Open Source Is Bad
Addressing elephants in the room
PyData London, March 2020 2023
| Casper da Costa-Luis |  |
|---|---|
Disclaimer¶
- I am not insane (probably)
- Nothing is 100% awesome
- Aim: avoid subjective moral rhetoric, focus on objective legal issues
Licences: Restricting Use¶
- Ongoing debate
- Open Source Initiative (OSI) [1] versus e.g. Hippocratic Public Licence (HPL) [2]
- Permissive "open" versus Restrictive "do no harm"
- Misses the point: 5 billion online users[3] = unenforcable
[1]: opensource.org
[2]: firstdonoharm.dev
[3]: statista.com/617136
Warranty = Quality + Reliability(?)¶
- OS devs give you free software "AS IS, NO WARRANTY"
- Problem: applying "buyer beware" philosophy to "users" (NOT "buyers")
- 1 million buyers = customers
- 1 billion (free) users = general public
Hardware analogy¶
- I generously make a billion rubbish bins for free
- I clear them regularly
- ... are you happy with me?
- ... NO!
- Public Safety: governments would insist on paid service contracts
- if I stop being generous, would garbage collect on the streets?
- need warranties; guaranteed "uptime"; quality control
Supporting Users AND Devs¶
- Big Co. depends on FOSS; but concerned about supply chain vulnerability[1,2,3]
- Solution: pay e.g. Tidelift[4] to provide support
- some payment forwarded to OS devs/maintainers to provide guarantees (security support responsiveness, sensible release processes, licence terms, etc.)
[1]: 2022 theregister.com: NPM faker.js & colors.js
[2]: 2019 arstechnica.com: NGINX police raid after Rambler files crimial (!) case
[3]: 2016 theregister.com: NPM left-pad chaos
[4]: tidelift.com
| Casper da Costa-Luis | |
 |
|---|---|---|