sometimes the open-source sucks

[bd139]

Synopsys is poncing their static analyser there. Amazing the last thing I touched that coverity had given all clear I found a trivial privilege escalation hole in it. YMMV but you can’t measure let alone define quality in a complex system defined by static rules, only the compliance with the rules. Simply you can write a turd that’ll green light a static analyser easily.

Edit: all the steamers in OpenSSL are a good example for ref.

[legacy]

Regarding donations

I have randomly known a guy who represents another example of how open source can go wrong - "you want me to fix PCI code, and on top of spending days if not weeks of work on it I should pay for the privilege of buying a PCI XIO bridge from you?" - I had contacted him with the idea of collaboration in mind, and he asked hardware donation like if you are obliged to pay someone.

That's crazy, a donation is a voluntary decision that you make if you like to do it, and it cannot be imposed by anyone for any reason!

He complained that he cannot find hardware on eBay without the need to sell an arm, two legs, and both eyes (the XIO_PCI bridge still cost 300 euro), so I offered to mediate with a couple of sellers from whom my squad buy things simply because we are in a good touch with them hence they can apply a discount, even to him if we persuade them to do so.

And there are also a couple of tricks for the purchase if you know a couple of hardware hacks. I offered to explain, of course for free and this way he would have only paid 50-60 euros rather than 300 euros.

But, in this case, the problem is not opensource, but rather that you cannot deal with a donkey head ( I want to be polite). In fact, You know what? This dude claims and asserts that this is the case where he MUST (must?!?) receive the hardware entirely (entirely!?!) for free, as a donation, because he has been around for the last twenty years and bla-bla-bla as if he was the most contributor to the opensource ever.

I have not even seen his name in any patch, but this is not the point, but rather sometimes open source really looks rotten and sick to me with certain persons.

[Monkeh]

Regarding donations

I have randomly known a guy who represents another example of how open source can go wrong - "you want me to fix PCI code, and on top of spending days if not weeks of work on it I should pay for the privilege of buying a PCI XIO bridge from you?" - I had contacted him with the idea of collaboration in mind, and he asked hardware donation like if you are obliged to pay someone.

That's crazy, a donation is a voluntary decision that you make if you like to do it, and it cannot be imposed by anyone for any reason!

He complained that he cannot find hardware on eBay without the need to sell an arm, two legs, and both eyes (the XIO_PCI bridge still cost 300 euro), so I offered to mediate with a couple of sellers from whom my squad buy things simply because we are in a good touch with them hence they can apply a discount, even to him if we persuade them to do so.

And there are also a couple of tricks for the purchase if you know a couple of hardware hacks. I offered to explain, of course for free and this way he would have only paid 50-60 euros rather than 300 euros.

But, in this case, the problem is not opensource, but rather that you cannot deal with a donkey head ( I want to be polite). In fact, You know what? This dude claims and asserts that this is the case where he MUST (must?!?) receive the hardware entirely (entirely!?!) for free, as a donation, because he has been around for the last twenty years and bla-bla-bla as if he was the most contributor to the opensource ever.

I have not even seen his name in any patch, but this is not the point, but rather sometimes open source really looks rotten and sick to me with certain persons.

Indeed, it is very hard to deal with someone who expects you not only to spend your time working on their problem for nothing, but also to spend your own money on the hardware.

[Nominal Animal]

Do note that the problems discussed here are not with the software, but with the developers.

Sometimes the two are related, as in systemd being technically crap because its developers lack in design and programming skills; but sometimes they are completely separate, as in systemd folks mostly ignoring bugs and fixes because they think they are better than anyone else, and do not believe their code can have bugs.

The GCC project used to have the latter to the hilt a decade or so ago, but seems to be going in a better direction now.

A lot of open source projects suffer from bugs, because most developers aren't interested in fixing code that does not affect themselves, and will instead spend their time developing new features they think they might like.  Only projects with discipline -- either the company paying the devs, or a project leader who won't accept new features from developers who don't respond to bug reports -- can avoid this.  But few people have the necessary discipline.  (It is also the reason why democracy does not work for software projects: nobody wants to do the dull unglamorous bug-fixing work.)

It is often useful to distinguish code issues from developer issues.  That way, you put the right thing on your shit list.

[hermit]

Kinda sucks that you have to wait for a project to mature to see how they will treat users.  I don't know if source forge still exists but it used to be frustrating going there and finding 10 abandoned or poorly maintained projects because everyone was duplicating efforts because THEY wanted to be the head god.  People wanted to imitate Torvalds right down to his obnoxious behavior because they were under some stupid delusion that you had the right to be an axehat as project lead.

[rjp]

Its always funny with conversations that attempt to turn hundreds of thousands of different developers and software systems into one "true"  opinion.

I could offer anacdotes of terrible systems and great systems all day, from both sides of the fence.

Open source is 2 seperate worlds as far as I can tell so its meaningless to lump them - things like linux are no longer community driven and most of the code comes from professional coders working for the big boys, ditto things like postgres and other core web applications.

then we  have 100's of thousands of projects done by random indivuduals and small teams  ,and with those its highly variable and you get what you get, and yes, you need to read the source and fork if required.

[Nominal Animal]

I have randomly known a guy who represents another example of how open source can go wrong - "you want me to fix PCI code, and on top of spending days if not weeks of work on it I should pay for the privilege of buying a PCI XIO bridge from you?" - I had contacted him with the idea of collaboration in mind, and he asked hardware donation like if you are obliged to pay someone.

That's crazy, a donation is a voluntary decision that you make if you like to do it, and it cannot be imposed by anyone for any reason!

No, you're in the wrong here, legacy.

Now, I happen to know your intent was not to get a new "customer", but simply to invite a new person to participate in the development.  Yet, that is not what it looks and feels to anyone on the other side.

You see, I've been on both sides, and I can tell you that being on the other side, treated like you treated that person, hurts.

What you did, is akin to asking someone to come to an art exhibit, but at the door, tell them they need to pay for their own ticket.  Or asking someone for a bicycle trip, and when they say they don't have a bike, you offer to sell them one.  It does not work that way; you look like someone wishing to exploit others if you do that.

You need to learn to examine your interactions from the other side, to understand how your actions and communications are perceived, because others cannot perceive your intent directly.  I am telling you this, because this is exactly what I myself had had to learn to do.

If you look up invitation in a dictionary, you can see some of the associated expectations.  The associated term solicitation should tell you there is a negative side.  Consider yourself being invited for brunch, for it to turn out being about you buying something from that person.

When we talk about building a community, inviting new members with technical ability is delicate.  It is very easy to be seen as looking for free labour to exploit.  A lot of companies and clients do that -- either as "skill tests", or as "you'll get so much kudos for this!".  So, the community organizer needs to prove their good intentions first.  I am sure all developers have found themselves in a situation they have been exploited for free or cheap labour, and most hate it as much as I do.

The way you should have approached that developer person, is to offer to lend them one, explaining that as a small community of volunteers, you cannot yet afford to buy them one.

[Nominal Animal]

I don't know if sourceforge still exists but it used to be frustrating going there and finding 10 abandoned or poorly maintained projects because everyone was duplicating efforts because THEY wanted to be the head god.

That's exactly a people-problem, and nothing to do with open source per se.  You see that even more in nontechnical non-profit organizations.

Open source is 2 seperate worlds as far as I can tell so its meaningless to lump them - things like linux are no longer community driven and most of the code comes from professional coders working for the big boys, ditto things like postgres and other core web applications.

I don't see a distinct difference between commercially-backed and community-driven projects; but I do see a difference in well lead (benevolent dictatorship by a capable person) and poorly managed projects.

Companies can pay developers to fix bugs, and that is a major factor; it makes management simpler and much easier.  Bounties only work for small minority of devs, often the younger ones; not everyone enjoys a gig economy.

You see, there are a lot of commercially-backed projects with poor leadership/management/dev control.  Commercial backing won't guarantee anything, it just makes management easier, because money is a powerful incentive.  Consider PHP: a lot of money has been sunk into it, and it is used by a lot of people, but it is a poor, insecure tool for the things it is used for.  All that money has given it additional warts and publicity, but hasn't made it technically any better.

My little hate button is the forked Linux distros manufacturers provide with single-board computers, with very little support, and finite lifetime.  They are an awful example of how commercial backing is no guarantee.

[rjp]

My little hate button is the forked Linux distros manufacturers provide with single-board computers, with very little support, and finite lifetime.  They are an awful example of how commercial backing is no guarantee.

Definately, but then again, thats a one time bitten, 10 times shy situation, I think the initial flurry of excitement over those things has died down and now the market is much more mature and focused on the long term support and lack of binary blobs.

I know I look for a publically maintained kernel, onboard emmc and confirmation that the features on the chipset I want are actually supported before I purchase now.

I don't see a distinct difference between commercially-backed and community-driven projects; but I do see a difference in well lead (benevolent dictatorship by a capable person) and poorly managed projects.

Companies can pay developers to fix bugs, and that is a major factor; it makes management simpler and much easier.  Bounties only work for small minority of devs, often the younger ones; not everyone enjoys a gig economy.

You see, there are a lot of commercially-backed projects with poor leadership/management/dev control.  Commercial backing won't guarantee anything, it just makes management easier, because money is a powerful incentive.  Consider PHP: a lot of money has been sunk into it, and it is used by a lot of people, but it is a poor, insecure tool for the things it is used for.  All that money has given it additional warts and publicity, but hasn't made it technically any better.
 

I do make a distinction in the sense that many of the posters rant about lack of documentation, or snarky "fork it and fix it responses" .. I expect those from the random chaos of small teams and individuals, they literally owe you nothing and are perfectly allowed to be busy on something else and not care how useful your contribution might have been.

Those code bases are take it or leave it, be glad if something good happens and you form a relationship, move on if you dont.

[bsfeechannel]

It is interesting to note that after all these years of free software people still struggle with the concept.

Richard Stallman regrets that the word free in English means free as in free beer and free as in freedom. And also disapproves of the fact that to avoid this ambiguity people chose to call it open source, as it is misleading, since you can actually have open source software with restrictive licenses.

Free software is free as in freedom. It has nothing to do with your agreements to have access to it or have it modified. Once I have it, what can I do with it? Can I use it the way I want? Can I modify it to my needs? Can I correct its bugs? Can I copy it? Distribute it?

So free software is not about get your software for free, have a say in its development for free, have support for free, tell the developer what to do for free, or the like.

Free software is not about software quality either. Although we have very high quality free programs around, there are crappy free programs out there, just like high quality and crappy proprietary ones.

People also confuse democracy with anarchy and use other inconvenient political metaphors to describe how free software is developed.

When you report a bug, you do just that. When you have a patch that solves your problem, you have just that.

When I report bugs, I don't do it because someone has an obligation to solve it, but to raise awareness about the problem. Maybe there's someone out there who knows the solution, or gets interested in solving it. I don't know. It is just an announcement.

If I really want the problem solved, I obviously will have to hire someone to do it. Or tackle the problem myself.

When I find a solution, I also report it because I think it is a retribution for all the voluntary work that made it possible for me to have access to the software. I wouldn't have a bug if the program had not been written in the first place.

[techman-001]

My little hate button is the forked Linux distros manufacturers provide with single-board computers, with very little support, and finite lifetime.  They are an awful example of how commercial backing is no guarantee.

Mine too!

Commercial involvement is often a guarantee of a slapped together Linux distro, poorly understood by the seller and only provided to give the illusion of a finished hardware product while they offload their cheap crappy stock before closing their doors and moving on to the next quick buck.

[Nominal Animal]

When I find a solution, I also report it because I think it is a retribution for all the voluntary work that made it possible for me to have access to the software. I wouldn't have a bug if the program had not been written in the first place.

One of my personal flaws is that I severely overreact when completely ignored.  I can take negative feedback, but being ignored I do not handle well.  I understand how difficult it is for a developer to consider patches (be they fixes or added features) coming out of the blue, without knowing the context or the submitting developer; and I understand why so many patches get overlooked (not examined by developers).. but it still is a major problem for me.

Code of Conduct people usually do not see how they are in fact making it risky for developers to respond to bug reports, fixes, or patches out of the blue -- because anything can be considered offensive --, and are in fact strongly encouraging devs to completely ignore submissions from unknown people.  This drives tribalisation and projects turning inwards, excluding "outsiders", even if the original intent was completely opposite.

Note that I do not intend to derail this thread by politics; I am pointing all this out to show how complicated it is to manage a development community, to get the effects/results/response you want.  My own flaws and quirks exclude me from several, and I've had had to learn a lot about interpersonal interaction to get even this far.  In the same sense, I wish legacy understands that the point here is to get them to change their behaviour, because it is not congruent with their intent.  That is, to get the results and interaction they want, they need a different approach.  Hopefully, I've at least roughly outlined why and how.

[bsfeechannel]

Note that I do not intend to derail this thread by politics

The mention of politics was not aimed at you specifically. My intention was exactly to dispel this kind of analogy.

[thinkfat]

Let me see if I can piece this story together:

You take a piece of free software to give you a headstart on a hardware project. You run into trouble for lack of understanding of the hardware and the software structure. You ask the maintainer of the software package for advice. He replies that the particular hardware you're using is obsolete and he cannot help you right away because he worked on that hardware ages ago and doesn't recall the details, but he would do it if you paid for his time and offers you a reasonable rate. You decline and fix the problem yourself.

Then you go and complain loudly on a public internet forum about how unfairly you have been treated, because the maintainer would like to integrate the patch you developed so that others don't run into the same problem.

This demonstrates a level of entitlement that is just mindboggling.

[Nominal Animal]

The mention of politics was not aimed at you specifically. My intention was exactly to dispel this kind of analogy.

I understand; my point was more that team management, or project leadership, is completely different to politics in general, and that what one considers politically effective, does not mean it is applicable to development projects.  I would not want to be ruled by a benevolent dictator in real life, but as a project leadership method, it works orders of magnitude better than democracy.  That sort of thing.

Project leadership and community building is a separate art, but one that can be learned.

This demonstrates a level of entitlement that is just mindboggling.

I disagree: entitlement is not the right word.

It is a matter of not understanding how project management and inviting new members into a collaboration works.

You can ascribe it to malice or entitlement or lack of empathy, but from offline discussions with legacy, I do not believe it is so.  Legacy has even shown that they are willing to work hard to fix an existing somewhat related problem previously, so I believe there is nothing negative or selfish in the intentions here; only a severe, but fixable, bug in the implementation, related to a misunderstanding of how project communities work.

Some people have an instinctual grasp of that.  Some of them become natural leaders, the rest of them happily exploit other people for their own gain.  People like me have to learn it the hard way, but it can still be done well that way too.

[legacy]

"you want me to fix PCI code, and on top of spending days if not weeks of work on it I should pay for the privilege of buying a PCI XIO bridge from you?"

This sentence was sneaky because he had already told me that he wants to fix PCI code, and he already told me that he wants to buy the PCI-XIO. Here he was only trying to make me feel wrong, in order to persuade me to donate the hardware for free.

Oh, let me tell you what happened in the past with similar dudes.

One year ago we offered hardware for free under the agreement that the receiver would have not sold it on eBay but rather used it to collaborate.

Don't you guess what happened then? 

That feeling and belief that one can rely on someone went down hell because certain human beings do suck. But humans cannot be all bad, ain't it?

[Nominal Animal]

What you did, is akin to asking someone to come to an art exhibit, but at the door, tell them they need to pay for their own ticket. 

No. This is wrong.

Perhaps, but based on the information you posted at the beginning of the thread, I disagree.

This is not the moment to be defensive, either.  Admitting error, no matter how painful, allows one to reassess, adjust, and learn.  If there is no pain, there is nothing to overcome, nothing on the line.  I do not know all the details so I do not know if I am right or not, but I have been where you are now, and I tell you, you should take this as a learning opportunity, and analyze the sequence of events to the fullest of your ability.  But be brutally honest to yourself about the ways your own communications may have been (mis)understood; examine the events from all sides you can, avoiding any preconceptions or assumptions: do not make it easy for yourself, or you won't learn.  There is no need to explain anything to anyone else; only to learn from this. 

The simple fact is, you and your community is suffering because of communication issues like this one.  Yes, the world of humans is an unfair and quite crappy place, but we cannot force or even entice others to change.  All we can do is change the ways we ourselves interact with others.

[legacy]

Admitting error, no matter how painful, allows one to reassess, adjust, and learn.

if I should consider what those guys said, it would mean my squad is useless and inadequate for everything related to the opensource, and we'd better close the forum and all the related projects.

This hurts, but if going ahead this way is a mistake, then I will for sure close everything.

[Siwastaja]

Admitting error, no matter how painful, allows one to reassess, adjust, and learn.

if I should consider what those guys said, it would mean my squad is useless and inadequate for everything related to the opensource, and we'd better close the forum and all the related projects.

The problem is, you didn't originally provide this information. The picture changed quite a lot with your latest posts.

Still, even if they were total manipulative assholes, there usually is something to learn.

[jadew]

I'm not sure I understand the situation anymore, maybe because I'm tired, but am I getting this correctly that the guy asked for a board, so he can add support for it and you refused?

If yes, then that was your first mistake. I don't know what kind of board it is, but I doubt its price wouldn't have been covered by even just one day of work.

[m98]

And this is one of the reasons why I'm never going to bother using complex free software for anything productive if there's a commercial alternative.

[GlennSprigg]

I guess we can all have good & bad experiences from either Open-Source or Commercial Vendors
when/if we try to offer help or 'fixes' etc.....  Once I found a major bug in a JavaScript Module, being part
of a quite powerful and very popular 'WebSite Creation' package, causing errors due to certain parameters.

I re-wrote the section, & submitted it to them via email. By the very next day, they emailed me back,
confirmed my diagnosis/rewrite, thanking me for my efforts, and informed me they have now included it
in the very next revision Update coming out shortly !   

Maybe I was just 'lucky' ?
P.S.   In 'payment', they even gave me a free license for one of their 'paid' software modules. 
All I wanted, was to simply help...

[Nominal Animal]

Maybe I was just 'lucky' ?

No, you just contacted a well-managed project.

And this is one of the reasons why I'm never going to bother using complex free software for anything productive if there's a commercial alternative.

That is fairly idiotic.  You are associating "open source == badly managed project" and "commercial == well managed project".

Instead, look at how the project developers deal with bug reports and patch submissions.  It usually takes about fifteen minutes for me to get a good handle on an open source project, by looking at the mailing list (and list rules) and bugzilla.  With some commercial projects, you either need to find someone who has experience with their support, or take the plunge.

[legacy]

He replies that the particular hardware you're using is obsolete and he cannot help you right away because

Re-read email, he said he has the documentation in his drawer, just he has no time to open the drawer, search for his notes under the letter "W", find the board (for which he is the mainteiner), and give a reply.

Unless you pay for this.

he worked on that hardware ages ago and doesn't recall the details, but he would do it if you paid for his time and offers you a reasonable rate

Checked again the email, and calculated the "resonable rate" ... he said 50 Euro / h with a minimal commit of 5-10 hours, it means 250-500 euro.

complain loudly on a public internet

On the internet, "loudly" means you write in CAPS LETTERS. Did I?

This demonstrates a level of entitlement that is just mindboggling.

This is nothing but simply inappropriate.

[m98]

That is fairly idiotic.  You are associating "open source == badly managed project" and "commercial == well managed project".

Instead, look at how the project developers deal with bug reports and patch submissions.  It usually takes about fifteen minutes for me to get a good handle on an open source project, by looking at the mailing list (and list rules) and bugzilla.  With some commercial projects, you either need to find someone who has experience with their support, or take the plunge.

It might be idiotic, but I've never encountered any notable problems that way. Of course my statement is oversimplified, there are a lot of other indicators I base a decision on if it matters.