Core-JS chief complains open source is broken, no one will pay for it
(2023/02/15)
- Reference: 1676449811
- News link: https://www.theregister.co.uk/2023/02/15/corejs_russia_open_source/
- Source link:
Denis Pushkarev, maintainer of the core-js library used by millions of websites, says he's ready to give up open source development because so few people pay for the software upon which they depend.
"Free open source software is fundamentally broken," he wrote in [1]a note on the core-js repository. "I could stop working on this silently, but I want to give open source one last chance."
The issue of who pays for open source software, often created or managed by unpaid volunteers, continues to be [2]a source of friction and discontent in the coding community.
[3]
Feross Aboukhadijeh, an open source developer and CEO of security biz Socket, had a lot to say on the subject in an email to The Register :
Maintainers are the unsung heroes of the software world, pouring their hearts into creating vast amounts of value that often goes unappreciated. These unsung heroes perform critical work that enables all of modern technology to function – this is not an exaggeration. These tireless individuals dedicate themselves to writing new features, fixing bugs, answering user inquiries, improving documentation, and developing innovative new software, yet they receive almost no recognition for their efforts.
It is imperative for the commercial industry and open source community to come together and find a way to acknowledge and reward maintainers for their invaluable contributions. As long as significant personal sacrifice is a prerequisite for open source participation, we'll continue to exclude a lot of smart and talented folks. This isn't good for anyone.
Maintainers of packages that are not installed directly, such as core-js, which often comes along for the ride when installing other packages, have it especially hard. Reliable, error-free transitive dependencies are invisible. Therefore, the maintainers are invisible, too. Perversely, the better these maintainers do their job, the more invisible they are. No one ever visits a GitHub repository for a transitive dependency that works perfectly – there's no reason to do so. But a developer investigating an error stack trace might visit the repository if for no other reason than to file an issue. This is the exact problem that the core-js maintainer faced.
For the large companies that get more from the free labor in open source code than they pay out in donations – if indeed they pay out – the status quo looks like a pretty good deal.
For individual developers, however, code creation and maintenance without compensation has a cost – measurable not just in financial terms, but also in social and political capital.
[4]
[5]
For Pushkarev, known as [6]zloirock on GitHub, the situation is that core-js is a JavaScript library that's been downloaded billions of times and used on [7]more than half of the top 10,000 websites – but the income he receives from donations has fallen dramatically. When he started maintaining core-js full time he could count on about $2,500 per month, and that's down to about $400 per month at present.
There are various reasons for this. One is that Pushkarev is in Russia, which since the illegal invasion of Ukraine has been subject to broad financial sanctions. It also didn't help that he served about ten months in prison in 2020 [8]for colliding with two pedestrians on his motorcycle, killing one of them.
[9]
And his circumstances are different now. "When I started working on core-js, I was alone," he wrote. "Now I have a family. [Just] over a year ago, I became [the] father of [a] son. Now I have to provide him with a decent standard of living."
[10]What happens when the maintainer of a JS library downloaded 26m times a week goes to prison for killing someone with a motorbike? Core-js just found out
[11]Warning over Java libraries and deserialization security weaknesses
[12]The great big open-source census: Most-used libraries revealed – plus 10 things developers should be doing to keep their code secure
[13]GitHub drops Atom bomb: Open-source text editor mothballed by end of year
Pushkarev acknowledges that he has received a lot of hate – and not just [14]social media hostility about code style.
"Today, one developer wrote to me a message," he wrote. "He called me a parasite on the body of the developer community that makes a lot of money spamming and doing nothing useful.
"He called me the same murderer as Hans Reiser, but who bought the judge and went unpunished. He wished death on me and all my relatives. And there is nothing unusual here, I get several such messages a month. In the last year, this has been added that I am a 'Russian fascist'."
But he also has received [15]a lot of support from people in the open source community who recognize that code sustainability is still a problem and confine their consideration to financial matters. (Or who simply [16]support fellow Russians ).
[17]
Pushkarev would prefer to focus on the economics of open source rather than the politics of his situation and of the country in which he resides. "Open source should be out of politics," he said, adding that he does not want to delve into these issues in detail as there are people on both sides of the border between Russia and Ukraine who might suffer as a result.
"I returned to Russia because it was a place where it was possible to have a decent standard of living for relatively small money and concentrate on FOSS instead of making money," he wrote. "Now I cannot leave Russia, because after the accident I have outstanding lawsuits in the amount of tens of thousands of dollars and I am forbidden to leave the country until they are paid off."
Such sentiment does not sit well with [18]Victor Shepelev – known as @zverok on Twitter and GitHub – a Ruby developer and software architect who resides in Kharkiv, Ukraine.
"For me, whatever (probably meaningful) discussion can be made around problems of open source sustainability, getting paid etc., is critically overshadowed by the 'Some words about war' section, and since it is there, I have no desire to comment on the rest of the issue," said Shepelev in an email to The Register .
"'Open source should be out of politics' (and in general 'Culture should be out of politics' – as software development as a part of human culture) is a nice truism to utter in peaceful and democratic society, like 'I have different opinion on taxation and voting system nuances than you, but this doesn't prohibit us from working together on interesting problems!'"
"In the time of genocide, being pronounced by the citizen of the country performing genocide, it is irresponsible to the level of disgust. The army of Denis's country kills my friends and ruins my country, and, according to some, no good and peaceful person in Russia has any role in it because it is all 'politics,' which they stand out of (lazily commenting on 'two kinds of evil' between perpetrator and victim of the genocide, when being asked). Good for them."
"This is as much as I can comment on [Pushkarev's post]."
Open source does appear to be broken, but in truth it was never whole or fair. Its problems were just more manageable in peaceful times. ®
Get our [19]Tech Resources
[1] https://github.com/zloirock/core-js/blob/master/docs/2023-02-14-so-whats-next.md
[2] https://www.theregister.com/2022/11/16/sourceware_open_source_openssf/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y@y7Ub5Bc9wSqXKzNkNRcAAAARA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y@y7Ub5Bc9wSqXKzNkNRcAAAARA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y@y7Ub5Bc9wSqXKzNkNRcAAAARA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://github.com/zloirock
[7] https://trends.builtwith.com/javascript/core-js
[8] https://www.theregister.com/2020/03/26/corejs_maintainer_jailed_code_release/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y@y7Ub5Bc9wSqXKzNkNRcAAAARA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2020/03/26/corejs_maintainer_jailed_code_release/
[11] https://www.theregister.com/2022/08/22/java_library_flaws/
[12] https://www.theregister.com/2020/02/20/linux_foundation_report/
[13] https://www.theregister.com/2022/06/08/github_atom_dropped/
[14] https://github.com/samdark/opensource-hate
[15] https://github.com/zloirock/core-js/issues/1179
[16] https://github.com/zloirock/core-js/issues/1179#issuecomment-1429107496
[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y@y7Ub5Bc9wSqXKzNkNRcAAAARA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[18] https://www.theregister.com/2022/03/17/ruby_ukraine_zverok/
[19] https://whitepapers.theregister.com/
"Free open source software is fundamentally broken," he wrote in [1]a note on the core-js repository. "I could stop working on this silently, but I want to give open source one last chance."
The issue of who pays for open source software, often created or managed by unpaid volunteers, continues to be [2]a source of friction and discontent in the coding community.
[3]
Feross Aboukhadijeh, an open source developer and CEO of security biz Socket, had a lot to say on the subject in an email to The Register :
Maintainers are the unsung heroes of the software world, pouring their hearts into creating vast amounts of value that often goes unappreciated. These unsung heroes perform critical work that enables all of modern technology to function – this is not an exaggeration. These tireless individuals dedicate themselves to writing new features, fixing bugs, answering user inquiries, improving documentation, and developing innovative new software, yet they receive almost no recognition for their efforts.
It is imperative for the commercial industry and open source community to come together and find a way to acknowledge and reward maintainers for their invaluable contributions. As long as significant personal sacrifice is a prerequisite for open source participation, we'll continue to exclude a lot of smart and talented folks. This isn't good for anyone.
Maintainers of packages that are not installed directly, such as core-js, which often comes along for the ride when installing other packages, have it especially hard. Reliable, error-free transitive dependencies are invisible. Therefore, the maintainers are invisible, too. Perversely, the better these maintainers do their job, the more invisible they are. No one ever visits a GitHub repository for a transitive dependency that works perfectly – there's no reason to do so. But a developer investigating an error stack trace might visit the repository if for no other reason than to file an issue. This is the exact problem that the core-js maintainer faced.
For the large companies that get more from the free labor in open source code than they pay out in donations – if indeed they pay out – the status quo looks like a pretty good deal.
For individual developers, however, code creation and maintenance without compensation has a cost – measurable not just in financial terms, but also in social and political capital.
[4]
[5]
For Pushkarev, known as [6]zloirock on GitHub, the situation is that core-js is a JavaScript library that's been downloaded billions of times and used on [7]more than half of the top 10,000 websites – but the income he receives from donations has fallen dramatically. When he started maintaining core-js full time he could count on about $2,500 per month, and that's down to about $400 per month at present.
There are various reasons for this. One is that Pushkarev is in Russia, which since the illegal invasion of Ukraine has been subject to broad financial sanctions. It also didn't help that he served about ten months in prison in 2020 [8]for colliding with two pedestrians on his motorcycle, killing one of them.
[9]
And his circumstances are different now. "When I started working on core-js, I was alone," he wrote. "Now I have a family. [Just] over a year ago, I became [the] father of [a] son. Now I have to provide him with a decent standard of living."
[10]What happens when the maintainer of a JS library downloaded 26m times a week goes to prison for killing someone with a motorbike? Core-js just found out
[11]Warning over Java libraries and deserialization security weaknesses
[12]The great big open-source census: Most-used libraries revealed – plus 10 things developers should be doing to keep their code secure
[13]GitHub drops Atom bomb: Open-source text editor mothballed by end of year
Pushkarev acknowledges that he has received a lot of hate – and not just [14]social media hostility about code style.
"Today, one developer wrote to me a message," he wrote. "He called me a parasite on the body of the developer community that makes a lot of money spamming and doing nothing useful.
"He called me the same murderer as Hans Reiser, but who bought the judge and went unpunished. He wished death on me and all my relatives. And there is nothing unusual here, I get several such messages a month. In the last year, this has been added that I am a 'Russian fascist'."
But he also has received [15]a lot of support from people in the open source community who recognize that code sustainability is still a problem and confine their consideration to financial matters. (Or who simply [16]support fellow Russians ).
[17]
Pushkarev would prefer to focus on the economics of open source rather than the politics of his situation and of the country in which he resides. "Open source should be out of politics," he said, adding that he does not want to delve into these issues in detail as there are people on both sides of the border between Russia and Ukraine who might suffer as a result.
"I returned to Russia because it was a place where it was possible to have a decent standard of living for relatively small money and concentrate on FOSS instead of making money," he wrote. "Now I cannot leave Russia, because after the accident I have outstanding lawsuits in the amount of tens of thousands of dollars and I am forbidden to leave the country until they are paid off."
Such sentiment does not sit well with [18]Victor Shepelev – known as @zverok on Twitter and GitHub – a Ruby developer and software architect who resides in Kharkiv, Ukraine.
"For me, whatever (probably meaningful) discussion can be made around problems of open source sustainability, getting paid etc., is critically overshadowed by the 'Some words about war' section, and since it is there, I have no desire to comment on the rest of the issue," said Shepelev in an email to The Register .
"'Open source should be out of politics' (and in general 'Culture should be out of politics' – as software development as a part of human culture) is a nice truism to utter in peaceful and democratic society, like 'I have different opinion on taxation and voting system nuances than you, but this doesn't prohibit us from working together on interesting problems!'"
"In the time of genocide, being pronounced by the citizen of the country performing genocide, it is irresponsible to the level of disgust. The army of Denis's country kills my friends and ruins my country, and, according to some, no good and peaceful person in Russia has any role in it because it is all 'politics,' which they stand out of (lazily commenting on 'two kinds of evil' between perpetrator and victim of the genocide, when being asked). Good for them."
"This is as much as I can comment on [Pushkarev's post]."
Open source does appear to be broken, but in truth it was never whole or fair. Its problems were just more manageable in peaceful times. ®
Get our [19]Tech Resources
[1] https://github.com/zloirock/core-js/blob/master/docs/2023-02-14-so-whats-next.md
[2] https://www.theregister.com/2022/11/16/sourceware_open_source_openssf/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y@y7Ub5Bc9wSqXKzNkNRcAAAARA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y@y7Ub5Bc9wSqXKzNkNRcAAAARA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y@y7Ub5Bc9wSqXKzNkNRcAAAARA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://github.com/zloirock
[7] https://trends.builtwith.com/javascript/core-js
[8] https://www.theregister.com/2020/03/26/corejs_maintainer_jailed_code_release/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y@y7Ub5Bc9wSqXKzNkNRcAAAARA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2020/03/26/corejs_maintainer_jailed_code_release/
[11] https://www.theregister.com/2022/08/22/java_library_flaws/
[12] https://www.theregister.com/2020/02/20/linux_foundation_report/
[13] https://www.theregister.com/2022/06/08/github_atom_dropped/
[14] https://github.com/samdark/opensource-hate
[15] https://github.com/zloirock/core-js/issues/1179
[16] https://github.com/zloirock/core-js/issues/1179#issuecomment-1429107496
[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y@y7Ub5Bc9wSqXKzNkNRcAAAARA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[18] https://www.theregister.com/2022/03/17/ruby_ukraine_zverok/
[19] https://whitepapers.theregister.com/
The Exploited
Potemkine!
Good will being commercially exploited by others? No kidding.
There's nothing new, and this will last.
Read this yesterday
sabroni
This guy has been giving away incredibly valuable work for his entire career and is now wondering why no-one wants to pay him.
Shows that you can be really brainy in one area and absolutely fucking clueless in another.
It's sad but ffs, spend some time on planet earth buddy.
Re: Read this yesterday
TonyHoyle
To a manager free = worthless. I had to learn that the hard way when I was younger. Used to do free work for charities.. Literally had one suddenly blank me and say they were going to 'hire a professional'. Like lady, this is my day job, you should have been paying about £1k a day for that work.
These days I've no problem submitting bug fixes for OSS projects but beyond that, cash or GTFO.
I really do sympathise with the guy, but he needs to walk away and start making some real money.. he doesn't owe those companies anything. So it'll break? That's on them.
"Free open source software"
Pascal Monett
I'm sorry, what in the word free do you not understand ?
You propose your code freely for all and then you're surprised that people take it without paying ?
Hint : if you hand out sandwiches and say that they are free, you won't get paid either.
That bit by Victor Shepelev disturbs me. I am in favour of all the sanctions we can put on Russia, but that doesn't mean that I am not aware that they cause significant harm to ordinary people. The degree to which an individual citizen can benefit or suffer due to the actions of their government far exceeds the amount of influence they have, particularly in a dictatorship.
Naturally, I also understand why somebody whose homeland is being destroyed wouldn't be interested in the above. Not being in either situation, I simply feel sorry for both of them being caught up in some particularly heinous geo-politics.
This said, I have difficulty interpreting the relevant section of the OP. I'm not sure what point he is trying to make or avoid. I do agree that open source and politics should be kept apart as much as possible, and while that may be idealistic everybody does have a right to their own ideals.
FOSS is broken, people need funding to work on it, GIFs at 11.