HN Reader

> You might not want to leave Debian (which is fundamentally people) in the lurch over a security issue, but if a corporation shows up with a security issue, well, you tap the sign.

I think that many people have done this, and all of them were deposed and replaced with someone who would "play ball" (I.E., work for free). Go ahead, keep an eye on Libxml2, we'll either see this reversed, or we'll see libxml3 promoted from all angles and libxml2 decried as "deprecated".

Note that if that happens, it doesn't mean libxml2 is actually bad, it just means that it no longer fits the needs of the corporate overlords, and they need YOU to believe that it's no longer good so you won't waste their time with support requests.

I feel bad for the libxml2 maintainer. The project was originally intended for parsing GNOME configuration files, but then a bunch of corporations started using it to parse untrusted data with much higher stakes. I hope that both the decision not to prioritize security issues and the new notice in the README saying it's foolish to use the project to parse untrusted data will encourage corporate users to either switch to a different project or do more to improve its security than dumping security reports onto an unpaid maintainer.

I will say that all of the comments saying that open source licenses should change to formally prohibit this behavior are a bit naive. Ever since the Open Source Initiative was founded in the late 90s, its express purpose has been to boost the adoption of free (now "open source") software by pitching it to corporations as a way to cut costs. This means that they'll never approve a license that requires certain users to contribute to the project, monetarily or otherwise. Of course anyone's allowed to license their project any way they see fit, but they'll have to call it something other than open source and accept the limited distribution and userbase they'll see as a result.

At this point, why shouldn't the licences change?

Sharing the result of collaborative efforts liberally makes sense. Wanting to be able to modify software and redistribute modifications makes sense. Allowing software to evolve in a broader eco-system makes sense.

What isn't seeming to make sense is how OSS software is used commercially and the way that skews the culture and priorities of open source projects. What purpose does the lack of commercial restrictions serve?

No restrictions on commercial use at all seems naive (and perhaps plain ideological) at this point. I used to think that things were too embedded to change but it does feel like a major shift is fermenting and has been for a while.

> They're not in open source as a cooperative venture, they are using it to make money

> Existing open source licenses, practices, and culture don't draw this distinction

I disagree for the most part. Corporations avoid copyleft licenses like the plague. It's the term open-source that includes 'free beer' licensed software that created this confusion.

Personally, the distinction I draw isn't between corporations and cooperation as per the article ("they make money" is kind of an arbitrary difference IMO), but just that in general maintainers have no obligation to do any sort of work for free.

So like, regardless of the user of the software, one should understand that there really is no warranty, or promise of quality or support from FOSS.

If one (whether it be Debian or Apple) needs a feature, bug fix, or security fix, one can ask for it, but don't expect anything.

The best way is to do it themselves, and share their code if they wish to or are obligated to under the GPL. Or commission a programmer or the maintainer to do it. Or buy a support contract from the maintainer. Or encourage it by doing micropatronage and voting for it.

The current attitudes and licenses of FOSS, while good in many ways, have also enabled a ton of exploitation and free-riding, and people need to acknowledge that.

Nobody should be giving Bezos free work.

I think this is correct and projects like DuckDB are doing a food job at supporting both halves by triaging issues also based on the identity and affiliation of the author (no anonymous issues) and converting them into supporters https://duckdblabs.com/community_support_policy/

This passive approach of libxml2 where the software remains community only is just fine and totally fair, but corporate users can pay up if there's a clear offering. What they actually get doesn't need to be much, but if it does need to be clear. Of course this does change the project into hybrid community/corperate open source but there can be a spectrum there where a lot of time and resources is carved out for the community approach and the corperate sponsors are given just enough to keep them happy. In a way some more corperate focussed Linux distributions are also an example of a hybrid approach really given the two worlds are very much linked.

It's also notable that these companies often dont respect the terms of foss software at all. Anyone worth their salt can tell you that training your LLM on gpl3 code would make it a derivative product, as it is able to reproduce large parts of that code. LLMs that are currently earning Google, Facebook, Openai, etc, billions, while they obviously dont make "their" products available under gpl3.

> This policy will probably make some downstream users nervous, but maybe it encourages them to contribute a little more.

This is an understated but brilliant framing. Oh I know they won't contribute, users will continue to apply pressure through issue threads saying that their clueless security teams are breathing down their necks. But at least you'd hope this gives pause.

The linked issue is worth a read, it's a shame the burden that corporate leeches like apple and google have placed on him. To them this project is simply free labour they have assumed they are entitled to and by extension are subject to their individual security theatrics.

https://gitlab.gnome.org/GNOME/libxml2/-/issues/913