←back to thread

672 points LexSiga | 1 comments | | HN request time: 0.218s | source
Show context
Tepix ◴[] No.45666563[source]
It's an Open Source project - I don't understand what people are complaining about. Noone is entitled to receive free Docker images. I'm sure if there is enough demand, someone else who is trustworthy will step up and automate building them.

What I'd like to complain about instead is the pricing page on the Min.io webpage - it doesn't list any pricing. Looking at https://cloudian.com/blog/minios-ui-removal-leaves-organizat... it seems the prices are not cheap at all (minimum of $96,000 per year). Note that Cloudian is a competitor offering a closed-source product.

replies(20): >>45666657 #>>45666766 #>>45666806 #>>45666929 #>>45667098 #>>45667178 #>>45667201 #>>45667203 #>>45667286 #>>45667401 #>>45668228 #>>45668656 #>>45668714 #>>45668719 #>>45669554 #>>45670644 #>>45670900 #>>45671464 #>>45673127 #>>45674773 #
weli ◴[] No.45666766[source]
When you always published and built Docker images for the public you are creating an expectation, people will rely on that and will chose your software based on that expectation.

You suddenly deciding that you won't be offering updated Docker images especially after a CVE and with no prior notice (except a hidden commit 4 days ago that updated the README) is approaching malicious-level actions.

If they truly cared about their community and still wanted to go through the decision of not offering public docker builds the responsible thing to do is offer a warning period, start adding notices in the repo (gh and docker) and create an easy migration path, even endorse or help some community members who would be fine with taking care of the public builds of the image.

But no, they introduced the change, made no public statement about it, waited for someone to notice this, offered no explanation and went silent. After a huge CVE. Irresponsible.

replies(10): >>45666850 #>>45666888 #>>45666945 #>>45666962 #>>45667042 #>>45667291 #>>45667585 #>>45668545 #>>45670863 #>>45676669 #
arghwhat ◴[] No.45666962[source]
There is absolutely nothing malicious or suspicious about deciding not to provide docker images or binaries. Doing so does not hide or guard you against CVE's, which are entirely unrelated to such optional processes.

Building minio is not only trivial, but is standard procedure - the latest release is in my distributions standard package repo, and they would not use prebuilt binaries. If you want that dockerized, the Dockerfile is shorter than the command-line to run said container. Dealing with Docker themselves, the corporation that has famously gone on a tax collection spree, is however quite the pain in the arse for a company.

I can't stand the entitlement people (everyone, not one particular person) feel when they are provided things for free. Sure, minio is run by a corporation these days and this applies a bit more to smaller FOSS projects, but the complaint is that the silver spoon got replaced with a stainless steel one. You're still being fed for free, despite having done nothing for it.

</rant>

replies(4): >>45667096 #>>45667127 #>>45667330 #>>45672871 #
weli ◴[] No.45667127[source]
> There is absolutely nothing malicious or suspicious about deciding not to provide docker images or binaries. Doing so does not hide or guard you against CVE's, which are entirely unrelated to such optional processes.

Agree. But that's not my point. If you start an oss project from scratch and you don't want to provide builds that's fine.

If you start your oss project, provide public docker images since the beginning, start getting traction, create a commercial scheme for you to monetize the project and then suddenly make a rug pull on the public builds; that is indeed irresponsible, and borderline malicious when you do it without: 1. sufficient warning time. 2. after a recent cve.

Is it malicious? I don't know. I prefer to believe in Hanlon's razor. Is it irresponsible? 100% yes.

replies(2): >>45668024 #>>45669522 #
1. arghwhat ◴[] No.45668024[source]
It is also not irresponsible, or a rug pull. The project is still available, free, and widely packaged as it always has been, just one redundant source removed.

I don't get why one they would provide prebuilt binaries in the first place, and removing them is just cleanup.