Blogged about open source maintenance and security. Had this planned for a while now, but with the recent XZ vulnerability, it was high time to get it out: https://anteru.net/blog/2024/open-source-maintenance/
@anteru great post! Agree with everything, except the “hapyp” typo :)
@aras Thanks! Fixed the typo, should cycle within the hour :( There's always a typo when typing something in the evening, isn't there ..
@anteru it still baffles me how many companies who use Blender still don't give back to the devs while at the same time not blinking an eye at licensing Maya and Renderers for many thousands per year and per seat.
I really like the verified idea despite the problems you mentioned but we really need a shift in value from the users as well.
Open source is still great IMO but we should give devs the option to actually work on it if we like and use it. Aka funding.
@SpookyDoom @anteru on the one hand companies in general pay as little as they can get away with, on the other hand a big chunk of small devs use blender specifically because they can't afford maya / max
@logicalerror @anteru Yes, exactly. That's my problem with the culture here. I specifically blame large to very large companies, here.
I am very sure that in the top tier of supporters (even neglecting the few who don't want to be mentioned) there are many more who use Blender and could afford to donate, easily. For me that's the user side of it. If you want better maintenance, then pay for it if you can afford it.
@SpookyDoom @anteru I agree
I actually think large companies should hire blender devs directly imho, so they can make sure it fits their needs. It would be win/win
@SpookyDoom @logicalerror @anteru there is a monkey paw wish moment here though: companies do not pay for the good of their hearts, when money is involved (be it directly or via developer time) they'd want *something* in return and there is a good chance what the company wants may not align with what the community may want.
Personally i'm always wary of open source projects that have some company throw their weight around, especially when said projects are practically incredibly hard to fork.
@badsector @SpookyDoom @logicalerror That's really a secondary problem. The main issue are companies/people who get the return first (use an existing open source library) without any investment, and expect it will continue to work perpetually without further investment. As in, you pick up a dependency, and even if you don't want any changes, you want it maintained/secured, but you don't pay.
@logicalerror @anteru and Blender is even doing very well in terms of Open Source Projects, too. Look at Krita's funding in comparison. :(
What's so sad about it is that companies who do have the funds don't even benefit from supporting closed source. I'd say even contrary. You can potentially find many more employees proficient in a software all around the world if that software doesn't have the financial or legal entry barriers in the likes of Maya.
@logicalerror @SpookyDoom @anteru i think that was the case ~10 years ago but in recent years people use Blender because they like it - and because nowadays there are *TONS* of video tutorials, addons and other learning material for Blender.
Of course all of that became possible because of Blender's price (and quality), but this isn't the same as people using Blender because they can't afford Maya/Max.
@badsector @logicalerror @SpookyDoom Blender is also really not in the problem space here. They have a well working team, full-time contributors, and what not. That's basically as far away from the lone overworked maintainer keeping a key library going as it gets. I think Blender is doing fantastic for an open source project, but they have sufficient scale. You won't hire 10 people to maintain your `lzma` library.
@anteru @logicalerror @SpookyDoom yeah i agree, i mainly commented for that last part about people using Blender because they can't afford Maya / Max :-).
TBH i'm not sure what could be done to avoid something like xz-utils in practice. I don't think technical solutions would make any difference because at the core is a social issue (who do you trust) and people not only have different values there but also contribute to open source for different reasons and consider different things important.
@badsector @anteru @SpookyDoom You make it sound like I said that all of Blender's users use it because it's free, that's not what I said
I'm still certain it's a big reason why a lot of people start using it, because it has a low barrier of entry
@logicalerror @anteru @SpookyDoom my objection was specifically about people using Blender "because they can't affort Maya / Max", nothing else :-P.
I fully agree that Blender being free is a very important reason it is popular, but it is far from the only reason, after all it existed for decades (it even had some features other programs lacked - e.g.. i remember back in midlate-2000s some artists using it IIRC to simulate fluid physics) but it is only in recent years it exploded in popularity.
@badsector @anteru @SpookyDoom well obviously people keep using it because it's about the same/better than maya/max. if it was terrible, nobody would be using it :)
(and I'm glad it's actually good)
@logicalerror @badsector @anteru I tried Blender many times before because it was free and always went back to different commercial programs over the years. Partially because I didn't know how to use it and partially because it lacked vital features I needed.
Since 2.8 this is not the case any more. Now I really like it better. I also like that it is fair and does not have intrusive DRM. Both sides have to work. Free but bad doesn't work just like great but restrictive is unattractive.
@SpookyDoom @logicalerror @badsector Softimage XSI (back in the day), Lightwave and Modo also were always very different from "other commercial programs". There's really the Max/Maya family, and everything else. It's also pretty clear that Blender has put usability front and center for the last couple of years and tried to align with "industry standards", but do keep in mind the industry has become much smaller than it used to be at the same time.
@anteru @badsector @logicalerror Absolutely. Blender is an example of how I would actually *want* more Open Source projects to be able to operate. With enough budget so that the core development can be run like a regular small company. But with the added benefits of a free and open projects for everybody.
Maybe that didn't come across in my wording. I just meant that even for a great, well-funded project like blender (unlike all the small ones) you can still see how many companies cheap out.