I’ve seen more and more visceral rejection of the notion of “software supply chain” by source contributors. They’re rightly calling out the hypocrisy of companies demanding they be complicit in the supply chain of a product, but not paid or compensated for their works on it.
There is no “software supply chain”, only products you didn’t pay for but still expect slave labor to support in perpetuity.
On the flip side, I’ve never known a project to reject work while being paid a livable wage to complete it. Funny, that.
Is there much push anymore, behind the “open source software supply chain” concept? It seems like a very misguided and bad idea, but I actually wonder if the open source community actually managed to get that point through to policy makers? At least I haven’t heard anything about it lately (I’m not particularly listening, though).
Counter-argument to the author: If you publish a package you are a supplier full stop. If you don’t want to be considered a supplier, do not publish a built version of your software.
Allow someone else to build and publish it on your behalf (i.e. a separate distributor entity), then they become the supplier. They assume the risk - they can establish those business relationships.
This is how software distribution has worked in Linux forever. For example, it’s Debian’s or Red Hat’s problem to fix a bug in a library they ship and they can upstream it back to you if they want.
Do not publish your package, only provide the source. Publish it for only yourself privately if you wish to consume it. Promote it, provide build scripts… whatever. But don’t publish it.
I really love Rob Mensching's framing in Open Source Maintenance Fee[1]. "The _software_ is free. The _project_ (issue tracker, forums, release management, package repository, etc.) is not."
It doesn't solve the supplier problem, but it is a very clever way to square the "free software, but I'd like to cover my expenses" circle.
I feel there must be a middle ground here. It's similar to free food. Giving food to anyone does not entitle them to more food in the future. They are not entitled to complain free food is not up to their standards or demand changes.
But they are entitled to not being poisoned. Basic sanitation is still required. You should remove free food from the public once it's rotting.
It's a broken analogy though, because in software, people (should) do some research first before picking a tool. But to extend your analogy, it's like someone comes into the free supermarket, picks peanut butter, then demands the manufacturer changes the recipe or complains after a few years because there's a new type of peanut and they want their old jar of peanut butter to be updated. I dunno, I'm stretching the analogy lol.
7 comments
[ 5.2 ms ] story [ 21.0 ms ] threadThere is no “software supply chain”, only products you didn’t pay for but still expect slave labor to support in perpetuity.
On the flip side, I’ve never known a project to reject work while being paid a livable wage to complete it. Funny, that.
2022 (389 points, 240 comments) https://news.ycombinator.com/item?id=34201368
Allow someone else to build and publish it on your behalf (i.e. a separate distributor entity), then they become the supplier. They assume the risk - they can establish those business relationships.
This is how software distribution has worked in Linux forever. For example, it’s Debian’s or Red Hat’s problem to fix a bug in a library they ship and they can upstream it back to you if they want.
Do not publish your package, only provide the source. Publish it for only yourself privately if you wish to consume it. Promote it, provide build scripts… whatever. But don’t publish it.
It doesn't solve the supplier problem, but it is a very clever way to square the "free software, but I'd like to cover my expenses" circle.
[1]: https://opensourcemaintenancefee.org/
But they are entitled to not being poisoned. Basic sanitation is still required. You should remove free food from the public once it's rotting.