←back to thread

672 points LexSiga | 1 comments | | HN request time: 0s | source
Show context
Tepix ◴[] No.45666563[source]
It's an Open Source project - I don't understand what people are complaining about. Noone is entitled to receive free Docker images. I'm sure if there is enough demand, someone else who is trustworthy will step up and automate building them.

What I'd like to complain about instead is the pricing page on the Min.io webpage - it doesn't list any pricing. Looking at https://cloudian.com/blog/minios-ui-removal-leaves-organizat... it seems the prices are not cheap at all (minimum of $96,000 per year). Note that Cloudian is a competitor offering a closed-source product.

replies(20): >>45666657 #>>45666766 #>>45666806 #>>45666929 #>>45667098 #>>45667178 #>>45667201 #>>45667203 #>>45667286 #>>45667401 #>>45668228 #>>45668656 #>>45668714 #>>45668719 #>>45669554 #>>45670644 #>>45670900 #>>45671464 #>>45673127 #>>45674773 #
weli ◴[] No.45666766[source]
When you always published and built Docker images for the public you are creating an expectation, people will rely on that and will chose your software based on that expectation.

You suddenly deciding that you won't be offering updated Docker images especially after a CVE and with no prior notice (except a hidden commit 4 days ago that updated the README) is approaching malicious-level actions.

If they truly cared about their community and still wanted to go through the decision of not offering public docker builds the responsible thing to do is offer a warning period, start adding notices in the repo (gh and docker) and create an easy migration path, even endorse or help some community members who would be fine with taking care of the public builds of the image.

But no, they introduced the change, made no public statement about it, waited for someone to notice this, offered no explanation and went silent. After a huge CVE. Irresponsible.

replies(10): >>45666850 #>>45666888 #>>45666945 #>>45666962 #>>45667042 #>>45667291 #>>45667585 #>>45668545 #>>45670863 #>>45676669 #
arghwhat ◴[] No.45666962[source]
There is absolutely nothing malicious or suspicious about deciding not to provide docker images or binaries. Doing so does not hide or guard you against CVE's, which are entirely unrelated to such optional processes.

Building minio is not only trivial, but is standard procedure - the latest release is in my distributions standard package repo, and they would not use prebuilt binaries. If you want that dockerized, the Dockerfile is shorter than the command-line to run said container. Dealing with Docker themselves, the corporation that has famously gone on a tax collection spree, is however quite the pain in the arse for a company.

I can't stand the entitlement people (everyone, not one particular person) feel when they are provided things for free. Sure, minio is run by a corporation these days and this applies a bit more to smaller FOSS projects, but the complaint is that the silver spoon got replaced with a stainless steel one. You're still being fed for free, despite having done nothing for it.

</rant>

replies(4): >>45667096 #>>45667127 #>>45667330 #>>45672871 #
fragmede ◴[] No.45667096[source]
If it were for a feature request, it would feel more justified. People feeling entitled to making feature requests is one thing. Like they can get fucked. Contribute code or pay me. But if I let something loose out into the world that suddenly started causing problems because someone discovered you could stab people with it, I'd be going around making sure all of the copies I gave out it had a knife guard put in place.
replies(1): >>45668064 #
1. arghwhat ◴[] No.45668064[source]
We're not going around making kitchen knives illegal. I would go out of my way to mitigate footguns where an entirely legitimate use or legitimate source of confusion would turn foul, but if you chose to go out of your way to misuse it as a hammer or ignore documentation, then you're on your own.

In this case, we're not even talking about that though, it's just a redundant prebuilt binary getting janked. I don't think it makes sense to provide prebuild binaries in the first place.