Everyone's happy to get software in exchange for nothing from a project with only a handful of people working on it, until there's a problem in the code that is a real bear and causes massive vulnerabilities, and on a long enough horizon, that will happen to any sort of code running on machines connected to the internet.
If your entire business model relies on that code, it'd be wise to back the project, even with token support. I'm talking about less than cost of one team building outing.
Sorry - I wasn't clear. I meant there's no point talking the way you were about how businesses should pay the people "actually" creating the value. All sorts of people create value, and if your business has some volunteers willing to give you work for nothing, you shouldn't assume they did all the work and are the sole ones who should've been paid all along.
I agree that it's a good idea to de-risk your supply chain. The problem is a lot of OSS is popular because it's free, and often there isn't a stable business backing it that an org could have confidence in giving money to. If you're just donating to a GitHub account there's still no likelihood that the project will stick around.
Comments
There's no point doing this. If something is being given away with no strings attached, don't be surprised when it's used.
That's true, to a point.
Everyone's happy to get software in exchange for nothing from a project with only a handful of people working on it, until there's a problem in the code that is a real bear and causes massive vulnerabilities, and on a long enough horizon, that will happen to any sort of code running on machines connected to the internet.
If your entire business model relies on that code, it'd be wise to back the project, even with token support. I'm talking about less than cost of one team building outing.
Sorry - I wasn't clear. I meant there's no point talking the way you were about how businesses should pay the people "actually" creating the value. All sorts of people create value, and if your business has some volunteers willing to give you work for nothing, you shouldn't assume they did all the work and are the sole ones who should've been paid all along.
I agree that it's a good idea to de-risk your supply chain. The problem is a lot of OSS is popular because it's free, and often there isn't a stable business backing it that an org could have confidence in giving money to. If you're just donating to a GitHub account there's still no likelihood that the project will stick around.