Hacker News Reader

Comment by hyperpape | Hacker News Reader

You haven't given any mechanism that would make this happen. Specifically, some reason that the company would see contributing be beneficial to it. Of course, it benefits from the existence of open-source as a whole, but what material difference does its contribution make?

Take a small-medium sized business (say 5 - 50€ million annual revenue). Perhaps it can fund one library that is critical to it, but no contribution it makes will make a material difference to the trajectory of major products like Linux, or Python.

View on HN

The mechanism is clear: If you use Open Source software commercially, you are now liable if the software misbehaves. Thus, you have an incentive to make sure the software is correct. For (A)GPL software, you have to publish your contributions.

Not a lawyer, but it also seems to me that if you are a small shop, you might decide to pay, e.g. RedHat for taking on the liability. RedHat can pool these resources to make sure their software behaves as advertised.

(A)GPL don't require publication, just giving code to your users, who may or may not elect to further distribute the code.

> If you use Open Source software commercially, you are now liable if the software misbehaves. Thus, you have an incentive to make sure the software is correct.

As a software developer at a non-tech firm, I can gaurantee this means we will not be able to use any open source software. If we are granted an exception, it will be such that we must maintain a private version of the open source software.

This is simply a no-go for many companies of all sizes. The risk associated here is not something many (any?) legal department will be willing to take on.

You just ignored the second part of my message?

If your company is not willing to pay someone (another company ) for making sure the open source software used is actually working properly (and for assuming liability if it doesn't), then it can't use open source software. But then, what does open source lose when losing for profit users that are not willing to contribute back?

With a fifteen million euro penalty if you don’t. Yeah nice. If only we could also make fifteen million euros.

That’s clear.

What is due to some health condition they are incapable of fixing it anymore. Tough! Now the law is discriminating against old people because the risk of health deterioration is higher. Let me guess, tough. Old people shouldn’t be programming anyway and they don’t deserve to earn anything with it.

Of course, an SME company will not hire a developer to constantly perform security checks and apply patches for an important library libImportant.

What will happen is that company A will hire company B to do this and assume liability for it. If we set the annual cost of this at 100k, the monthly cost is about 8333 EUR. Let's say company B has 20 customers to protect the security of libImportant, that is 416 EUR per month and SME can afford that. There are OS that are of course used more frequently and that scales much better (i.e. cheaper per month). I actually see a new market niche here and perhaps they will find resourceful entrepreneurs.

Only if there are enough companies interested in the project. Will company B support cppcheck like that? I prefer kde to gnome, but my company won't pay for kde support when gnome already comes from some contract they have - at least kde is large enough that I expect someone to offer support - there are other desktops that are not popular and now have even less hope of breaking in.

Entrepreneurs are meant to solve real problems, not self-inflicted bureaucratic ones.

Security is a real problem.

Most users of open source don't really care to make a difference to the trajectory. Someone else made the linux drivers I need, that is good enough for me.

For linux you will probably be able to buy a certified Linux distribution for similar costs to Windows which is affordable to a medium sized company that needs certification. However that will only cover your basic OS: linux, ls, basic gnome desktop (but not many applications, just the window manager, a file management, and email client) - probably not a web browser.

However there are a lot of small projects that are not popular enough for anyone to certify like that.

Reply on news.ycombinator.com