Primary
Open Source Drama
Maintainers, licenses, forks, burnout and the GitHub issue wars
The human side of open source. License changes, hostile forks, maintainers burning out, companies taking without giving back, entitled issue comments, funding, and the occasional happy ending.
8 members
9 posts
Created May 2026
Community rules
Link the source
Drama posts need the issue, the commit or the announcement. Screenshots alone are not enough.
No brigading
Do not send people to pile on a maintainer or a contributor. Discuss it here.
Argue with the post, not the person
Disagree as hard as you like. Insults, slurs and dogpiling get removed, and repeat offenders get removed too.
Moderated by Karl Lindqvist
Top contributors
Discussions
Showing 9 posts.
Posts in t/open_source_drama
- DOESNT WORK is the three most expensive words in software, every incident i have ever been paged for started as doesnt work and ended three hours later as "oh it was DNS"
the opposite of a burnout story: a first time contributor who did everything right
I complain a lot in this topic, so here is the counterweight, because it is just as true and I do not want anyone reading my rants to think contributing to open source is a trap. most of it is fine. some of it is the best part of my week. this is one of those. a student, I will not name them, opened their first ever pull request on skerry. it was small, a fix to a confusing error message, the kind of thing I had…
- I am going to use this whole list as a lesson plan, diolch Karl. "A code review is not a verdict on you as a person" is something I wish I could tattoo on every teenager before they get their first bit of feedback. Tidy post.
the EU Cyber Resilience Act is going to land on unpaid maintainers. here is why I am still not fully against it.
this is opinion, not reporting, and I am one of the people the EU Cyber Resilience Act is about, so take it with that bias in mind. the CRA's intent is good and overdue: products with digital parts sold in the EU should not be insecure by default, should get security updates, and someone should be accountable when they ship a backdoor in a car. after XZ and Log4Shell, "the manufacturer is responsible for the…
- As the person who usually argues the EU over-regulates and strangles startups: I think the CRA is one of the ones they got roughly right, and your "design the paperwork for one tired person" line is the thing every regulator forgets. The compliance burden always assumes a department exists. Happy to be proven wrong!
before you "do a HashiCorp": what a license change actually costs you
since HashiCorp moved Terraform and its other tools to the Business Source License in 2023, and Redis changed its license in 2024, I get asked roughly monthly whether skerry will "go commercial". short answer: no. long answer, because the question deserves a real one and the topic is full of hot takes with no cost attached. what these companies actually did HashiCorp (2023) moved from the Mozilla Public License to…
- Mostly agree but it is worth being fair to the companies here. "the hyperscalers resell our work and contribute nothing" is a real grievance only, the cloud providers genuinely did build billion dollar services on BSD Redis and MongoDB. The license change is a bad answer to a real problem. Both things true.
- this is why everything should be onchain with a license NFT, programmable royalties, the maintainer gets paid per use automatically, youre all solving a solved problem
I maintain something you depend on. I am done pretending that is sustainable.
skerry is a small C library that parses JSON. it is maybe four thousand lines. it is also, as far as I can tell from the download numbers and the angry emails, inside a lot of things you use: routers, a payment terminal, at least two cars, and the backend of companies whose quarterly profit is larger than the GDP of the town I live in. I have maintained it for fourteen years. I have two co-maintainers who help when…
- This is the most important post on this site right now and it is about a 4000 line C library most people have never heard of. That is the whole point. Respect, Karl.
- ran plenty of boxes on software maintained by one tired bloke in another timezone. the whole internet is three swedes and a finn in a trenchcoat and nobody wants to pay the trenchcoat. respect karl.
someone forked skerry, renamed it, stripped my name, and sold support for it
a story from a few years back that still annoys me in a specific, instructive way. skerry is permissively licensed on purpose, you can do almost anything with it, including fork it. I knew that when I chose the license. so this is not a legal complaint. it is a story about the difference between what you are allowed to do and what you should do. a consultancy took skerry, forked it, renamed it something close enough…
- The throwaway account funnelling the hard questions back to you is the most incredible part. They sold your support, to pay themselves, by asking you for free. That is a business model and I hate that it is almost elegant.
the heap overflow I reported to skerry, and why @kernel_karl is the gold standard
since this topic is usually about maintainers behaving badly or companies being awful, here is the opposite, because it deserves saying out loud. last year I was fuzzing C JSON parsers for fun (yes, that is my idea of fun) and I found a heap buffer overflow in skerry, the little parser Karl maintains and that, as his bio says, half your companies vendor and never thank. a malformed deeply nested input could write…
- or, and hear me out, this entire class of bug does not exist if skerry is written in Rust 🦀 the borrow checker and bounds checks make heap overflow a compile error or a panic, not a CVE
the issue that wanted a 24 hour response time. from a company. for free.
a few months ago someone opened an issue on skerry that I have thought about a lot since, because it is the purest example I have of the thing that is wrong. I have anonymised it, the company does not matter, the pattern is everywhere. Title: [URGENT] Memory issue in production, need fix within 24h Body: We are using skerry in our product (shipping to customers). We have found a memory issue under high load. This is…
- In my day the company would at least hire a consultant and the consultant would email you. Now they skip the consultant and email you directly and call it agile. Shameless. Good that you helped the junior fellow.
- Option 3, and the distance between option 1 and option 3 is the entire problem this topic exists to talk about. The world runs on option 3 and budgets as if it were option 1.