@ashwinvis @strypey It's better not to need trust. With Windows, you have to trust that the closed code is doing what you want. With linux, you can't inspect all the code and you have to trust that others are auditing competently.
@strypey @ashwinvis Recall that #openSSL had a quite serious bug around ~10 yrs ago. After it was discovered, it was realized that no one spotted the bug for several years.
@aktivismoEstasMiaLuo OpenSSL was a very different case to the Linux kernel, which has dozens of paid devs plus volunteers. It's worth noting that if OpenSSL was proprietary, the bug would probably not have been found at all, and would still be unpatched.
@strypey @aktivismoEstasMiaLuo @ashwinvis
The problem with OpenSSL was the same as GnuPG or many other popular open-source software. Everyone is using them and everyone expects they will be maintained and developed in accordance to best practices but... nobody supports them.
This applies equally to large companies who monetize every dollar from open-source but donate nothing, just as well as regular users who *could* easily donate $1 per month but won't because they expect "someone else"...
@strypey @aktivismoEstasMiaLuo @ashwinvis
Based on my personal long-time experience whenever I see a project I really like and depend on, even being early stage or crappy feature-wise, I start throwing my money on it immediately. Be it $10 per month, be it $1 per month, or even by submitting PR or any other way of helping them. I consider this proper from moral point of view but when I need to explain it to my more utilitarian friends it's just helps them not abandon the project...
@kravietz I've never had the money to give cash, but I've always tried to give whatever help and encouragement I can to projects that are doing what I consider to be The Right Thing (TM).
@strypey @aktivismoEstasMiaLuo @ashwinvis
Sure, even simple mentions on social media or simple "thanks" are a way of appreciation for the work on open-source projects.
@strypey @aktivismoEstasMiaLuo @ashwinvis
This is sometimes pain because right now I get receipts from LiberaPay, Patreon, OpenCollective, PayPal and god-knows-what-else donation systems but well, it's still worth it.
@kravietz @ashwinvis @strypey Since you mention #Paypal, plz read this (https://dev.lemmy.ml/post/30880) & consider boycotting Paypal. This may mean telling projects to find another payment processor -- and they will have some motivation to do so if a donor insists on it.
@strypey @ashwinvis @kravietz also note that #opencollective is a CloudFlare site, so I suggest boycotting that too. When you're donating money, you're the one with the leverage
@aktivismoEstasMiaLuo have you tried communicating with OpenCollective about the problem? They're a social enterprise or platform cooperative of some kind. I expect they would want to know.
@aktivismoEstasMiaLuo
FWIW if your first reaction to any ethical concern is always to boycott the thing, you'll eventually end up boycotting everything. With major negative effects on your own life, but pretty much no effect on the services boycotted. Because boycotts only work as organized public campaigns, where the company know they're being boycotted and exactly why, and it looks like it could gain enough support to affect their bottom line.
@strypey @kravietz @ashwinvis I #boycott a *lot* of things. As an activist it's my ethical duty to do so. And I do not just as a utilitarian but also in support of deontological ethics. Thus, I have no expectation of making a significant impact (just as voters don't).
@ashwinvis @kravietz @strypey But i do not generally boycott everything. I can find evil in most consumption, but if I boycott all then I'm failing to support competitors of the biggest evil. So for every good or service I need, I patronize the least of all evils and boycott the rest.
@strypey @kravietz @ashwinvis E.g. if I needed mobile phone service in the US, I would boycott AT&T & Verizon and patronize T-mobile. There's some ethical problems w/T-mobile but nothing like the other two.
@aktivismoEstasMiaLuo I'd love to see how you find balance. This is something I struggle with. For as many areas as I try to do better, there are just as many where I can't find usable alternatives. From what I've read of your posts, you seem to have found a much better balance on this than many of us.
@chris as an ethical consumer I have become completely removed from the cost-benefit value assessment that consumers apply without much thought. Almost every choice is purely ethics based, even something like buying soap. But I suppose I fall short in some cases b/c you can't research everything. We can only act on the knowledge we have so far.
@aktivismoEstasMiaLuo The "can't research everything" part is what tends to get to me. 1/2 the time the alternative I think is "better" turns out to be just as toxic, at least with tech anyway. I'm grateful for posts of folks like yourself and others as well as sites like switching.social that help with some of that burden.
@chris indeed i try to organize the data in a way that's rapidly digestible for others.
@aktivismoEstasMiaLuo Please keep it up.
@chris One thing that helped with the transition was living in Europe, where consumers are not rewarded with perks (in fact punished with VAT, lacking return policies, etc).. this made it easier to learn to live without all the excessive consumerism.
@aktivismoEstasMiaLuo That makes a lot of sense. If I could leave the US I would. I hope to one day, before it is too late.
@strypey @kravietz @ashwinvis I always "try" to reach out, but often CF users are unreachable. In the case of #OpenCollective, their email is served by #Google. I will not send email to gmail users (Google blocks my mail server).. and I will not dance for google by putting another 3rd party in the loop.
@ashwinvis @kravietz @strypey #OpenCollective also has a bug tracker, but it's hosted by #Microsoft #Github -- another service I will not use.
@aktivismoEstasMiaLuo this is a fantastic example of how this level of puritanism is self-defeating. Getting OC to modify their practices is low-hanging fruit. But you've self-marginalized to the point where you can't even pick that fruit.
@aktivismoEstasMiaLuo I don't mean to pick on you. But I think it's important to point out that being *effective* in changing the world is more important than conforming to your own individual morality. As an example, even Richard Stallman understands the strategic necessity to have a minimal presence in the user-abusing where the people are, so you can show them ways out of those spaces into ethical services.
https://stallman.org/facebook-presence.html
@strypey I often link that article myself. This is not RMS compromising his own decisions. AFAIK, he does not have a #Facebook acct. He recognizes that /other/ people are not as committed as he is to technology freedom & ethics. So he suggests a compromise. It's a baby step toward a better status quo.
@strypey If you go to the higher page (I think it's https://stallman.org/facebook.html) you see that RMS draws the same hardline that I do. I will not set foot in FB. I won't even run FB j/s. RMS reserves the baby step option to audiences who he knows he can't sell the full ethical paradigm to.
@strypey I'm not sure what you would propose as an analog to that technique for marginal progress when it comes to #Paypal & #OpenCollective, but it's not critical for me to be the one to suggest the compromise.
@strypey If we consider a good-cop/bad-cop scenario, one person can go gung-ho all-in and someone else can play the good cop & suggest a compromise. The "bad cop" establishes public awareness which is useful even if it doesn't in itself trigger a corrective action.
@strypey Self-defeating implies self-harm. Yet I see no harm to my own agenda. I'm not even sure if you're talking from the context of asking for donations via unethical systems, or giving donations through such systems.
@strypey From the PoV of donating to projects, there are countless projects that I can justify donating to (far more than I have funds for). So nixing projects that use unethical mechanisms doesn't diminish my net donation, which just goes to a different project.
@strypey From the PoV of receiving donations, if #Paypal & #OpenCollective are not offered then most donors (or enough donors) will choose the most convenient of the non-controversial payment methods offered. Some may walk but this wouldn't happen on the scale of declaring "defeat".
@aktivismoEstasMiaLuo @ashwinvis @strypey
I absolutely support this and personally I'm suggesting to all projects I support to use LiberaPay.
@strypey @aktivismoEstasMiaLuo @ashwinvis
Because as I maintain a few open-source projects - including one that has been running since 90's (pam_tacplus) it's fine when you're actually using your project in your daily job and focused on it. But then you move on, and it's really a big pain in the ass when you get tons of issue reports and feature requests, and essentially everyone expects something from you - and you see they come from "respected IT companies" but won't bother to donate $5 :)
@strypey @aktivismoEstasMiaLuo @ashwinvis
From personal experience I can however tell that if you're working for a large company their procurement process is usually so fucked up that it's easier to get $100k for some crap commercial half-baked product than $10 per month to donate to an open-source project... This is stupid and short-sighted.
@kravietz @ashwinvis @strypey A big part of that is accountability. Managers want to offload accountability which is why they love to buy COTS (since a company stands behind it, it gives the illusion of having a warranty even though it doesn't). But w/ #freesoftware managers are afraid they can't point the finger when something goes wrong.
@strypey @ashwinvis @kravietz the fix in this situation is to actually have a 3rd party for-profit support company who develops and gives tech support for the free software.
@aktivismoEstasMiaLuo that was the theory in the late 1990s of how open source was going to be funded, with Red Hat as the poster child for this model. As the data from the last 20 years indicates, it works for some things, but not for second and third tier common infrastructure like OpenSSL. This is the stuff funding projects like Snowdrift.coop and Tidelift are trying to find ways to fund properly.
FYI Frank from Own/NextCloud has given some excellent talks about funding free code development, what's effective or counterproductive and why. Some of that is discussed in this interview and there are links there to the talks:
https://librelounge.org/episodes/32-companies-money-and-society-with-frank-karlitschek.html
@strypey @aktivismoEstasMiaLuo @ashwinvis
Precisely. Consulting only works if the software does *not* do what the commercial customer does 😂 and they require some extra customizations etc.
If it just does its job, nobody will bother to come up with "take my money" because why would they (unless they think strategically).
The free vs premium model is an evolution of this idea and makes a lot of sense, but still you can't do this for OpenSSL...
@kravietz @ashwinvis @strypey i've worked on projects that relied on #freesoftware compilers and tools like emacs. We paid a high (but reasonable) b2b price. We opened tickets for any kind of anomaly or screwy behavior, which would either get fixed or they would respond with instructions on how to overcome the issue. So we got bug fixes & training from the contract. We also filed enhancement requests.
@strypey @ashwinvis @kravietz It was a flat annual price, with no per bug or per hour pricing. Seemed to work well for everyone and the support was quite good. But I could only see this model working for software that's close to our daily operations. Infrastructure types of code like OpenSSL would indeed present the snowdrift problem.
@kravietz @ashwinvis @strypey It was nice that there was no restriction on the kind of tickets we could open. So users would open a ticket just to ask how to do something that's not well documented. It was much better than my experience with support on proprietary products.
@aktivismoEstasMiaLuo the Tidelift model is that companies pay for one support contract, and Tidelift strategically deploy the collected funds to developers, right down the tech stack.
@ashwinvis @kravietz
@aktivismoEstasMiaLuo @ashwinvis @strypey
Oh yes, exactly. I had seen many these large companies essentially have a policy of "we don't onboard software unless it comes with a support contract" which was essentially rationalized as "we have someone we can sue" by their lawyers. As you correctly noted, they don't 😂
@kravietz yup, it's the Snowdrift Dilemma:
https://wiki.snowdrift.coop/about/snowdrift-dilemma
But there's software this definitely doesn't apply to, eg the Linux kernel.
@aktivismoEstasMiaLuo @ashwinvis