https://www.theregister.com/2023/02/15/corejs_russia_open_source/ [user] [user] Sign in / up The Register(r) -- Biting the hand that feeds IT [magn] [burg] [burg] Topics Security Security All SecurityCyber-crimePatchesResearchCSO (X) Off-Prem Off-Prem All Off-PremEdge + IoTChannelPaaS + IaaSSaaS (X) On-Prem On-Prem All On-PremSystemsStorageNetworksHPCPersonal Tech (X) Software Software All SoftwareAI + MLApplicationsDatabasesDevOpsOSesVirtualization (X) Offbeat Offbeat All OffbeatDebatesColumnistsScienceGeek's GuideBOFHLegalBootnotesSite NewsAbout Us (X) Vendor Voice Vendor Voice Vendor Voice All Vendor VoiceAmazon Web Services (AWS) Business TransformationDDN Google Cloud for Startups (X) Resources Resources Whitepapers Webinars Newsletters [devops] Devops 61 comment bubble on white Core-JS chief complains open source is broken, no one will pay for it 61 comment bubble on white Being in Russia and going to jail might have something to do with it, tho icon Thomas Claburn Wed 15 Feb 2023 // 08:30 UTC # Denis Pushkarev, maintainer of the core-js library used by millions of websites, says he's ready to give up open source development because so few people pay for the software upon which they depend. "Free open source software is fundamentally broken," he wrote in a note on the core-js repository. "I could stop working on this silently, but I want to give open source one last chance." The issue of who pays for open source software, often created or managed by unpaid volunteers, continues to be a source of friction and discontent in the coding community. [devops] Feross Aboukhadijeh, an open source developer and CEO of security biz Socket, had a lot to say on the subject in an email to The Register: Maintainers are the unsung heroes of the software world, pouring their hearts into creating vast amounts of value that often goes unappreciated. These unsung heroes perform critical work that enables all of modern technology to function - this is not an exaggeration. These tireless individuals dedicate themselves to writing new features, fixing bugs, answering user inquiries, improving documentation, and developing innovative new software, yet they receive almost no recognition for their efforts. It is imperative for the commercial industry and open source community to come together and find a way to acknowledge and reward maintainers for their invaluable contributions. As long as significant personal sacrifice is a prerequisite for open source participation, we'll continue to exclude a lot of smart and talented folks. This isn't good for anyone. Maintainers of packages that are not installed directly, such as core-js, which often comes along for the ride when installing other packages, have it especially hard. Reliable, error-free transitive dependencies are invisible. Therefore, the maintainers are invisible, too. Perversely, the better these maintainers do their job, the more invisible they are. No one ever visits a GitHub repository for a transitive dependency that works perfectly - there's no reason to do so. But a developer investigating an error stack trace might visit the repository if for no other reason than to file an issue. This is the exact problem that the core-js maintainer faced. For the large companies that get more from the free labor in open source code than they pay out in donations - if indeed they pay out - the status quo looks like a pretty good deal. For individual developers, however, code creation and maintenance without compensation has a cost - measurable not just in financial terms, but also in social and political capital. [devops] [devops] For Pushkarev, known as zloirock on GitHub, the situation is that core-js is a JavaScript library that's been downloaded billions of times and used on more than half of the top 10,000 websites - but the income he receives from donations has fallen dramatically. When he started maintaining core-js full time he could count on about $2,500 per month, and that's down to about $400 per month at present. There are various reasons for this. One is that Pushkarev is in Russia, which since the illegal invasion of Ukraine has been subject to broad financial sanctions. It also didn't help that he served about ten months in prison in 2020 for colliding with two pedestrians on his motorcycle, killing one of them. [devops] And his circumstances are different now. "When I started working on core-js, I was alone," he wrote. "Now I have a family. [Just] over a year ago, I became [the] father of [a] son. Now I have to provide him with a decent standard of living." * What happens when the maintainer of a JS library downloaded 26m times a week goes to prison for killing someone with a motorbike? Core-js just found out * Warning over Java libraries and deserialization security weaknesses * The great big open-source census: Most-used libraries revealed - plus 10 things developers should be doing to keep their code secure * GitHub drops Atom bomb: Open-source text editor mothballed by end of year Pushkarev acknowledges that he has received a lot of hate - and not just social media hostility about code style. "Today, one developer wrote to me a message," he wrote. "He called me a parasite on the body of the developer community that makes a lot of money spamming and doing nothing useful. "He called me the same murderer as Hans Reiser, but who bought the judge and went unpunished. He wished death on me and all my relatives. And there is nothing unusual here, I get several such messages a month. In the last year, this has been added that I am a 'Russian fascist'." But he also has received a lot of support from people in the open source community who recognize that code sustainability is still a problem and confine their consideration to financial matters. (Or who simply support fellow Russians). [devops] Pushkarev would prefer to focus on the economics of open source rather than the politics of his situation and of the country in which he resides. "Open source should be out of politics," he said, adding that he does not want to delve into these issues in detail as there are people on both sides of the border between Russia and Ukraine who might suffer as a result. "I returned to Russia because it was a place where it was possible to have a decent standard of living for relatively small money and concentrate on FOSS instead of making money," he wrote. "Now I cannot leave Russia, because after the accident I have outstanding lawsuits in the amount of tens of thousands of dollars and I am forbidden to leave the country until they are paid off." Such sentiment does not sit well with Victor Shepelev - known as @zverok on Twitter and GitHub - a Ruby developer and software architect who resides in Kharkiv, Ukraine. "For me, whatever (probably meaningful) discussion can be made around problems of open source sustainability, getting paid etc., is critically overshadowed by the 'Some words about war' section, and since it is there, I have no desire to comment on the rest of the issue," said Shepelev in an email to The Register. "'Open source should be out of politics' (and in general 'Culture should be out of politics' - as software development as a part of human culture) is a nice truism to utter in peaceful and democratic society, like 'I have different opinion on taxation and voting system nuances than you, but this doesn't prohibit us from working together on interesting problems!'" "In the time of genocide, being pronounced by the citizen of the country performing genocide, it is irresponsible to the level of disgust. The army of Denis's country kills my friends and ruins my country, and, according to some, no good and peaceful person in Russia has any role in it because it is all 'politics,' which they stand out of (lazily commenting on 'two kinds of evil' between perpetrator and victim of the genocide, when being asked). Good for them." "This is as much as I can comment on [Pushkarev's post]." Open source does appear to be broken, but in truth it was never whole or fair. Its problems were just more manageable in peaceful times. (r) Get our Tech Resources # Share Similar topics * Development * JavaScript * Open Source More like these x Similar topics * Development * JavaScript * Open Source * Politics * Software Narrower topics * AdBlock Plus * App * Application Delivery Controller * Audacity * Confluence * Database * Devops * FOSDEM * IDE * Jenkins * LibreOffice * Map * Microsoft 365 * Microsoft Office * Microsoft Teams * MySQL * OpenOffice * QR code * Retro computing * Search Engine * Software bug * Software License * User interface * Visual Studio * Visual Studio Code * WebAssembly * Web Browser * Wikipedia Broader topics * FOSS * Programming Language Similar topics # Share 61 comment bubble on white COMMENTS Similar topics * Development * JavaScript * Open Source More like these x Similar topics * Development * JavaScript * Open Source * Politics * Software Narrower topics * AdBlock Plus * App * Application Delivery Controller * Audacity * Confluence * Database * Devops * FOSDEM * IDE * Jenkins * LibreOffice * Map * Microsoft 365 * Microsoft Office * Microsoft Teams * MySQL * OpenOffice * QR code * Retro computing * Search Engine * Software bug * Software License * User interface * Visual Studio * Visual Studio Code * WebAssembly * Web Browser * Wikipedia Broader topics * FOSS * Programming Language TIP US OFF Send us news --------------------------------------------------------------------- Other stories you might like The quest to make Linux bulletproof Part 2 What the big players and an outlier are doing, and why OSes16 Feb 2023 | 94 Transmission FOSS BitTorrent client hits version 4.0 Torrenting is still a thing, it still works, and it's not just for illegal downloads to get around streaming restrictions Applications8 Feb 2023 | 30 Google's big security cert log overhaul broke Android apps. Now it's hit undo Devs missed warnings plus tons of code relies again on lone open source maintainer Security16 Feb 2023 | 10 What does it really take to be a leader when it comes to cloud databases? Here's what the AWS customer obsession means to you Sponsored Feature [devops] System76 teases features coming in homegrown Rust-based desktop COSMIC Meanwhile, Xfce takes its first steps toward Wayland support OSes2 Feb 2023 | 41 American jailed for smuggling controlled tech to Iran 30 months in prison for providing, um... enterprise mobile banking software dev tool Legal10 Feb 2023 | 12 VMware turns 25 today: Is it a mature professional or headed back to Mom's house? Special feature Beat Microsoft. Set agendas. Became essential. Hiked prices. Now we wait for Broadcom's reign Virtualization10 Feb 2023 | 15 'Private cloud server' Jira upgraded for wider teams, dragged into culture wars Atlassian wants it used more widely ... but probably not for reporting misinformation to social networks Devops13 Feb 2023 | 7 Microsoft's .NET Framework gets one less update reboot Software behemoth makes Windows updates smaller, faster ... how about less buggy and more tested? Software16 Feb 2023 | 11 Linus Torvalds releases probably unnecessary release candidate eight for Linux 6.2 Emperor Penguin promised a relaxed seasonal development cycle and has delivered OSes13 Feb 2023 | 11 Thunderbird email client is Go for new plumage in July Supernova will prove open source project is not dead - just pining for an enormo-revamp Software14 Feb 2023 | 87 Open Source Policy Summit: Where FOSS and government meet FOSDEM Sometimes it takes a war to make people pay attention Applications9 Feb 2023 | 8 The Register icon Biting the hand that feeds IT About Us* * Contact us * Advertise with us * Who we are Our Websites* * The Next Platform * DevClass * Blocks and Files Your Privacy* * Cookies Policy * Privacy Policy * T's & C's * Do not sell my personal information Situation Publishing Copyright. All rights reserved (c) 1998-2023 no-js