Hacker News Reader

Comment by ChuckMcM | Hacker News Reader

I think this is a badly needed capability. But the SSL bug (which is highlighted) and the Netflix bug, really brought home an interesting question, "Who is writing your software?"

A company has a whole stable full of developers, but if they are all using the average of 8.9 open source "components" in their stacks, really there is a huge software development "organization" that is essential to their business, larger than their paid employee base, that is both absent from the building and outside of their control.

Think about that. Its bad enough when your middle managers don't know how the sausage is made, what about your engineers? And what are you paying the engineers for anyway? And why are they getting paid essentially to put into action stuff that other people wrote? Its a very interesting question for me to think about.

View on HN

At this point it would be pretty difficult NOT to rely on enormous stacks of other people's software, from OS's to compiler/interpreter runtimes et. al., library code, frameworks, etc.

However, there is definitely something to be said for the idea of knowing (at least to some useful degree) how the whole thing works if you're going to rely on it.

Right now I think the industry as a whole is beset with far too much new code and "innovation" for its own sake. An obvious counter would be a radical push for simplicity, but I don't see that happening.

> why are they getting paid essentially to put into action stuff that other people wrote

Isn't that true of almost every tool in a modern economy with division of labour, including something as simple as a pencil[1] that you use to jot down notes?

[1] http://en.wikipedia.org/wiki/I,_Pencil

I may not know how to make a pencil, but I know precisely how a pencil works. I can be reasonably confident that it is not going to start writing in ink one day, because an upstream maintainer thought it would be a cool feature.

But that "problem" has to be equally true in any field of engineering you can care to mention.

Nobody goes back to raw materials for all needs, it's simply impossible. There's no reason it should be less so in software.

Many car companies chose to build their own engines, but not all of them do. I'm pretty sure that among those who do, they still don't manufacture all of their own engine components, or even the bolts used to assemble the engine, or the wires used to hook up the engine electronics, and so on.

really there is a huge software development "organization" that is essential to their business

Or even worse, no organization. We're all using a bunch of unmaintained software (e.g. bash) and it never occurred to us to notice that fact.

I was under the impression that bash is maintained. The internets suggest currently by Chet Ramey, and it looks like there have been tens of patches this year.

Yeah. I hope software management gets less comfortable with these answers and put their money toward real sustainability such that we see the commercial sides of FOSS projects grow in quality and quantity, with sustainable business models around sponsored features, bug bounties, support engagement, etc. and no need to stoop to licensing the software itself for money (neither restrictively free/commercial dual licenses or enterprise/community feature splits).

That would be the ideal case, a sort of FOSS non-profit structure. Hard to create the economic alignment however.

One thing that might be able to help is to improve the incentives around security. If some more liability for misuse of systems fell on those who deployed those systems, then people would push harder for quality or pay for indemnification, and either way that puts more dollars toward stability.

That said, I'd note that I'm a more than a little concerned that it would be done horribly wrong if attempted.

How far down the stack are you willing to go? Firmware? Hardware? Hardware components? Processing of natural resources required to create those hardware components? Methods for extracting natural resources? The geological reasons why those natural resources occurred in the first place?

Reply on news.ycombinator.com