people just took down their repo rather than doing that. I bet they then re-uploaded it somewhere else.

I've seen blatant cases as well. There was a github repo where someone was sharing their notes on performance engineering, and there were tickets from people thanking them for their amazing work. Except these notes were literally copy-n-pasted pages from my systems performance book. It's weird to find all these messages from people thanking someone else for the work I did.

When I contacted them to ask how they thought it was ok to republish my work like this (I was giving them a chance to explain), they just took it all down.

Were there any legal repercussions? Was the employee fired? Were you as calm about this at the time as you seem now?... I would be furious!

EDIT: For some reason I assumed OP was the author. Someone with a twitter account should ping him and get him over here to participate in discussion.

I was in shock, and a bit furious at being ripped off, but didn't feel there was a lot I could do about it. I edited this bit out (I was trimming the post):

"You might wonder why I didn't talk about this first case publicly at the time. I'd already informed them of the problem privately and how to fix it, so there wasn't more to say. Also, Sun was the number one employer in town, and to be publicly critical could be career ending."

I don't know what happened to the US developer. But I didn't think it made sense to burn bridges with Sun about it. I was more worried about giving people a bad experience with DTrace by running older versions of my software.

Are there no legal recourse options for breaking the license so blatantly?

Was there a license violation if the software wasn't distributed?

As he said, he did not want to burn his bridges.

Wouldn’t you have made significant bank if you had sued? To the extent that you never had to work for a paycheck ever? Just curious if a lawyer consult might have been useful.

Brendan has "made more bank" since then than he could have made in that one suit or since that suit if he'd filed it. Brendan's a pretty big shot nowadays and is almost certainly very well compensated, but when you demonstrate that you're too happy to sue you tend to get discriminated against, so if he had sued... it might have ended his career.

Sun was the number one employer in town in Australia? What?!

Sorry, should have said "tech" employer, and this is referring to Sun and its ecosystem. A few years earlier I gave a talk to a local University about the job market and asked the comp sci students to have a showing of hands as to whether they thought they'd work on Windows or Solaris when they graduated. Most hands went for Windows. Then I showed the local job statistics: Sun Solaris was number one.

Recently I was struggling to understand MotionLayout in Android and how to make it do what I wanted for my app. I had searched all over the internet reading blogs and forum posts trying to figure out what I was doing wrong. I ended up watching one particularly helpful presentation video (I think it was from a DroidCon) given by this guy named Jason Pearson. It helped a lot, (watched various parts of the presentation multiple times) but eventually I still got myself stuck again. I ended up dropping a question out on StackOverflow in desperation just to see if anyone might be able to point me in the right direction. Well, fast forward a bit and someone responds to my question with a really great answer that helps me understand what I was missing. Happened to look at the user who wrote the answer and saw his name was Jason Pearson... Then I had to double-check and sure enough, it was the same guy!

So, shout out to Mr. Pearson for a great presentation and a really helpful SO answer!

I once had an interview where someone quoted one of my blog posts at me. 'Oh, I wrote that', I said. It felt good.

And I thought it was fun when a colleague who publicly belittled me on a somewhat regular basis for scripting (“we're not programmers!”) triumphantly showed a blog post he’d found to solve a problem he was having.

A blog post on my blog.

In fairness to him, it was still on a domain that didn’t identify me at all, though the “About” page had my name on it.

He then proceeded to launch up the chain of command to get me in trouble for publishing company secrets on said blog.

I promised to only write it outside of work hours and not to directly copy any code (scripts, one-liners) I wrote at work, and that was the end of that.

There were other less-antagonistic instances of others in this large company finding solutions on my blog, which says something about the value to the company of posting generic stuff like this on publicly-searchable platforms instead of an internal-only SharePoint or Confluence instance, and definitely instead of the PDFs our senior management insisted on for all documentation.

Can you share your blog URL?

https://zwischenzugs.com

Thanks... first article I see about "IT Transformation" is soooooooo painfully accurate!

I worked at a company that was interfacing with the AOL Instant Messenger network in the early 2000s. Finally the business people got a deal and AOL made us sign NDAs to get access to the official API docs. We were excited because we were using the docs that one of the open source clients had produced from their reverse engineering efforts.

AOL's docs were the same ones from the open source project, with the GPL message intact.

What does an NDA-encumbered GPL document mean in practice? You're allowed to spread the document, but not tell anyone where you got it from?

I once received a library under a modified Apache 2.0 license, where all the conditions under section 4 (attribution, etc.) were just inverted for a given number of years (effectively an NDA), after which the normal Apache 2.0 would apply. Which worked because it came straight from the original copyright owners, but here I assume AOL weren't.

Trillian?

It's a small world. Many, many years ago, I wrote a little help desk application for a one man ISP. The only requirement? "I have to be able to respond to support requests using WAP". This was, of course, before smart phones were a thing. Typing long replies on a phone with only a numpad was not pleasant. So I built something with a lot of prehashed replies and parts of replies, which could be accessed by entering a couple of digits (with some very rudimentary context awareness).

Fast forward 10 years or so, I'm consulting at a company. When I see one of their support engineers using a tool that looked vaguely familiar. Turns out the company had acquired the one-man ISP and had continued developing the little helpdesk application I'd made for WAP all those years ago.

I was fortunate enough to happen to be live at LISA13 where AFAIK, Brendan gave his first public flamegraphs demo. I'm glad I saw it. I love learning about areas (performance engineering) where I'm weaker. Great demos! I've tried to keep my personal live demos at a high quality too. Can't wait to see what he comes up with next!

Flame graphs completely blew my mind, but most people I talk to about them just don't seem to get it.

I'm a generalist, but I've been thinking lately if performance engineering is something I should be specialising in. I'd love to hear any advice from those in the field.

Specializing in anything is good if you have 5+ years of exp IMO. It's always good to stand out from the crowd of generic developers.

The other plus is, if you frame yourself as a specialist in X, it might be easier to explain not knowing Y. You can't simply know everything, especially if you invest heavily in specializing in other things.

Personally I've been a web performance (i.e. mostly JavaScript/HTML) guy lately and it's been fun. There's a million of React devs in the world, but only a few dozen web perf guys with web presence (Twitter / blogs), and I almost know all of them by name at this point.

Of course it depends what you want to do. Typically it's big corps who look for specialists. Small companies prefer generalists.

Thanks for the advice!

My problem with picking a niche is that ones that are easy to learn from a book are too crowded to be considered niches, and the rest can only be learned by doing in real production environments. Now there’s one where I have a foot in, and it’s one that I enjoy.

Can someone elaborate on why he takes a weird detour in the middle of the post to discourage forks? Is there some particular issue with supporting bpf tooling forks?

As someone who has spent a lot of time in open source, forks are not a problem, they are indicative of a problem.

Don’t cry when people fork and go a different direction, try to figure out why and see if you’re willing to change the project to accommodate them. Dropping chastising “more wood behind fewer arrows” platitudes is pointless when half of the wood wants to break off in a different direction anyway.

Yes, there can be good reasons to fork (especially after making a fair effort to have things fixed), and bad reasons.

But also yes: There are two particular issues with bpf tooling forks. 1) They look deceptively simple, but those that are kprobes-based are really kernel-specific and brittle, and need ongoing maintenance to match the latest changes in the kernel. One ftrace(/kprobe) tool I wrote has already been ported a bunch of times, and I know it doesn't always work and one day I'll go fix it -- but how do I get all the ports updated? No one porting it has noticed it has a problem, and so the same problem is just getting duplicated and duplicated. Which is also issue 2) Unlike lots of other software, when observability tools become broken it may not be obvious at all! Imagine a tool prints a throughput that captures 90% of activity and no longer 100% (because there's now a fast-path taking 10%). So the numbers for some deep kernel activity are now off by 10%. It's hard to spot, and that increases the risk people keep deploying their old broken ports without realizing there's a problem.

> They look deceptively simple, but those that are kprobes-based are really kernel-specific and brittle, and need ongoing maintenance to match the latest changes in the kernel

It seems like there is a missing formal interface here if this is so brittle, no? If it’s hitting a bunch of internal kernel stuff shouldn’t this stuff just live with the kernel itself?

The formal interface is tracepoints. So tracepoints in theory aren't brittle (they are best-effort stable) and don't need so much expert maintenance (which is mostly the case). In theory, someone could port tracepoint-based tools and almost never need maintenance.

But kprobes is basically exposing raw kernel code that the kernel engineers bashed out with no idea that anyone might trace it. And they can change it from one minor release to another. And change it in unobvious ways: Add a new codepath somewhere that takes some of the traffic, so gee, seems like my tool still works but the numbers are a bit lower. Or maybe I measured queue latency and now there's two queues but the tool is only tracing the first one, or now there's no queues so my tools blows up as it can't find the functions to trace (that's actually preferable, since it's obvious that something needs fixing!).

I really don't like using kprobes if it can be avoided (instead use tracepoints, /proc, netlink, etc). But sometimes it's solve the problem with kprobes or not at all.

Now, normally such code-specific-brittle things should indeed live with the code like you say, so normally I'd think about putting the tools in the kernel code. But we don't want to add so much user space to the kernel, and, it also opens the door as to whether these should actually be tracepoints instead (which begins long discussions: Maintainers don't want to be on the hook to maintain stable tracepoints if they aren't totally needed).

Another scenario where the tools should ship with the code base would be user space applications. E.g., if someone wrote a bunch of low-level tracing tools for the Cassandra database that used uprobes and were code specific, then they would be too niche for bcc, and would probably be best living in the Cassandra code base itself.

> As someone who has spent a lot of time in open source, forks are not a problem, they are indicative of a problem.

Forks because the main project is not responding to a need are not a problem. Forks just because some project or product believes it gives them more control and they don't interface with the original project usefully are a sort of a problem. Those aren't necessarily started because of a community need, but some business need or perceived business need which may have nothing to do with the reality.

I think that's the situation he's asking to avoid here, as he mentions observability products. He's saying please don't fork just to have it under your own repo and for no other reason, when it can be developed jointly.

Why? If someone wants more control their interests already aren’t aligned with the community. Developer resources aren’t just some faucet easily redirected.

It’s worse to have people trying to jam shit into the main project if they don’t actually care about the main project. That’s how you get contributions that are huge hacks and require more work to review and iterate on than is worth it to the community.

If some company forks for an observability product and doesn’t contribute back, they clearly don’t want to. Don’t try to force them.

git is an incredible tool for managing forks and this anti-fork mindset is right out of old school open source culture from the early 2000s.

Demanding people contribute to your project instead of forking just sounds like demands to pay homage more than anything.

> That’s how you get contributions that are huge hacks and require more work to review and iterate on than is worth it to the community.

And yet the author here is saying please work together. Presumably he or the community is okay with picking apart those huge hacks. I'm not sure why you should care what that community is willing to accept, unless you're part of it.

> If some company forks for an observability product and doesn’t contribute back, they clearly don’t want to. Don’t try to force them.

Who's forcing anyone? Did you not notice the "please" he starts that statement with?

> Demanding people contribute to your project instead of forking just sounds like demands to pay homage more than anything.

That's just a straw man, nobody demanded anything, and I'm not sure why you'd even try to insinuate he was when he literally says please.

If I had to paraphrase the part of the post you're critiquing, I would do so as "If you're using these tools, don't feel like you have keep any stuff you do separate. We'd like to build something better for everyone, so feel free to contribute to the project rather than keeping it separate and we can all build on each other's work." That's pretty standard open source ideals IMO.

The criticism is of forks that are done in order to re-brand and re-sell a project, and then never contribute anything back to the original, and likely, never pull improvements from the originally forked project (which can include critical bug fixes) after that.

Serious question, how does that hurt the original project? This has never been a concern in the projects I’ve worked on. Getting mad every time some developer writes code that didn’t go to your project is a good way to be mad all of the time.

Just a couple of example scenarios:

- Someone sells you BPF observability that's buggy and dissapointing, and you avoid BPF in the future. So in that case it's hurt the BPF community.

- Funding goes to a project that gives nothing back, instead of funding a project that does. Again, it hurts the community as funding isn't infinite.

Obviously it hurts if your project gets bad rep from an old unmaintained fork. If "everyone knows $your_project is broken, don't use it" it will spill back on you.

Somewhat like when powershell on windows had aliases for wget and curl that was just shell aliases for a simple downloader, making some scripts work without those two installed, but also confusing anyone that wanted to do anything outside of "get one single file from url".

I worked with a tech from a software vendor who had a link to one of my Server Fault answers in their setup docs. We got to that bit of the setup and I mentioned that I wrote the answer his doc was referencing. I quite enjoyed it.

Great article. Disgusting behavior. Seems like the sort of experience that sticks with you for years.

Was there actually no follow-up? Change of header?

I never got a chance to see it again. I ended up spending more energy with another Sun project that wanted to switch the CDDL license to the GPL, only because they wanted to avoid going through the legal approval procedure to ship mixed-licensed products. Maybe I'll share that story one day: it was another eye-opening experience.

Thanks! Also, you never heard back from the Dtrace expert? (silly question, ok)

Is the "D" prefix in things like DTrace a Sun standard/convention?

What does it mean, for example in the JVM arguments start with "D" as well.

Any history to this?

TL;DR: DTrace uses a minimalistic C dialect called D to write it's probes, hence the name.

In order to trace arbitrary code, it has to inject these into the code site that you want inspected.

If you could just inject arbitrary C, you'd get the issue of potentially adding probes which change the behaviour of your code under test to a degree where new bugs/behaviours are introduced or old bugs/behaviours are masked.

DTrace solves this by using a C subset which helps you avoid such unwitting changes, by not including loops or other operations which could change the memory or timing behaviour of the existing system.

>DTrace uses a minimalistic C dialect called D

Which is completely unrelated to the other language called D, also known as DLang. (which was released 4 years earlier than DTrace by the way)

Should've called it C--.

As an American, I found this and the other cultural anecdotes very interesting. We definitely do a lot of obnoxious things, or at least things that can seem obnoxious to other cultures. No arguments there. We should be better. =)

    To an Australian, introductions in the US can sound 
    boastful, but they can also be useful as a quick 
    way to share one's specialties.

But this one puzzles me a bit. Typically, we talk up the people we're introducing - I'm not sure I've ever heard anybody talk themselves up during an introduction!

"Sally, this is Bob. Bob's been doing some really cool stuff with XYZ lately. Sally, I know you have too!"

(At which point Sally and Bob often politely insist that no, they're nothing special at XYZ)

I've always thought of this as gracious and not boastful. I definitely agree it would be obnoxious to talk one's self up!

I recently had an experience kind of like this. I run a website about a kind of niche topic. I got a call from someone at a FAANG one day working in a similar space who wanted to chat about it. I get these calls pretty regularly and agreed, always happy to chat about it. While she was showing me some of what they were working on it started to look very familiar, and I realized that a lot of the ideas had been copied from my site. In some cases they had literally copy/pasted my content. I mentioned this to her and she got uncomfortable and admitted to something like "yeah we took a lot of inspiration from your work." Frankly I don't care that much, I put the info out there to be used and use it they did! But attribution (or an acquisition offer) would have been nice.

To be honest, Sun's whole culture treated software as an afterthought - which is part of the reason they ended up where they did

That's not true. I was there, and I was there at the time. Sun had a lot of problems, but software was not an afterthought, at least not within the Solaris org.

they also (in my limited experience) treated sales as an afterthought. Its the only time I've contacted a company to inquire about a product, and had them actively dissuade me from buying the product (IAM).

Could anyone, please, share some light on the "low-key" introduction issue mentioned in the article?

I work quite a few years in IT and never, during any interview or meeting, I've been introduced as anything more than just an engineer. This must be cultural gap, no doubt, but I'd feel weird if someone would detailed my career in front of other participants. Of course I have nothing against filling some details in by myself but only if applicable in given situation. Truth to be told I've never worked in Australia or US, but I did some job in two EU countries and in Japan and, as said, never encountered detailed introduction.

Is this still a thing?

Great story. One of my open source bioinformatics tools was ripped off, with name AND GPL license stripped off, by a person working at the EMBL/EBI (European Molecular Biology Laboratory European Bioinformatics Institute; a prestigious scientific institution)

Management, when alerted, made it right, but I think the point of my story is that this is perhaps more common than anyone realizes.

Wait but what happened? Did he do something about it after, like contact Sun saying "Stop! You have violated the law!" or whatever? If not, why on earth not?

What's the point of publishing with a copyleft license if you aren't going to do anything when someone literally walks into your office and says "we at Big Corp are selling your work without any attribution?"

Just to throw in an analogous story.

I was hosting a research talk given by quasi-famous professor at a biotech startup that I worked at.

Quasi-famous prof was describing a gene (gene "xyz") being used as a tool in his lab, "but the specifics of what gene xyz is and what it does are not important. It's just a gene we use in these assays...."

Me: Do you know who has 2 thumbs and discovered xyz? This guy.

> a heavy American accent

Any non-Americans want to chime in on what is a heavy American accent? I’m imagining heavy southern accent, but maybe this is something that can only be heard by non-Americans?

I'd say most people hear divergence from their local accent, and consider theirs to be (at least subconsciously) a normal accent. This results in English people hearing my accent as a bit Irish, and Irish people hearing the English parts. Neither acknowledge fully the shared parts. In truth, I am a bit of both.

So I'd say a strong American accent to an Australian is the most divergent one, not one that somebody in US might consider strong.

Living in upstate New York I also frequently heard "oh, you have an accent" to which I always tried to explain "so do you", and several times I got the response that their accent was either neutral or closer to generic English.

It is amazing the subjective differences in how people experience accents, and how they feel about their own.

I'm born and raised in Göteborg (Gothenburg), Sweden. My parents are originally from Karlskoga, 270km NE from here. Göteborg has a very distinct accent and I always get told by others that I have a very bland Swedish with no hint of that accent.

But one time I was at a wedding in Karlskoga and talked to someone I hadn't met before. I opened my mouth and managed to get half a sentence out before he interrupted with "Oh! You're from Göteborg!"

There was a month or so after I moved back to Germany from the Netherlands where my own accent when speaking German was super noticeable to me. Otherwise I don't even hear my own accent when speaking English even though it is undeniable there when I listen to recordings of me.

It's like your mouth was full of water - in contrast to British Received Pronunciation, which is like a mouth full of down feather. Also compare to "Hollywood Soviet English", which is like a dry mouth, but the tongue is filled with helium so it floats up, and then 'r' sounds like this: https://upload.wikimedia.org/wikipedia/commons/c/ce/Alveolar....

I have absolutely zero ability to take your descriptions and convert them into an understanding of what you're trying to convey. Like what could this possibly mean???

> ...which is like a mouth full of down feather.

Speak through your nose and and lean heavily on the R sound wherever you find it.

Peter Sellers called Americans "The Herns" [1]:

> Various American characters with the surname Hern or Hearn, often used for narration, outrageous announcements or parody sales pitches. The Goons referred to Americans as "herns", possibly because saying "hern hern hern...." sounded American to them, possibly because Sellers once said that a decent American accent could be developed simply by saying it in between sentences.

[1] https://en.wikipedia.org/wiki/List_of_The_Goon_Show_cast_mem...

As a non-native English speaker I absolutely hate English accents where consonants absolutely disappear for no good reason.

Personally I'd rather have Americans "lean heavily on the R" than act like the letter doesn't exist (rhotic vs non-rhotic). I think it's another factor why American English is more popular than British English (besides the huge economic factor, the US economy being 5x the UK one), since their pronunciation is clearer and more explicit.

You can hear a European perspective on it in the song Prisencolinensinainciusol: https://www.youtube.com/watch?v=-VsmF9m_Nt8

Imagine a British accent. Now imagine that that is what’s normal; everyone in your country speaks it. Suddenly American sounds very different.

Specifically in my limited experience stuff like pronouncing t’s like d’s and soft back-in-the-throat r’s. “Budder” vs. “buttah”, for example. American vowels tend to sound larger as well in my experience.

I'm Swedish and to me a heavy American accent means a clear rhotic r[0], slightly slurred speech, and a lot of volume.

[0] https://en.wikipedia.org/wiki/Rhoticity_in_English

I got that a lot in Iceland[0] recently.

I’d say something to a clerk, and they’d reply with “you’re an American!”

Yes, how could you tell?

You’re so loud!

Thanks?

[0]: https://youtube.com/playlist?list=PLOgT48pM4GctCy-88GTDyyqyy...

For me as a German, the people in this video speak a heavy American accent: https://youtu.be/c9kI_rAFuKA?t=72

Well, that's a specific regional American accent, in the US called a Southern accent. Probably the only strong/widespread regional accent really left in the states (you could also argue for AAVE/ebonics but it's not regional in the same way).

It's a bit like saying that someone from rural Bavaria who speaks with a strong Bavarian accent has a heavy German accent while speaking German.

Most accents that aren't your neutral evening news accent sound "heavy".

For me, as an exaggeration to being understandable to an American, it could be this example from Regular Car Reviews (time: 02:20):

https://youtu.be/oMDcIApBtL8?t=141

Really rhotic r's, relaxed prosody, tongue flaps instead of a t berween vowels, indistinct schwas on unstressed syllables, etc.

I also perceive Canadians to have "heavier" North American accents than Americans do. Some Canadians speak as if from the backs of their throats, with leaden vowels and really round r's. They also often overcorrect /a/ to /æ/ so "drama" becomes "dramma" (like the first two syllables of "Dramamine". And of course there was William Shatner's famous "sabotadge"...

Rhoticity (the r sound in words like butter).

https://en.m.wikipedia.org/wiki/Rhoticity_in_English

Americans can identify accents from within the US. Any such accent would be identified by foreigners at least as American and probably as coming from a coast, the central US and the south.

I would read that as an accent that isn’t a softer New England accent, but also not one that non-Americans would so easily place more specifically (Southern, New York, maybe one or two others?)

When the speaker is creaking like a frog, speaking in that weird vocal fry register. It's very american way of speaking.

For me, if the speaker uses two syllables for "and", it's a strong American accent.

To me it's when water and wider are pronounced in a very similar way. Also, Americans abuse awesome.

I’m trying to understand what you mean here. How does one pronounce and with 2 syllables?

Like pronouncing "and" as "eeyaand".

I almost had an heart attack last week when I noticed that a library I've used for work in the last year wasn't open source, but rather source available.

Thankfully, my employer had some licenses for the library without my knowledge, but it ain't fun to break licenses at work, especially when you don't notice until months later.

I wonder if @bcantrill was aware of this at the time it happened?

Definitely not -- see my earlier comment[0], but when I met Brendan in person later that year (and he relayed this incident to me), I didn't even recognize the name. Certainly, it wasn't someone who should have been claiming to be a DTrace expert! And honestly, by that time, any actual DTrace expert inside of Sun definitely knew of Brendan -- and likely vice versa.

[0] https://news.ycombinator.com/item?id=27396911

The VIP can only be Bryan himself, caught with his pants down. Amusing

No, it wasn't, I don't even remember the VIP's name. Met him that once and never heard of him again.

My reaction to this presentation would have been... let's just say, less gracious than the author's.

I'd love to hear stories from the other side. Behind each of these "someone else taking credit" war stories is the engineer or product owner at the other company who decided this was an ethical course of action. How did you justify this to yourself and to your boss, and what was the plan if/when you got caught? Doesn't your company have an internal process for vetting the licenses of software you use? It seems like these cases are failures at multiple levels in the company. It would make an interesting post-mortem. Use a throwaway account if you like!

Awesome story.

I'm not sure if this is just my personal feeling but I would say that stealing intellectual property was sort of common at that time. Open source was not widely known, knowledge was scarce, communities were just ramping up and really anyone with lack of principles could pretty much steal anything and get away with it.

It happened to me a few times with online content I wrote. Essentially tutorials, articles, etc. around Open Source. Once my own company sent me a newsletter which contained one of my articles signed by another employee from a different place. It felt pretty weird.

The article says the story was from 2005. Open source was very much widely known at that time. Linux was 13 years old by then, and Sun themselves open sourced both DTrace and Solaris that same year.

Widely known... by a few techies. Well, certainly many more than in 1995, right? But can't compare those times to these days.

What a great story. Thanks for posting. And being a tall poppy.

Sergey Tselovalnikov is not Brendan Gregg.

I read a large bit of the article before I finally realized it was not about some demo (understand demoscene) I did not know :)

So is this "developer-splaining"?

TIL that people fly around the world demoing DTrace...

At the time, Sun were pushing it heavily as one of the two salvations for Solaris, so I'm not surprised.

I have to say that my limited experience in dealing with Sun as a customer mirrors Brendan's comments around a remarkable arrogance, and it probably played no small part in their downfall.

> At the time, Sun were pushing it heavily as one of the two salvations for Solaris, so I'm not surprised.

Yeah, I remember that. I kept thinking "this tool might be nice for C wizards but it does nothing for my day-to-day experience as smalltime Linux user / admin". The other big thing was ZFS, which was interesting, but they were extremely uncooperative with the license, basically ensuring it would never make it big.

This has me imagining a struggling engineer at Sun, trying to live up to the arrogance and falling short, who finds Brendan's work and decides to save his career by passing it off as his own. Then some high-level executive decides to make it one of the straws that will save the company...

This is a made-up story, so you are free to make up your own ending as to whether this was the world-travelling VIP, and if so, whether he had some partial or complete flashback on hearing Brendan's name. One thing we can be sure of: whoever 'carelessly' stripped the copyright notice out of Brendan's code had seen his name before (and it was, perhaps, the part of the code he was most familiar with!)

16 years ago, it must have been pretty refreshing.

Nice story and judging by it congrats on overcoming your "low-key" austrailian manner handicap ;)

What rights does a developer have in these cases? Can you get some compensation/damages for the license/copyright violation even if you were giving away the software originally?

Can you get more money if they violate the OSS license if you offer the software under a commercial license as well?

It makes me sad that the way a developer is expected to react when they discover that the Valuable Thing that they gave away for free is being sold by a Big Company for Big Money is to try to ensure that the Valuable Things they give away in the future remain free.

I'd much prefer to see the people who build Valuable Things show more interest in capturing some of that value.

There's this overwhelming narrative revolving around Open Source that makes it seem shameful to profit from your work. It's maddening to watch. There's no reason we as developers need to be the low man on the totem pole getting tread on by business people. We just set ourselves up that way and socially punish anybody who doesn't.

If that's what you took from the article, then you got completely the wrong end of the stick. The problem was the removal of the author's attribution and illegal relicensing. He says himself he was glad when Apple later included his tools in macOS with correct attribution and licensing.

Exactly. That was the problem that he saw.

The problem he should have noticed was that the Sun was selling the code he wrote for hundreds of thousands of dollars and not passing any of that on to him.

Step one shouldn't have been to worry about putting his header comment back in place and getting them the latest version of his code to sell to their customers. It should have been negotiating a redistribution license for his code if they wanted to continue selling it.

IMHO the problem is the term "free software" :

https://www.gnu.org/philosophy/selling.en.html

This works in the other direction: how many developers are willing to pay for their dependencies? Would things like npm even exist if you had to pay invoices for every bit of code loaded?

Finding code in multiple places....

Semi-related... I TA'ed a Comp Sci class a long time ago (back when they had to submit their code as print-outs). I read through the print-outs and noticed that the "look" of one of them seemed oddly familiar (blocks, line lengths, indenting etc). I went back through the others and found another one that was almost exactly the same.

Took it to the Prof and we agreed the ones that copied got 0 on the project, and the ones who allowed the copying got 50% of their mark. Honestly, they got off quite easy.

This reminds me of how the developer of MINIX, Andrew S. Tanenbaum, found that Intel put his operating system on millions of machines only after reading about it in the media: "I guess that makes MINIX the most widely used computer operating system in the world, even more than Windows, Linux, or MacOS. And I didn't even know until I read a press report about it."

https://www.cs.vu.nl/~ast/intel/

Heh. I've a few times asked questions, only to be pointed to my own blog for answers.

To be fair, yes those articles were on the same topic, but I'm actually trying to take the next step here. :-)

I've found my own blog posts in the search results while searching for something more than once.

The best part is when my own blog posts actually have the answer I was looking for - at which point I start feeling old and forgetful.

This has happened to me. And I wrote the post in the first place because I kept having to rediscover how to do the thing

Once I worked at company X, while there I have seen a said Library for universally accessing things in OS. It was written by our senior architect. Year later I worked at another company, there was this high strung developer boasting about his own library. He even put it up on a webpage - was before GitHub. It was same library at company listed above, so I ratted to the developer who wrote that library. I usually feel queasy about ratting, for some reason I did not feel a slight bit of dissonance.

". I usually feel queasy about ratting, for some reason I did not feel a slight bit of dissonance."

I feel it would have been ratting to the original creator to do nothing.

> It was something I and my consulting colleagues had run into before: The belief at Sun that only Sun could make good use of its own technologies, and anything created outside of Sun was trash.

Yep. See Sun's response to the Linux SPARC maintainers technical critique of Solaris for SPARC. Meanwhile at Red Hat we started hiring all the ex-Sun people that had been pushing for x86 internally at Sun and gotten frustrated with the flip flops (RHEL 3 on Xeon already demolished Solaris/SPARC) .

A lot of us at Sun in the Solaris org had no love for SPARC. Sun made a very typical and terrible mistake: it sat on its laurels. Sun created some awesome things then tried to lock-in and milk customers. Sun (and later Oracle) did this with SPARC and J2ME, among others. All the products they did this with are as good as dead today in terms of market share -- surprise!

Vendor lock-in is not great for the customer, but when you try to milk the customers, you end up risking taking them to the FYO point [0], and that is catastrophic for the vendor, and the vendor never sees it coming and can't help themselves.

Sitting on your laurels is not good. Don't do it. Innovate. Then innovate some more. Then never stop innovating.

  [0] Let me google that for ya: https://www.google.com/search?q=fyo+point

>The belief at Sun that only Sun could make good use of its own technologies, and anything created outside of Sun was trash.

As a former Sun employee, I can tell you that's true: people at Sun wouldn't even look at competing technologies because they were sure there was nothing useful to be learned from them.

That's why Bill Gates and Anders Hejlsberg were able to screw Sun so badly by examining and copying the good things about Java, and making something much better: C# and CLR.

While Sun totally failed to learn from any of the good things that Microsoft or Apple or anyone else did.

>We are better off with all the wood behind one arrow.

Nice reference to the old Sun slogan and 1999 April Fools Day prank, in which Sun employees put an enormous arrow through Scott McNealy's office.

https://findery.com/johnfox/notes/all-the-wood-behind-one-ar...

All your wood notwithstanding, it also helps to chose an arrow that isn't flawed and doesn't totally miss the target. For what it's worth, Scott McNealy also put all his wood behind another arrow named Donald Trump.

Scott McNealy has long been one of Trump's few friends in Silicon Valley

https://www.sfchronicle.com/politics/article/Scott-McNealy-h...

Trump held fundraiser at former Sun CEO Scott McNealy’s Silicon Valley house on Tuesday

https://www.cnbc.com/2019/09/17/trump-silicon-valley-fundrai...

Scott McNealy gets touchy feely with Trump: Sun cofounder hosts hush-hush reelection fundraiser for President

https://www.theregister.com/2019/09/17/mcnealy_trump_fundrai...

Something I should be aware of; in Go programming, they sometimes encourage you to just copy some code instead of add another dependency. However, if you copy code from a codebase with a certain license, you should, if everything is above board, include the license as well then for that bit of code.

I mean in practice it's tiny utilities that I'm too lazy to reimplement in the exact same way, but still, it's something to keep in mind.

Hah. Reminds me of this incident: https://newatlas.com/ai-art-auction-obvious-belamy/56984/

Someone downloaded the code for GANs (generative adversarial networks) from Github, generated (sampled) a painting using it, slapped the GAN objective function as a signature, and sold the painting for over $400k!

Are we being fools? Do you only get ahead in the world if instead of spending our precious time building things we use it cannabalizing other peoples work?

No.

While I don't believe in karma, I do believe there are consequences to misbehavior, even if one is not caught:

The temerity and lack of ethics to appropriate a project that someone else has written and claim it as one's own leaks into other areas of one's life. That kind of behavior is not isolated to just open-source software. Perhaps the world-weary thief of the OP took his experience as a lesson and changed his ways, but he likely continued bumbling around, behaving dishonestly, losing the respect of his peers along the way. Perhaps even that of family and friends. Perhaps he miscounts the points in a boardgame, or cheats on his spouse, but it won't be limited to this.

Contrast that to the life and career arc of the OP himself.

So, no, the fools are those who steal, caught or not.

Great read, curious to hear what happened after the demo.

It would be fun to make the American guy sweating profusely by saying something like "I'm going to sue the shit out of you" ;)

Once, someone tried to refute my argument using a post by a ghost user from github.

That ghost user was an older account of mine. Their interpretation of the post was wrong though.

I reacted to the situation by laughing slightly but didn't even bother explaining why. Because of the poor tone, I decided to let that person enjoy being wrong.

A very similar thing happened to me when I was pitching Gmail on anti-spam and realized they were running a forked version of Vipul’s Razor and claiming it was their own. They never contributed anything back... it’s unfortunately not uncommon.

As much as I think RMS himself is an utter embarrassment of a human being, stories like this are why I also believe the GPL is one of the most important contributions to computing, ever.

MIT/BSD-style licenses are practically begging large billion-dollar corporations to rip off your work wholesale and use it to generate profits while contributing only the occasional patch or two. I used to see this phenomenon on HN, where every time some distro had a new release the BSD folks would be in here reminding us that BSD runs Netflix and routers and Playstations and won't we please just donate? As if Sony and Netflix value these projects enough to use them for critical infrastructure but not enough to keep them financially solvent.

(The GPL is of course not a panacea; as TFA demonstrates, Sun would have got away with this, possibly forever, had the author not made his serendipitous discovery)

In this specific case, the files were under the CDDL, which is copyleft. The only thing that Sun did that was not allowed by the license was to remove the copyright notice. Had the scripts been under GPL, nothing would have been different. Anyone can sell GPL software, as long as they allow access to the source code and allow further motification and redistribution.

I think the GPL and FSF etc lost momentum with their GPLv3 push. I know that was the case for me. I really liked GPL (v2). Then GPLv3 came out and I was like huh? After that I became much more open to the lighter versions of things MIT / BSD.

GPLv3 is not really workable in terms of preserving developer freedom to do what they want with code (as long as they share their code back).

Obviously the powers that be disagreed and the GPL has been "upgraded" to v3, but was never impressed, and now much happier to contribute to MIT / BSD licensed products (which do allow you as the developer to do what you want with the code).

Would be curious if anyone has analyzed this.

I think the FSF appeared at a critical juncture and that the tools they built, that were totally free, helped to fix the direction that software was going. With the rise of Linux as the working GNU kernel an entire generation (or two) became aware and appreciative of open source which then went on to become the backbone of most of the internet and now those companies are some of (if not the) largest contributors to open source.

With that said you’re right, with GPLv3 they moved the fight into new domains that aren’t as obvious or really “as big of a deal” to a majority of people. Also with the rise of things like JavaScript GNU, under Stallman, became the old man crying at the children. Stallman hated the rise of “non-trivial” JavaScript and refuses to work with proprietary code so GNU could never have developed e.g. React or Tensorflow. We now have a new generation of open source tooling that was developed more in spite of the FSF than by it.

The current environment will in turn spark a new generation of tooling down the line that is even more removed from the likes of Stallman; who once responded to a request I sent to work on a JS library advertised on the GNU website with the fact that I should call it F/LOSS instead of open source (and nothing else.)

So while I respect the FSF for the work they did in creating what we have today, the time where they were leading the fight to save software is long passed. They won in some ways and the world is better for it, but they lost in others and I’m not sure the world is that worse because of it. Having trade secrets isn’t completely a bad thing as it allows competition and different implementations, though that part is simply my opinion I suppose.

I remember RMS saying that the license was based on these freedoms he enumerated, but after releasing software under GPL v2 he found out he had to explicitly add the freedom to actually RUN the software.

Remember that the idea of the GPL is the authors preserve and propagate the rights for the USERS.

He also once said "proprietary software subjugates people", which I thought was sort of over-the-top to say, but over time I think software in this era of dark patterns and privacy has unfortunately become very obvious.

The irony is the GPLv3 does more to address some of the problems we have with open source than most other licenses, but was rejected by many due to a lack of concern for these issues.

You can still use gplv2 if you like. The auto-update clause is optional afaik, and lots of projects are gpl2-only.

I suppose you're right though in as much as it splits mindshare.

Please try to refrain from personal attacks on people. It’s very disrespectful, especially when someone has clearly dedicated so much of their time to public works.

The BSD license doesn’t allow you to delete the copyright statements from someone else’s code and claim it as your own.

Yep, that's literally the only thing one can't do.

Sadly a lot of people don't even respect that.

Where does this expectation come from that a rich organization or person using open source software should be paying for it? That’s against the entire spirit of the open source license in the first place.

From the same place taxes come, or more generally, quite a lot of social obligations. It's the expectation that, if you're benefiting from commons, you should also contribute something back to the commons.

A company using open source software to make money is making money off commons. Makes sense they should feel obliged to contribute something back, and since they have the surplus of the best form of contribution - money - it's reasonable to expect them to donate some of it.

RMS is not the one embarrassed by your comment.

The only great thing I get from the story, at least a multi Billion dollar company thought your tools were so amazing it deserve paying their own VIP going on World Tour.

And no wonder why Sun failed to compete. A Cultural and management failure.

This comment section if full of interesting stories! Gold content here!

Sounds like a Silicon Valley (the series) plot.

Nice

Good story; I do find the “Australians are just the little guys” narrative a bit frustrating and a self-fulfilling prophecy though.

It's frustrating at times; at other times, it's a breath of fresh air to deal with engineers who just tell you what they're doing, without the overblown sales pitch.

Swings and roundabouts.

Agree it's cringe. The whole "little guy punching above his weight" thing is even worse in NZ.

Why do you find it cringe? In NZ I think it's even more true than Australia. It's a tiny, isolated country with a small population that isn't the hub of anything really.

Aussie and NZ compared to the US are completely different worlds in my eyes.

(I'm a Kiwi btw)

Have you ever been to the UK? That sort of mindset is widespread. In fact, there is basically an obligation that the country must, at all times, fight wildly above its level.

Can you explain? Is "little guy punching aboce his weight" applied to the country level? It is the first time I hear it in connection to NZ or AUS.

Could you fit in your nationality a few more times in the article? I can't tell what country you're from.

P.S: if you constantly boast about how humble your country is, you're probably not that humble.

Ok, maybe i'm too old or experienced with these type of things to really enjoy this article. The author might honestly be sincere as he wrote this but I felt it was a bit overblown and coming from negative feelings of being brushed off and rightfully so being upset that his code was stolen. It could just be there are some cultural misunderstandings as well.

He mentioned this "VIP" is a "Developer and dtrace expert". But reading that and the other details, I think this is probably not the reality and maybe was communicated incorrectly to him. I really doubt this guy was a "VIP" as he says.

My guess is this "VIP" was actually a pretty normal member on the dtrace project, could be a little senior and got the opportunity to go around and talk about it. I am sure they had a team somewhere who put together most of the software, maybe he was involved a little bit, but probably he was just as confused as everyone else about using that open source software - he probably knew enough to teach it, and how it worked, but so many people work on these type of projects, unless they sent the lead engineer he probably didn't know it deeply except enough to evangelize and teach how it works.

He mentions about being slighted by this guy a lot, saying things like "He wasn't impressed", "gave me a look like he didn't really believe me" etc. This might be true, but i suspect it's coming from his negative interpretation of the situation. This guy just traveled all the way around the world, was super exhausted, was possibly honestly confused what's going on - i certainly have been in that situation before.

The author also mentions he felt it odd that he (the author) was producing more dtrace tools than Sun was. This almost sounds a bit like indirect boasting. Large companies are slow. A dedicated passionate developer who is working alone or with a small team will always run laps around huge companies. This isn't odd at all. Companies often get distracted, can't focus on what's important, or decide not to do what is important for a product due to other business reasons.

In fact, as he found out, some engineer somewhere just ripped his stuff cause it was faster and easier for them to do it. Sun's team was not professional at all, even possibly breaking the law, which I think is the point of the article but the descriptions of the Dtrace guy who's job was to show Dtrace around the world lessened my enjoyment of the article.

I have said this elsewhere on this thread, but just to reemphasize: the person that Brendan met had absolutely nothing to do with DTrace -- to the point that when he told this story to me, I didn't even recognize the name. (And can't now remember it.) The DTrace team was very small (there were three of us), and the community of early DTrace users inside of Sun -- the earliest folks who could rightfully call themselves DTrace experts -- can be seen in the acknowledgements section of our 2004 USENIX paper.[0]

[0] https://www.usenix.org/legacy/publications/library/proceedin...

Brendan Gregg has a lot of clout. Besides that, he did eventually work at Sun proper, and later Joyent. I have no reason not to believe his account.

I am not saying it's factually incorrect. My point is that it includes a lot of Gregg's personal feelings (and maybe was informed incorrectly about the situation) and I'm just not sold that the guy who was assigned to show off Dtrace was the bad guy here

The example in the article is an exception but, companies (including Sun) are generally very careful about using open source, and using it without attribution would be the exception not the rule.

Large companies are slow, indeed. In the late 90s I wrote a few operating system plugins (nss_ldap, pam_ldap, GSS SASL plugin for the Netscape directory server) which were eventually obsoleted by native Solaris equivalents. The Sun versions were on the whole better engineered, if less flexible, because their OS team had a depth of experience that I didn't have at the time.

How is information in this blog related to Wikipedia article on DTrace [1] where one can read "DTrace is ... originally created by Sun Microsystems" and "Original author(s): Bryan Cantrill, Adam Leventhal, Mike Shapiro (Sun Microsystems)"?

[1] https://en.wikipedia.org/wiki/DTrace

Quite simply, it is not. The author is not claiming to have written DTrace, but rather, tools that made use of DTrace. From the introduction: "Sun Microsystems had just released DTrace" and "I was busy writing and publishing advanced performance tools using DTrace".

Sun developed DTrace the kernel building blocks, Brendan Gregg became an expert on it and made scripts that actually did useful stuff with them. The VIP was selling a GUI around Brendan Gregg’s scripts.

Bryan, Adam, and Mike created DTrace.

Brendan was the most amazing and prolific user of DTrace, from very early on. Brendan did not create DTrace, but in a sense he "made DTrace" what it is. And not just DTrace, but eBPF.

What do you mean? Brendan didn't create DTrace, he created DTraceToolkit and this VIP took his work and presented it as his own new DTrace-based product.

Look at footnote 28. https://en.wikipedia.org/wiki/DTrace#cite_note-28

Reply on news.ycombinator.com