Paul Cantrell
This is a very good analogy, and worth working out a bit:
What are the negative consequences of caring for a houseplant poorly? For an individual? a household? a society?
What are the negative consequences of caring for code in production poorly? For an individual? a household? a society? https://mastodon.social/@kornel/116394628325980197
Paul Cantrell
Consider these points the thread makes:
- Maintainers can't trust submitters have properly reviewed code
- so review burden increases
- and submission success rate decreases
- OSS is thus in deep trouble
- and though LLMs are the catalyst, trust issues are the root problem.
That sure paints a picture — one that rings true to me.
2/
Paul Cantrell
OSS as we know it is built on the assumption that we can decouple code contributions from human relationships:
“Anyone can contribute”
“Let the code quality speak for itself”
“If it works it works!”
That assumption has often been strained. It’s now set to snap entirely.
3/
Paul Cantrell
One part of the solution (under-considered IMO) is returning human relationships to OSS: you don’t just submit a PR; you build trust, have a real conversation, then submit a PR.
I don’t know what exactly that looks like in practice; there’s surely not just one answer for everyone. But I know what it •doesn’t• look like: a contribution •starting• with a huge code drop.
4/
Paul Cantrell
OSS has always edged in this direction, sometimes awkwardly: please discuss your proposed feature, please talk with the maintainers first, please join our Discord or…something.
I think there’s a fear that “You have to talk to the maintainers first” is a kind of gatekeeping. But let’s be real here: the story of a stranger coming out of the blue and making a valuable contribution is already fiction as often as not. PRs languish; maintainers strain.
5/
Paul Cantrell
What would it look like to center community, human communication, and trust-building as the •starting point• of OSS contribution?
I don’t entirely know, but I know that there are examples we can build on. And I know that the alternative is grim.
/end
Tabby
@inthehands in my experience as an OSS maintainer, the stranger who *actually* comes out of the blue and makes a valuable contribution is usually using it at work and needs that fix in their day job.
This can be fine in the short term, and in the long term you end up with something like ingress-nginx that does everything for everyone but is unmaintainable.
Paul Cantrell
@talexb > The few times I've contributed to OSS projects, I've engaged with the developers, worked on something they said needed work, submitted a PR, and had it approved.
Correct. Same.
> It's a conversation.
Correct.
> It's not complicated.
Nope. Conversations are unbounded in complexity, even more than software. Sometime conversations are short; sometimes code changes are short. Doesn’t mean either one is not complication. Social relationships are an intrinsically deep problem.
T Alex Beamish
@inthehands The few times I've contributed to OSS projects, I've engaged with the developers, worked on something they said needed work, submitted a PR, and had it approved.
It's a conversation. It's not complicated.
Luke Kanies
@inthehands (I agree with all this. But the truth has always been that reputation is hugely important in OSS. Anything else has always been more myth than reality, except in extreme or trivial cases.)
Paul Cantrell
@enobacon
For sure. My take on that is that we’ve been pretty careless about what “trust” really means.
😀🚲
@inthehands building trust was how the xz supply chain attack went.
Paul Cantrell
@miss_rodent
Yeah, I’m not even thinking of anonymous commits (wtf), but of all the other stuff you said after that.
The Linux kernel is a mixed bag for the community-building, but seems like a pretty good model for trust-building.
V
@inthehands This is the standard in a lot of Free software/open source projects... the anonymous commits thing is relatively recent, compared to the days where to even know where to send your patch you'd need to be involved in the appropriate usenet/irc/mailing list/whatever.
A lot of more functional projects - the Linux Kernel comes to mind - Still do this; for a patch to get into the kernel it has to climb the chain-of-trust over the mailing list.
B'ad Samurai :ifin:
@inthehands I image this as if someone randomly rolled up to my home or business with architectural digrams and work trucks.
Thomas A Caswell :python:
@inthehands I think this was always more aspirational and "you do not have to already be in the club to join the clubs".
In my experience with OSS the relationships are a major part of the work
Paul Cantrell
@tacaswell
Totally agreed, and I guess what I’m arguing for is to go ahead and make the relationship-building a more explicit, more mindful part of the process — and probably in some way an explicit gate to submitting a PR.
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.