Latest / DevQuestions with Tim Corey / 254. Free Open Source Projects Are Dangerous

Transcript

254. Free Open Source Projects Are Dangerous · DevQuestions with Tim Corey

• 0:00
  SPEAKER_01: Last week, we talked about Mediator, Auto Mapper, Mass Transit, Flu Assertions, and more having all announced changes to their licensing and how that raises a lot of outrage in the community.
• 0:12
  SPEAKER_01: We talked about the misconceptions around open source licensing and how to readjust how we look at the situations like this.
• 0:21
  SPEAKER_01: This week, I want to talk about the other part of this issue.
• 0:24
  SPEAKER_01: I see people attacking the symptoms, but missing the root problem of this issue.
• 0:30
  SPEAKER_01: Free open source projects are a risk to your business.
• 0:34
  SPEAKER_01: The question is, what options do you have?
• 0:37
  SPEAKER_01: Because everything's a bit of a risk, but there may be better options for you.
• 0:42
  SPEAKER_01: That's what we're going to talk about in today's episode of Dev Questions.
• 0:53
  SPEAKER_00: Welcome to the Dev Questions Podcast with Tim Corey.
• 0:57
  SPEAKER_01: Software development is more than just writing code.
• 1:00
  SPEAKER_01: So let's talk about the rest of it.
• 1:02
  SPEAKER_01: Specifically, let's talk about why you should want every library you depend on to have a monetization strategy.
• 1:11
  SPEAKER_01: Now, right now, the community is in turmoil because people are upset that libraries started requiring payments for new versions.
• 1:20
  SPEAKER_01: The common wisdom is probably that free alternatives need to be found because this is all a business can do or should do.
• 1:31
  SPEAKER_01: In fact, I've seen a lot of conversations about free alternatives in recent days.
• 1:36
  SPEAKER_01: However, I think that's a major mistake.
• 1:39
  SPEAKER_01: I think it's just perpetuating the same cycle we're already in.
• 1:43
  SPEAKER_01: So let's look at your options.
• 1:45
  SPEAKER_01: Because if you're going to make a change, you need to know what your options are.
• 1:50
  SPEAKER_01: Number one, you can build your own instead of relying on a library.
• 1:54
  SPEAKER_01: So if you're using a tool like Mass Transit, you can build your own version of that.
• 2:00
  SPEAKER_01: Now, the good news when building your own is you probably aren't using all the features.
• 2:07
  SPEAKER_01: So you can just build the features you need rather than the entire library.
• 2:12
  SPEAKER_01: So in that case, yeah, there may be an option for you to build your own, and it might be the right choice for you, but it's going to be expensive, right?
• 2:22
  SPEAKER_01: You have to spend time to build it yourself.
• 2:25
  SPEAKER_01: But that will allow you to have full control over that source code and what happens to it.
• 2:31
  SPEAKER_01: That's option number one.
• 2:33
  SPEAKER_01: Option number two is to utilize a different free open source library.
• 2:39
  SPEAKER_01: So if you are on mass transit, maybe Wolverine is the right choice or a different one.
• 2:44
  SPEAKER_01: You get to choose what works best for you.
• 2:48
  SPEAKER_01: Now, what this is going to do is just reset the clock for you.
• 2:54
  SPEAKER_01: Maybe.
• 2:55
  SPEAKER_01: Because in recent days, you've seen libraries that have even said, we will always be free.
• 3:02
  SPEAKER_01: Now say, actually, we're changing that.
• 3:06
  SPEAKER_01: That was a mistake.
• 3:07
  SPEAKER_01: And we're going to start charging for this library.
• 3:11
  SPEAKER_01: Because life happens.
• 3:13
  SPEAKER_01: And the circumstances you were in when you said that are not the circumstances of today.
• 3:19
  SPEAKER_01: So for those libraries, you know, they thought they were going to be free forever.
• 3:24
  SPEAKER_01: And they realized down the road, hey, this isn't going to work for us for whatever reason.
• 3:30
  SPEAKER_01: So when you choose a different open source library that's free, are you going to have it be free forever?
• 3:38
  SPEAKER_01: It's going to, is it going to last free forever?
• 3:41
  SPEAKER_01: Or are you just pushing this issue down the road six months, a year, two years?
• 3:47
  SPEAKER_01: Because if you're just pushing it down the road, is it going to be worth your time to just switch over to a different library for two years worth of use or one year or six months, especially since if the entire marketplace, let's say the entire marketplace says, yes, Wolverine is the option.
• 4:07
  SPEAKER_01: And it's not because it's a different product.
• 4:10
  SPEAKER_01: But let's just say the entire industry who was using Mass Transit goes to Wolverine.
• 4:15
  SPEAKER_01: Well, now Wolverine has three times, four times, five times, ten times the number of people using the product.
• 4:22
  SPEAKER_01: And you might say, well, that's great for Wolverine.
• 4:24
  SPEAKER_01: Is it though?
• 4:26
  SPEAKER_01: Because if they have 10 times the people using the library, they have 10 times the issues potentially.
• 4:32
  SPEAKER_01: Or they have 10 times the people wanting things from them.
• 4:36
  SPEAKER_01: Well, that's a lot more burden to bear on that free library.
• 4:42
  SPEAKER_01: So all of a sudden, you are putting more stress on a different open source library.
• 4:48
  SPEAKER_01: And that stress may cause it to say, hey, we can't do this anymore.
• 4:54
  SPEAKER_01: So you may be, by choosing the popular choice, you may actually be part of the issue that causes that open source library to also change its licensing.
• 5:07
  SPEAKER_01: So utilizing a different free open source library might be an option, but it's probably a short-term option rather than a long-term option.
• 5:15
  SPEAKER_01: Option number three is you buy a license to your current library.
• 5:20
  SPEAKER_01: If you like the library you're using, you like fluent assertions, and you say, hey, I want to keep using this, then you buy a license.
• 5:27
  SPEAKER_01: That's an option as well.
• 5:28
  SPEAKER_01: And yes, you weren't paying for it yesterday and you are going to pay for it today.
• 5:35
  SPEAKER_01: That's kind of a bummer because you expected one thing and it changed.
• 5:39
  SPEAKER_01: By the way, if you haven't watched or listened to yes uh last week's episode, we talked about the misconceptions, one of those being that you've lost something.
• 5:48
  SPEAKER_01: You haven't lost anything because that old version still exists.
• 5:51
  SPEAKER_01: And you can still use that, you just don't get updates.
• 5:54
  SPEAKER_01: So that's a side rabbit trail there.
• 5:57
  SPEAKER_01: But you know, you weren't paying for a license yesterday.
• 6:00
  SPEAKER_01: Now you're paying for a license.
• 6:02
  SPEAKER_01: That does change your budget, it does change your costs, but that might be a way to continue to move forward.
• 6:08
  SPEAKER_01: Maybe you say, hey, you know what?
• 6:10
  SPEAKER_01: We don't want to invest the time in building our own.
• 6:13
  SPEAKER_01: We don't want to invest the time in switching over to a different library that might not be free for forever.
• 6:21
  SPEAKER_01: It might go away in a couple of years or a year or six months.
• 6:25
  SPEAKER_01: So buying a license might be the cheapest option for you.
• 6:29
  SPEAKER_01: Or you might say, you know what, we've really appreciated how this library has helped us.
• 6:35
  SPEAKER_01: We're going to continue to work with it and help them in return.
• 6:40
  SPEAKER_01: Kind of a reciprocal thing, um, kind of closing that loop there on support.
• 6:45
  SPEAKER_01: That's your third option.
• 6:46
  SPEAKER_01: Your fourth option is to buy a different license, buy a license with a different commercial product.
• 6:53
  SPEAKER_01: Maybe you say, you know what, I'm done with open source, I'm going to go closed source now and just pay for a vendor's product, which, okay, um, the only difference then is it can you view the source code or not?
• 7:08
  SPEAKER_01: But that might work as well.
• 7:10
  SPEAKER_01: Now, just to be clear, some people see the open source community as only free, which that's not true.
• 7:18
  SPEAKER_01: Um, but they also see the open source community as uh more ephemeral, it might go away more likely, whereas they see the paid licensed products from commercial companies as here forever.
• 7:31
  SPEAKER_01: And that's also not true.
• 7:34
  SPEAKER_01: Commercial products go away.
• 7:36
  SPEAKER_01: Companies stop producing new versions of commercial products.
• 7:40
  SPEAKER_01: And the difference between a commercial product that's closed source and open source product that you license is that the open source product you have the source code for, that's the big difference if you know everything else being equal.
• 7:56
  SPEAKER_01: Now, yes, a big company supporting it might be a good thing.
• 8:00
  SPEAKER_01: It might allow it to last for longer.
• 8:01
  SPEAKER_01: There's definitely cases of this.
• 8:05
  SPEAKER_01: There have been tool vendors and open source or closed source uh commercial products have been around for decades supporting the.NET community.
• 8:15
  SPEAKER_01: Um, Teleric has been around forever, it seems like.
• 8:18
  SPEAKER_01: Um, SyncFusion has been around for a long time, and so on.
• 8:22
  SPEAKER_01: But just because some have doesn't mean everyone will, and it doesn't mean that a big company is going to protect your package that you're using any better necessarily, because in a lot of ways, a big company is looking at a bigger picture than an open source maintainer.
• 8:43
  SPEAKER_01: An open source maintainer is maintaining one or a few open source projects, and they tend to be their babies, the things that they they have built up and grown and want to see succeed, as long as we don't burn out.
• 8:57
  SPEAKER_01: But on the other hand, big corporations see their products as just that product line.
• 9:04
  SPEAKER_01: And if one is not making enough money, it goes away.
• 9:08
  SPEAKER_01: Why would you invest in something that loses you money?
• 9:12
  SPEAKER_01: So there is a danger there as well.
• 9:14
  SPEAKER_01: But as I see it, those are your four options.
• 9:17
  SPEAKER_01: Build your own, use a different free open source library, buy a license to your current library, or buy a license to a different library, potentially even a closed source one.
• 9:28
  SPEAKER_01: So that's your options.
• 9:31
  SPEAKER_01: No matter what you do, you're going to pay for it.
• 9:34
  SPEAKER_01: Even option number one, where you're saying, hey, I'm going to build it myself, your time's not free.
• 9:40
  SPEAKER_01: Your time costs, even if you're not getting paid, because there's an opportunity cost.
• 9:45
  SPEAKER_01: So if you're doing this, you're not doing that.
• 9:48
  SPEAKER_01: So when you think about which of those four options to choose, you have to look at the actual cost to you, both in terms of time and money.
• 9:59
  SPEAKER_01: So that's the nature of software development.
• 10:01
  SPEAKER_01: That's the nature of all software development, whether you're talking about a library that you could do yourself or use, or just the thing that you do best with your application.
• 10:12
  SPEAKER_01: You're going to have to pay for it no matter what.
• 10:15
  SPEAKER_01: Everything has a cost.
• 10:16
  SPEAKER_01: My recommendation is to choose an open source library that has a monetization strategy, if at all possible.
• 10:24
  SPEAKER_01: Now, here's why.
• 10:26
  SPEAKER_01: So again, open source is a great tool, and open source marketplace is huge, but I would encourage you to look at open source products, open source packages that have a monetization policy as the most valuable, as the ones you should look at, which seems backwards, right?
• 10:49
  SPEAKER_01: Seems like, wait a minute, we're all complaining about having to pay for something.
• 10:53
  SPEAKER_01: And now you're saying use the ones that cost us something.
• 10:58
  SPEAKER_01: Yes, I think that you should look for ones that have a monetization strategy.
• 11:02
  SPEAKER_01: Here's why.
• 11:03
  SPEAKER_01: Number one, a monetization strategy means more stability.
• 11:08
  SPEAKER_01: So if a person is getting paid for their work, they're more likely to continue doing so.
• 11:16
  SPEAKER_01: There have been instances, uh, for example, Automapper.
• 11:20
  SPEAKER_01: The author of Automapper used to get paid by a company that said, hey, we want you to do open source work, so therefore work on Auto Mapper and work on your other projects as well.
• 11:32
  SPEAKER_01: So because of that, he spent a lot of time working on Automapper.
• 11:39
  SPEAKER_01: And when he left that job, he left behind the pay to do it.
• 11:45
  SPEAKER_01: Well, now he's got to work, he's working as a consultant and putting the most of his focus and most of his efforts and time on consulting, which means he's not spending time on Automapper.
• 11:57
  SPEAKER_01: So with that comes a loss of focus because he doesn't have any payment for that.
• 12:06
  SPEAKER_01: And so it doesn't make sense for him to put that as his top priority or a top priority because he has to put food on the table.
• 12:15
  SPEAKER_01: He has to put money on his bank account.
• 12:17
  SPEAKER_01: And the way to do that is to work on his consulting, not on the free projects.
• 12:22
  SPEAKER_01: It used to be he got paid to do it.
• 12:26
  SPEAKER_01: So a monetization strategy means more stability because it means that the project maintainer can more easily justify working more on the project.
• 12:39
  SPEAKER_01: So as the project grows, so does the monetization, which means it can be go from a small side project to a project you work on even more in your in your part-time job to a full-time job to even paying for people so it can grow with them.
• 12:58
  SPEAKER_01: So that means more stability.
• 13:01
  SPEAKER_01: Number two, it often means more focused effort because if you are getting paid to do something, then you want to continue that, right?
• 13:12
  SPEAKER_01: If something is making you money, you want to make sure it continues to make you money and maybe even make you more money, which means more focused effort.
• 13:20
  SPEAKER_01: So this sounds great so far, right?
• 13:23
  SPEAKER_01: You want a package that you depend on to be more stable.
• 13:28
  SPEAKER_01: You want it to have a maintainer that is making more focused effort on it.
• 13:33
  SPEAKER_01: Number three, it allows an owner to pass it on to someone else.
• 13:39
  SPEAKER_01: So let's say that the owner gets burned out.
• 13:42
  SPEAKER_01: The owner decides, you know what, I'm tired of this, I'm tired of working on this.
• 13:48
  SPEAKER_01: If the package is just free open source and there's no monetization strategy, then it's just take, take, take.
• 13:56
  SPEAKER_01: So there's mounting number of issues, there's there's pull requests to review, there's bugs to track down, there's you know, users that are up in arms about things in the comments.
• 14:08
  SPEAKER_01: Like there's a lot of things going into the take side of the project.
• 14:14
  SPEAKER_01: And if nothing is coming in financially, well, then if the owner says, I'm getting burned out, I want to pass this on, who do they pass it on to?
• 14:24
  SPEAKER_01: Because there's no incentive to take it.
• 14:27
  SPEAKER_01: Unless someone steps forward and says, you know what, I would love to continue working on this, probably it's really hard to pass off.
• 14:36
  SPEAKER_01: In fact, there have been libraries recently where that has happened, and the one person who stepped up to take it on was actually a malicious actor who wanted to insert some malware into a known product, a known uh library, so that they could spread that malware even further abroad.
• 14:57
  SPEAKER_01: So that's a danger to the project.
• 15:00
  SPEAKER_01: Now, however, if there's a monetization strategy in place where as more effort goes into it, more money comes out of it, roughly.
• 15:11
  SPEAKER_01: So as a number of customers goes up, so does the income.
• 15:17
  SPEAKER_01: Well, then if the owner says, hey, I'm burned out, I want to give it to somebody else, now you're not just saying, here's a burden to bear.
• 15:25
  SPEAKER_01: You're saying here's a job for someone.
• 15:29
  SPEAKER_01: So maybe you want to take this on because you know it's going to take 10 hours of your week every week, but it's going to give you back$1,000 a week.
• 15:40
  SPEAKER_01: And so, you know what,$50,000 a year for 10 hours a week, that could probably balance out.
• 15:47
  SPEAKER_01: I would, you know, there'd be a more people willing to do that because they can see, hey, I'm going to get paid for what I do.
• 15:56
  SPEAKER_01: And they're also incentivized to say, hey, I could potentially grow this into even more.
• 16:02
  SPEAKER_01: So number three, it allows an owner to pass this on to someone else much more easily.
• 16:09
  SPEAKER_01: Number four, a monetization strategy gives you, as the customer, a voice.
• 16:16
  SPEAKER_01: So people have been spoiled in the community with open source.
• 16:22
  SPEAKER_01: I'm going to say it, all of us have been spoiled by open source.
• 16:26
  SPEAKER_01: There are lots of people in the open source community who have given their time for free to help out.
• 16:35
  SPEAKER_01: Lots of people have spent an enormous amount of time working for you, working for me for free.
• 16:46
  SPEAKER_01: Should we have a voice in what they do?
• 16:49
  SPEAKER_01: Should we be able to demand something from them?
• 16:53
  SPEAKER_01: Should we be able to say, I want this and have it have any impact?
• 16:59
  SPEAKER_01: Probably not if they're working for free.
• 17:01
  SPEAKER_01: Now, I'm not saying it's not a good thing to help out by saying, hey, I found a bug, here's the bug, hey, I found this feature would be kind of cool to have.
• 17:12
  SPEAKER_01: But really what you're doing there is potentially adding more work to someone's plate, not necessarily helping them out in any way.
• 17:22
  SPEAKER_01: Whereas, if you are paying for a license that gives you more of a voice to say, hey, here's a bug I found.
• 17:33
  SPEAKER_01: I would really like to get this fixed.
• 17:35
  SPEAKER_01: Now, that does not guarantee it will get fixed, but you now have more of a voice to say, I am paying for this and it's not working the way I expect it to.
• 17:47
  SPEAKER_01: Please fix this.
• 17:49
  SPEAKER_01: So a monetization strategy gives you as a customer a voice.
• 17:54
  SPEAKER_01: So those are my four thoughts there.
• 17:56
  SPEAKER_01: So far, you probably think that a monetization policy or monetization uh strategy means a paid license.
• 18:05
  SPEAKER_01: And it can mean that, but there are alternatives that work as well.
• 18:10
  SPEAKER_01: Some people charge for support.
• 18:12
  SPEAKER_01: Others offer to add features based upon bounties.
• 18:16
  SPEAKER_01: Others create two versions of their library or offer paid additional features.
• 18:22
  SPEAKER_01: Whatever the strategy is, having a monetization strategy is vital for the long-term success of a project.
• 18:29
  SPEAKER_01: I think we've seen that a number of times recently.
• 18:33
  SPEAKER_01: As a developer relying on a project, you want to choose projects that are going to be found for a long time.
• 18:42
  SPEAKER_01: They're going to be around, they're going to be solid, they're going to be continued to be improved over time.
• 18:50
  SPEAKER_01: Okay?
• 18:50
  SPEAKER_01: And you want that stability.
• 18:52
  SPEAKER_01: That means picking projects that have set themselves up for long-term success.
• 18:57
  SPEAKER_01: That means, in my opinion, you should look for projects that have properly monetized their software first.
• 19:06
  SPEAKER_01: Thanks for listening.
• 19:07
  SPEAKER_01: As always, I am Tim Corey.
• 19:10
  SPEAKER_00: Thank you for joining us for this episode of Dev Questions.
• 19:13
  SPEAKER_00: When you're ready to learn to think and code like a professional developer, head over to IamtimCorey.com and enroll in a course.