Tag open-source

I talked about this yesterday wrt pinning your dependencies, but these sorts of actions, even if the rationale comes from a good place, are NOT OK. twitter.com/techmeme/statu…

Post details

Maintainer of the popular open source networking tool node-ipc appears to have sabotaged the tool's code to wipe data on computers based in Russia and Belarus (@josephfcox / VICE) vice.com/en/article/dyp… techmeme.com/220318/p9#a220…

Techmeme (@Techmeme)Fri, 18 Mar 2022 16:51 GMT

Christina Warren (@film_girl)Fri, 18 Mar 2022 19:29 GMT

https://twitter.com/juliaferraioli/status/1499449536934137856

At some point, we're going to have to have a brutally honest conversation about the cult of personality in open source.

julia ferraioli (@juliaferraioli)Thu, 03 Mar 2022 18:21 GMT

I don't say stuff like this often, but if you think that #OpenSource is about one person, you are doing it wrong.

julia ferraioli (@juliaferraioli)Thu, 03 Mar 2022 18:20 GMT

Happy to see @nodejs be fully free at last. When considering @deno_land and other venture backed similar projects, remember to take the governance model of those projects into account. It can have quite the impact over time.

Post details

Exciting news today! Joyent has transferred ownership of the Node.js trademarks to the OpenJS Foundation to help protect the work of the Node.js collaborators. We’ve worked hard to make OpenJS a stable, neutral home for the JavaScript community. openjsf.org/blog/2022/02/1…

OpenJS Foundation (@openjsf)Mon, 14 Feb 2022 17:03 GMT

Pelle Wessman (@voxpelli)Mon, 14 Feb 2022 17:59 GMT

Since #Log4j you've heard how OSS vulns impact most orgs, how OSS is underfunded & we need to do more to help, but did you know OSS security has improved drastically in the last 4 years? In 2017, 35% of OSS libs used had a known flaw. In 2022 it's < 10% veracode.com/state-of-softw…

Chris Wysopal (@WeldPond)Wed, 09 Feb 2022 19:36 GMT

Successful open source is doing enough work to make people like your project, but doing it just poorly enough they feel compelled to help.

Post details

every open source project is like "we're a community project!" and then you look at contributions and it's like 1 person doing 70k commits a day and a long tail of 5 people doing readme fixes

kat.rs (@zkat__)Tue, 08 Feb 2022 06:35 GMT

Phil Nash 💉💉💉 (@philnash)Tue, 08 Feb 2022 12:35 GMT

My Open Source contributions stopped right after I joined Google. 😅

Nicolas A Perez (@anicolaspp)Sat, 05 Feb 2022 17:42 GMT

We need to stop thinking about open source sustainability as “raise enough money to work full-time.” Not every maintainer wants that. Sustainability might be better achieved by four people working ten hours a week instead of one person working 40 hours a week.

Nicholas C. Zakas (@slicknet)Thu, 03 Feb 2022 16:30 GMT

I wish we as an industry would stop underfunding and abandoning open source 🙃 relatedly i'm spending the rest of my week fixing stuff _again_ because of lack of lack of investment and support over the last several years

danielle 🏳️‍🌈 (@endocrimes)Tue, 01 Feb 2022 19:32 GMT

https://twitter.com/tanepiper/status/1487354505322762243

Now on the other hand if a company uses open source to profit from, then yes companies should likely have a duty to treat that project as a supplier and act accordingly.

Tane Piper (@tanepiper)Sat, 29 Jan 2022 09:18 GMT

I've been writing open source software for over 20 years and I'd say it's absolutely no one's duty to contribute to anything - that's conferring a moral or legal obligation on people. It should only ever be a choice from a person

twitter.com/parik36/status…

Tane Piper (@tanepiper)Sat, 29 Jan 2022 09:18 GMT

Being an open source maintainer: build something popular and you either die a hero or live long enough to be told, “you’re what’s wrong with open source. “ 🤷‍♂️

Nicholas C. Zakas (@slicknet)Fri, 28 Jan 2022 01:58 GMT

If you don't have a paying day job you will likely die of malnutrition while the corporations sponge off your #OpenSource work.

Post details

Being an open source maintainer: build something popular and you either die a hero or live long enough to be told, “you’re what’s wrong with open source. “ 🤷‍♂️

Nicholas C. Zakas (@slicknet)Fri, 28 Jan 2022 01:58 GMT

Justin Johansson (@IndieScripter)Fri, 28 Jan 2022 09:33 GMT

I started a sketch of my thoughts on the funding of open source and so far my conclusions are so bleak I hesitate to publish.

Laurie Voss (@seldo)Mon, 24 Jan 2022 02:28 GMT

If you are a multi billion dollar company and are concerned about log4j, why not just email OSS authors you never paid anything and demand a response for free within 24 hours with lots of info? (company name redacted for *my* peace of mind)

Daniel 🥌 Stenberg (@bagder)Fri, 21 Jan 2022 23:43 GMT

https://twitter.com/oleg_nenashev/status/1483705093153337346

... but pure altruism isn't scalable, it's difficult to build a big community just on that. There're many advantages of participating pro-bono: learning/mentorship, portfolio, addressing your own needs, exposure, etc. These reasons are totally valid, and they can be win-win

Oleg Nenashev (@oleg_nenashev)Wed, 19 Jan 2022 07:42 GMT

https://twitter.com/oleg_nenashev/status/1483691924452265988

For what it worth, there are many small projects being maintained by solo maintainers. Their time investment is way beyond direct and indirect benefits they get for it. This is where altruism takes place, and it should be appreciated. Kudos to these maintainers🙏

Oleg Nenashev (@oleg_nenashev)Wed, 19 Jan 2022 07:37 GMT

https://twitter.com/IAmJerdog/status/1483494934841901063

Pure altruism of maintainers

Oleg Nenashev (@oleg_nenashev)Wed, 19 Jan 2022 06:44 GMT

"Securing the (open source) software supply chain" naturally focuses attention "upstream" in the supply chain. And there is so much to do _downstream_ in how we assemble and operate software more securely. Improvements downstream don't need to wait on investments upstream.

Matthew S. Wilson (msw) (@_msw_)Sun, 16 Jan 2022 17:18 GMT

Everyone wants to create something new to start a startup But there are so many open source projects that are widely used, but don’t have anyone offering support or custom dev You might not get huge valuations, but there are a thousand million-dollar businesses out there

Daniel Feldman.ehh (@d_feldman)Sat, 15 Jan 2022 06:17 GMT

Looks like the AWS CDK is broken because the dependency on colors.js which has a totally hilarious bug: github.com/aws/aws-cdk/is… It shows "LIBERTY LIBERTY LIBERTY".

Soenke Ruempler (@s0enke)Sun, 09 Jan 2022 18:43 GMT

Thanks to this tip I just found out Datasette gets a mention in this academic paper! "What Else Is New? Open Data Users Need to Know What’s Changed" computer.org/csdl/magazine/…

Post details

Well worth searching your GitHub URL with Google Scholar. E.g. scholar.google.com/scholar?q=gith… Great way to find out if your code has made it into any academic publications.

Terence Eden (@edent)Sun, 09 Jan 2022 15:56 GMT

Simon Willison (@simonw)Mon, 10 Jan 2022 02:07 GMT

People screaming as someone fucked up their OSS code on purpose. If only there was some way AWS could have, you know, pinned a specific version of a package for cdk... Oh wait there was.

Chris McKee (@chrismckee)Sun, 09 Jan 2022 23:49 GMT

How can we even start talking about supply chain security and sustainability if a maintainer publishing a bad npm package version breaks everyone instantly? Stable, deterministic pinning is table stakes. theverge.com/2022/1/9/22874…

Filippo ${jndi:ldap://filippo.io/t} Valsorda (@FiloSottile)Sun, 09 Jan 2022 22:23 GMT

https://twitter.com/odarbelaeze/status/1479284733670567939

I would say that once you start having *other* people contributing and maintaining is not fully *yours* anymore?

Hugo Rodrigues (@hugorodrigues)Fri, 07 Jan 2022 03:32 GMT

https://twitter.com/PhIegethon/status/1479516388100395009

Nope. Absolutely, completely, incorrect. Total nonsense. OSS maintainers don't owe you anything. Says so right on the license. If you can't read, maybe stay off the internet.

Yawar Amin لول (@yawaramin)Sat, 08 Jan 2022 01:01 GMT

https://twitter.com/JoshuaKGoldberg/status/1479235187582148609

Often OSS developers make the world keep the lights on but aren't compensated for their time. Marak was struggling, asked help. Got nothing. In protest, removed his code and github suspended his account for removing something he owned the rights to.

Sam (@metruzanca)Fri, 07 Jan 2022 01:07 GMT

I found a one-digit typo in the docs for Python's typing_extensions. I wanted to be a good community member and fix it. I had no idea how much frustration that one-char PR was about to cause. Brace yourselves as I take you along on this wild ride 🧵 RT for reach appreciated 🙏

Predrag Gruevski (@PredragGruevski)Wed, 05 Jan 2022 17:36 GMT

If one wants to push a long-standing issue along, then don’t comment that, instead (if sensible in context) ask: “What can be done to push this issue forward? Are more details needed? More use cases? Someone doing a PR?” Then it becomes collaborative rather than exploitative 👍

Post details

Random comment on long-standing issue: Any updates on this? Me: would you like to work on it? Them: …

Matteo Collina (@matteocollina)Thu, 06 Jan 2022 17:04 GMT

Pelle Wessman (@voxpelli)Thu, 06 Jan 2022 18:30 GMT

Random comment on long-standing issue: Any updates on this? Me: would you like to work on it? Them: …

Matteo Collina (@matteocollina)Thu, 06 Jan 2022 17:04 GMT

As an engineer, @Neovim is critical infrastructure for my productivity, so I set up a monthly donation a few years ago through GitHub. It's great to be able to support a project that I rely on! ☺️

Post details

here's a recommendable new years resolution: donate in support of the critical open source tools you rely on. We do this at @discourse every year.

Jeff Atwood (@codinghorror)Fri, 31 Dec 2021 00:27 GMT

Alex Gude (@alex_gude)Sat, 01 Jan 2022 15:40 GMT

here's a recommendable new years resolution: donate in support of the critical open source tools you rely on. We do this at @discourse every year.

Jeff Atwood (@codinghorror)Fri, 31 Dec 2021 00:27 GMT

👍🏻 For folks looking for concrete and impactful steps they can take that aren’t personal: divest from using Facebook tech in your projects. Vote with your tech stack. twitter.com/quinnypig/stat…

Post details

https://twitter.com/QuinnyPig/status/1476372236776849408

Let me be clear: I think the company is molten garbage, but that's a very different thing than dunking on the humans who work there. I don't want to be remembered for a lack of empathy towards other people.

Corey Quinn (@QuinnyPig)Thu, 30 Dec 2021 02:17 GMT

Zach Leatherman (@zachleat)Thu, 30 Dec 2021 17:55 GMT

“The customer has nuclear weapons” is an unusual argument when inquiring whether a bug has been fixed yet, in an open source project. gcc.gnu.org/bugzilla/show_…

FX Coudert (@fxcoudert)Wed, 29 Dec 2021 14:53 GMT

did...did this person threaten an open source project with nukes when they asked to be paid?

Post details

“The customer has nuclear weapons” is an unusual argument when inquiring whether a bug has been fixed yet, in an open source project. gcc.gnu.org/bugzilla/show_…

FX Coudert (@fxcoudert)Wed, 29 Dec 2021 14:53 GMT

Manish (@ManishEarth)Wed, 29 Dec 2021 14:57 GMT

the most important thing about the log4j incident is that it’s clear and incontrovertible evidence in support of whatever beliefs i already have about software development

henry 🌘 (@hdevalence)Mon, 13 Dec 2021 17:29 GMT