Web3 has certainly brought about a renaissance in craven astroturfing spam.
252 karma · joined October 16, 2021
What was enjoyable, becomes grunt work, like making the full set of unit tests for features users want, but you don't actually use yourself.
Whatever this handwavy 'other benefit' was, stops being beneficial.
But they're still paying the opportunity cost, sitting down as the older, greyer, burnt out maintainer while others get the benefit from their work.
https://en.m.wikipedia.org/wiki/Leech_(computing)
Contributors are not leeching the work.
Users who don't contribute are though, especially when they suck down developer time with issues.
You're not in a position to judge my understanding of FOSS because the word 'leech' makes you uncomfortable.
But as a continuous activity, over years, what exactly is in it for maintainers to get up in the morning and trade their remaining lease on life for value to be consumed by rich leeches?
https://www.theregister.com/2021/12/18/us_huawei_malware/
Itself a summary of a (detailed) Bloomberg article
I think digg is instructive.
"Look around and notice how the world actually works"...
No... projects want contribution more than money, the idea of paying the author is that they can then continue to contribute in the long term by proxy for the payers.
But FOSS-systemwide, I give much more than I take. It just needs leechers, who systemwide, give nothing back, to do the same.
That was exploited since April
https://github.com/nice0e3/log4j_POC
... this 'bug' is RCE on the logging infrastructure.
> Can you explain why you think the majority of authors/maintainers burn out?
Please try maintaining a popular FOSS project for a few years and explaining to your wife why you neither have any money nor have any time.
You can keep dreaming otherwise and enjoy a steady stream of security problems from your leeching.
Can you explain a bit more how it worked great for the bulk of maintainers / authors who don't see any return on their work, burn out and have to do something else?
There's no real way to secure finegrained node.js or python etc deps, since you have no clue if the original author who signs his sources should be trusted, or was malicious from the start and just biding his time, let alone everyone who contributed to every package.
What would help is independent audits and where needed help with hardening like fuzzing and asan / valgrind / static analysis. Just an extra security-minded eye on patches in realtime would be a big help (and maybe would have found the logging bug at hand).
> Webkit
Yes, commercial open source projects exist.
Parent and you say 'most'. Github says it has 200M projects on it, do you really think >100M of those are commercially funded? I don't think it is possible.
Go ahead and prove that.
Eg, he doesn't have to make access to all his music so it is contingent on his one credential, which can be revoked at any time by Apple. He can keep local copies of what he has bought, despite the ecosystem tries to make that difficult. Apple Music will delete any local copies it manages when the credential is invalidated.
https://www.guidingtech.com/what-happen-when-you-sign-out-ap...
But he did not seem to draw any lesson from it.
Yeah, so because of that they don't 'select' themselves to contribute to FOSS. If they don't have a PC, or can't program, likewise. I'm not responsible for any of that, as a FOSS maintainer, they turn up with patches in their hand, or they don't. If they don't, it's totally out of scope for me. With FOSS I don't even have a way to know such users exist.
If they want to contribute something, I can spend my time assisting that to happen, or not, that's the only button I can push.
>> cares > slave
I mean cares about race in the context of treating their patch differently because of it, this is the implication of the article. Maintainers are motivated to take in useful code.
> developers regular post pictures of sexy
If devs want to do that, they're not breaking any law. But a lot of contributors (eg, ones logging in on a work pc) would find it intolerable to the project's detriment. They'd lose me at tne word 'discord' anyway.
Ie, not in the article.
Can you elaborate on how that paper 'tells me' my own lived experience the last 20 years maintaining FOSS projects and offering patches 'isn't true'? That sounds arrogant on your part.
The paper tries to guess gender from github nyms and profile pics, and looking for google + integration, this seems like a red flag to me. I couldn't guess gender or sex from that, especially considering regional differences, like anime pictures for profile pics, unless it was explicitly telling me in the name. What they may instead be partitioning is the aggressiveness / confidence of the nym and its presentation, which corrolates later to what happens at the first hurdle for their patches.
For simple bug fixes, patches are typically acceptable right away. For more complex fixes and new features, some negotiation is needed with the maintainer as to how it should be done, there are often several ways that are reasonable, but eg, only one or two that align with future plans for the code. If the maintainer asks for a redo, a good proportion of contributors give up, they have exhausted their initial energy. Similarly, when asked for tests, or presented with considerations for other supported platforms the contributor doesn't care about, more give up. It requires extra confidence to approach the maintainer about preferred ways to do the patch before just starting on it. The maintainers are sometimes assholes (I am pretty sure, to everyone).
I think it's very hard to unpick why patches didn't go anywhere unless you follow the story of each, certainly you need abnormal energy and confidence to get started and get over the hurdles for anything nontrivial.
Open source contributors self-select. They have to put time in, usually for $0 and often without thanks. I don't know of any FOSS project who asks, or cares, about race or sex or anything else except code, or if the project is ill-maintained, at least your patch will get just as ignored regardless of your background.
The article reads like some (white) Karen who wants to talk to FOSS' manager, there isn't any.
If you think there should be more people sending patches or running FOSS projects, bring them, if their contributions are any good non-broken projects will be glad for them.
https://en.m.wikipedia.org/wiki/Betteridge's_law_of_headline...
It's just another reason to use -Werror so you cannot miss warnings.
I think you have to look one step deeper at how to deploy resources to encourage the system sustainably, not just throw money at the dead and dying.
Most people can talk easily about themselves, so if she doesn't have anything to fill a silence, general, open questions like, 'so, where did you grow up?' will get you over it and produce new content, as it were, that can lead forward. You can contrast or note similarities, but don't take over the flow unless asked about something or it's silent for a while.
Things in common are good but you don't need a carbon copy of yourself, you need someone compatible enough to get along with each other, and the hardest thing, both need a partner they can respect and trust.
If both sides feel further research needed, meaningful conversations will present themselves as it goes on. If either side don't feel it's good, be kind and accepting, she's putting herself out there same as you; if you learned a deal-killer, you'd be in the same situation having to gently detach. At the same time, if it's your feeling, you need to indicate that you would like to go on, so people typically propose doing 'it' (the date) again, or suggest going somewhere specific together at the weekend, so it can be turned down cleanly but also to show clearly where you are at.
Good luck.