Libxml2's "no security embargoes" policy

Why bother open sourcing if you're not interested in getting people to use it?

you seem to have mistaken corporations for people.

You seem to think corporations aren’t made of people

So that if they find it useful, they will contribute their own improvements to benefit the project.

I don’t think many projects see acquiring unpaying corporate customers as a goal.

Trillion dollar corporations are not "people".

A decent part of my job is open source. Our reason for doing it is simple: we would rather have people who are not us do the work instead of us.

On some of our projects this has been a great success. We have some strong outside contributors doing work on our project without us needing to pay them. In some cases, those contributors are from companies that are in direct competition with us.

On other projects we've open sourced, we've had people (including competitors) use, without anyone contributing back.

Guess which projects stay open source.

You can want to be helpful without wanting to have power or responsibility.

I'm interested in people (not companies, or at least I don't care about companies) being able to read, reference, learn from, or improve the open source software that I write. It's there if folks want it. I basically never promote it, and as such, it has little uptake. It's still useful though, and I use it, and some friends use it. Hooray. But that's all.

Sheds are made of wood, but they aren't trees.

The GPL does not prohibit anyone from using a piece of software. It exclusively limits the actions of bad faith users. If all people engaged with FOSS in good faith, we wouldn't need licenses, because all most FOSS licenses require of the acceptors is to do a couple of small, free activities that any decent person would do anyway. Thank/give credit to the authors who so graciously allowed you to use their work, and if you make any fixes or improvements, share alike.

Security issues like this are a prime example of why all FOSS software should be at least LGPLed. If a security bug is found in FOSS library, who's the more motivated to fix it? The dude who hacked the thing together and gave it away, or the actual users? Requesting that those users share their fixes is farrr from unreasonable, given that they have clearly found great utility in the software.

We have a solution to this. It's called the (L)GPL. If people would stop acting like asking for basic (zero cost) decency in exchange for their gift is tantamount to armed robbery, we could avoid this whole mess.

What’s the point in people using it if all that profit ends up in someone else’s pockets?

When I, as a little child (or at least that is how it feels now), got excited about contributing to open source, it was not the thought that one day my code might help run some giant web platform's infrastructure or ship as part of some AAA videogame codebase that motivated me. The motivation was the idea that my code might be useful to people even with no corporation or business having to be involved!

GPL doesn't force people to share their fixes and improvements. And there is nothing bad faith about not sharing all your hardwork for free.

It does if you then share the resulting software. And I think if you make an improvement just for your own enjoyment, you'd be a better person if you shared it back than if you didn't.

The GPL "does not prohibit anyone" in a narrow legalistic sense. In colloquial discussions (see e.g. https://www.gnu.org/licenses/why-not-lgpl.en.html), the Free Software Foundation is quite clear that the GPL exists to stop proprietary software developers from using your code by imposing conditions they can't satisfy.

No corporations are people, they are legal constructs. How much money they are worth makes no difference.

Groups of people are not the same as the people that make them up. They think differently and have different motivations.

People can use it. Corporations won't. I'm entirely unbothered by this outcome.

This isn't a popularity contest and I'm sick of gamification of literally everything.

There is tons of reasons. E.g. public money public code. We are in research and we are open sourcing because we know that we cannot maintain anything, giving people the chance to pick up stuff without having buy stuff that is constantly losing value and becomes abandon ware very soon these days (at this point we often don't even have the resources to open source). So what you most get from us is 'public money crappy unmaintained code'

A lot of software out there runs on servers and is never shared with users in a manner that matters for GPL.

Corporations are made of rich stock owners.

That's why there is AGPL to fix that "bug"

Anyway, the GPL is there to protect final users and not the maintainer of the project. And if a software is running on someone else server, you are not the user of that software. (Although you use the service and give the data, but that's another problem)

The GPL doesn't do anything when the project is just used internally by another company.

They never trigger the distribution clauses, and they own the copyrights of all the work being done. So if you NEVER distribute binaries outside your company's walls. The GPL is a giant nothing, for most practical cases.

That's why we're starting to see the AGPL more now. But even then, for INTERNAL applications. It's still a nothing.

The GPL doesn't cure people being greedy. It just changes how they are allowed to be greedy.