{"article":{"slug":"who-is-open-source-about","title":"Who Is Open Source About?","subtitle":null,"summary":"Glyph Lefkowitz argues open source is a web of ongoing relationships—not a one-way gift from maintainers to users—and asks who the community is really for.","content_type":"essay","language":"en","canonical_url":"https://blog.glyph.im/2026/09/who-is-open-source-about.html","author":{"name":"Glyph Lefkowitz","url":"https://blog.glyph.im/","person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"Deciphering Glyph","url":"https://blog.glyph.im/","listing_slug":null,"listing":null},"topics":[{"name":"Open Source","slug":"open-source","url":"https://listedarticles.com/topics/open-source"},{"name":"Opinion","slug":"opinion","url":"https://listedarticles.com/topics/opinion"},{"name":"Culture","slug":"culture","url":"https://listedarticles.com/topics/culture"},{"name":"Programming","slug":"programming","url":"https://listedarticles.com/topics/programming"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":5200,"reading_minutes":23,"published_at":"2026-09-24T00:00:00.000Z","added_at":"2026-09-25T09:17:07.367Z","updated_at":"2026-09-25T09:17:07.367Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/who-is-open-source-about","markdown_url":"https://listedarticles.com/articles/who-is-open-source-about.md","example":false,"citation":"Glyph Lefkowitz, Deciphering Glyph. \"Who Is Open Source About?.\" 24 Sept 2026. https://blog.glyph.im/2026/09/who-is-open-source-about.html (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://blog.glyph.im/2026/09/who-is-open-source-about.html"},"body_markdown":"# Who Is Open Source About?\n\nOpen source is, at least in part, **about *you***, where “you” refers to the\nuser.\n\n## Open Source Is Not About “Open Source Is Not About You”\n\nIn other words: Rich Hickey was wrong when he wrote “Open Source Is Not About You” and I’m tired of pretending otherwise.\n\nOf course he’s not *completely* wrong, or his famous post would not have\nresonated quite so much in the first place.  Obnoxious users who demand their\n*personal* use-cases be immediately addressed by volunteer maintainers for free\nshould indeed be viewed as the pariahs that they are.  Similarly, corporate\nusers who want free support from the community that supplies their\ninfrastructure to lower their costs.  As should those who\nprofit\nfrom this type of externalization by their own customers.\n\nBut the exchange of “open source” (or even “free software”) is not as simple as “I have prepared some software for you, please enjoy it, you have no right to complain”, and maintainers ought to have a precise understanding of the costs and benefits — as well as the ethical implications — of that exchange.\n\nRight now we barely even articulate that the exchange *exists*, let alone that\nit establishes a long-term, subtle, and implicit relationship between\nmaintainer and user.\n\nLet’s fix that.\n\n### A Brief Aside about Meta-Ethics\n\nWhen we talk about “obligations” and “rights”, of “shoulds” and “musts”, we are\nconstructing an ethical system. The *purpose* of such a system is to develop\nsocial expectations and social consequences.  There is not much use in me\ntelling you that you are *transcendentally evil* for failing to follow some\narbitrary recommendation that I have.  But I am implying that I believe there\nshould be consequences for your behavior.  I am also implying that there\nprobably already *are* some consequences, and they’re just not written down\nanywhere yet.\n\nTherefore, a post like this, where I say that we *should* view our social\nobligations in a certain way, that is the *beginning* of a broader social\nconversation.  I think there should be some consequences, so I am gesturing\ntowards that possibility.  Exactly what consequences?\n\nFor now, I’m not sure. Let’s figure it out.\n\n## What Are We Doing When We Do An Open Source?\n\nHickey, and his many acolytes in the years since his fateful post, asserts that the process of “open source” goes like this:\n\n1. Maintainer makes a thing, and makes it available to users as a gift.\n  1. Maintainer may “love working with the team”.\n  2. Maintainer may be “proud of the work we do”.\n2. Users accept the gift, and extract utility from it.\n  1. (Users MUST be grateful for this.)\n3. A tiny fraction of users reciprocally contribute to the thing.\n  1. (Maintainers may be grateful for this.)\n\nHe makes various oblique references to the specific activities of his company,\nwhich does things vaguely related to his projects for money<sup>1</sup>.  These\nactivities are exclusively characterized as for “customers”, however, a subset\nof the aforementioned users so tiny (“fewer than 1%”) as to nearly be an\nentirely distinct group.\n\nBreezing past this process in an essay about obnoxious users demanding things they are not entitled to, one might nod along, as this sounds mostly sensible. Giving gifts is nice. I too love working with good teams and taking pride in things.\n\nExamined more closely, however, it starts to logically fall apart.  If you have\nconsulting clients and that’s where all of your money is coming from, why are\nyou *bothering* (as he repeatedly insists) “doing [things] for the community”?\nWhat was the point of releasing this code in the first place?  You could love\nworking with your team and be proud of the work that you do in a lot of\ndifferent contexts; why bother implicating this horde of entitled and obnoxious\npeople, if that’s all you’re getting out of it?  *What’s in it for you?*\n\nIf we’ve left out something as fundamental as “why is the maintainer doing\nthis”, perhaps this story leaves out some *other* important bits as well.\n\n## Why Are You Doing This?\n\nThere are *many* possible motivations for releasing and maintaining open source\nsoftware.  They are often subtle, often overlapping, and rarely clearly stated.\nMaintainers are not a monolith and not everyone does it for similar reasons.\nBut let’s review a few reasons that someone might want to contribute.\n\n### Reputation\n\nOne reason that you might want to release some open source software is\n*advertising*.  The most common form of this is self-promotion; if you are a\nvisible, prominent contributor to an open source project, it stands to reason\nthat you will have an easier time finding work in the domain of that project.\n\nIf you operate a consultancy, as Rich Hickey did at the time of his famous rant, then this reputational currency translates into advertising for your services. It’s a practical demonstration of the skills of your team.\n\nThe trade in this benefit is most like the traditional “gift economy” that open source has been compared to. You give the code to your users, which has some value, but the users give you back some reputation, in the form of their attention, their esteem, and possibly even their money if they become customers or employers.\n\n### Influence\n\nInfrastructure is the most popular type of open source for a good reason. Programmers working on a problem are often hemmed in by sclerotic architectural choices which prevent them from solving problems in the way that they’d prefer to solve them. Major infrastructural investments are difficult to justify in a planning process, as their benefits are hard to prove. Sometimes the benefits are highly personal; different engineers have different aesthetic preferences about what types of equally-valid solutions they’d prefer to work with.\n\nIf you can develop your preferred type of solution and release it as open\nsource, then you can influence *how* everyone else solves this type of problem.\nAs an individual, such a position of influence can allow you to have some\ntransferable expertise between employers. You know how to use the tool you\ndeveloped, so you can be very quick and effective with it, and you can shape it\nto your ongoing taste over time.\n\nIf you’re an employer, and you can get everyone *else* to use your open source\nthing<sup>2</sup>, this can reduce *both* your hiring and training costs.  Potential\nemployees can read the code, see that it’s good, and want to work at a place\nthat produces good code like that.  They can also read the code and become\nfamiliar with it in advance of coming to work for you, which means that you\nhave a ready supply of developers who already know how your internal systems work.\n\nThe trade in this benefit is more like “soft power” than a gift economy. You give the code to your users, which has some value, but the users give you back the ability to dictate their technological agenda. You gain both the ability to influence their initial direction, and, as part of ongoing maintenance, to dictate their behavior over time.\n\n### Improvement\n\nAs an engineer, you might want to improve your own skills. Writing something proprietary and commercial cuts against this in two ways.\n\nFirst, you will want to build something that already exists within your skill set, so that it will attract commercial interest and actually be competitive. Within the context of a larger team, you will want to personally be able to be immediately effective for similar reasons. But you still need a way to learn new things.\n\nSecond, you will want to build something somewhat secretively, so that the value you are producing is captured rather than released to the community. This means that you will be cut off from external sources of expert feedback.\n\nAs an organization, you might want to build the skills of your staff in similar ways.\n\nThe trade in this benefit is code for knowledge. You release the code or changes, and in return you expect your users to provide you good bug reports, and to induce at least some of them to become co-developers.\n\n### Outsourcing\n\nAs an engineer, you can only do so much on your own.  Perhaps you want to have\nsome influence over your infrastructure so you want to write it, but you also\nwant to have a communal place to keep your infrastructure such that you can\n*make* a change to something to suit your needs, but you know that even if you\nwalk away, someone else will *maintain* that change and keep it working across years or even decades of changes to underlying platforms, hardware, etc.\n\nThis sort of communal maintenance effort can be shared among all interested\nparticipants; if a thousand companies all need the same tool, if even a few\ndozen can share it, that reduces even their *own* load massively, let alone\neveryone else’s.\n\nThe trade in this benefit is more complex, since there’s less symmetry between\nthe main maintainer and peripheral community members who also contribute code.\nThe main maintainer is actually trading a *namespace*, a central place for\npeople to contribute, coordinate, and release changes, rather than the *code*.\nThey are a sort of market maker where then all the other contributors trade\ncode *for* code within that market-ish structure.\n\nIn practice, this motivation produces a game theory\nproblem where, when\nmaintenance drops below a critical threshold, it creates a big enough\ncrisis that at least *some*\nfreeloading stakeholders will be forced to start making contributions.\n\nUltimately, however, this saves *all* involved parties a ton on maintenance,\nmore eager volunteers who do not freeload in the first place get all the other\nbenefits mentioned above as well.\n\n### A Brief Aside about your Chart of Accounts\n\nMost companies account for open source maintenance work as simple overhead on ongoing projects. Sometimes it’s CapEx, sometimes it’s OpEx, but it’s just “whoever happens to be working on this thing to support whatever random product it’s a part of”.\n\nThis type of accounting creates distorting incentives, because it doesn’t recognize all the benefits above. Under such a fiscal regime, ongoing healthy maintenance becomes a ZIRP because when resources are more constrained, this apparent indulgence gets corrected.\n\nThe ancillary benefits that open source creates ought to be properly\nrecognized.  It shouldn’t just be buried as Wages or IT or whatever.  If it’s\nhelping you hire better engineers, some of that expense should be allocated to\nRecruitment Costs.  If it’s materially improving your reputation among your\ncustomer base, some of it should go to Goodwill.  If it’s getting your product\nin front of developers who are your customers, it should be in Marketing.  Most\nimportantly, if maintenance on an open source project is actually helping you\nmaintain your enterprise-wide platform, it should not be squirreled away in\nsome small team who happened to be the first one to adopt it.<sup>3</sup>\n\nExactly how these costs should be allocated and cross-charged to different departments depends heavily upon your organization and your specific chart of accounts. But “whatever, it’s just part of the software product” or “I guess it’s DevRel because the SDK is in there” is guaranteed to have your open source organization destroyed along with all those side-benefits the next time that there’s a cash crunch.\n\n## The Things that Aren’t Supposed To Be Benefits\n\nThese categories *could* be made as explicit, rational trade-offs, even if they\nare often implicit and subtle in practice.  They are transactions where the\nmaintainer gets something and the user gets something.\n\nHowever, not everything that you are getting as a maintainer is something you\nare actually *supposed to use* to your own benefit.  Being given trust in\nservice of a responsibility is not a transaction.\n\n### “Oops, All Root Shells”\n\nOpen source code *is code*.  In our modern world of absolutely pathetic\nsandboxing,\ninstalling code from somebody else gives them control over your system, even if\nit is somewhat indirect.\n\nThere is an unwritten rule that if I create an open source library, and you use\nit, it probably *shouldn’t* have a backdoor in it that gives me the credentials\nto your bank account.  There is a trust relationship between the user and the\nmaintainer, and here, we see the first *obligation* that the maintainer has.\nThe maintainer is obligated *not to use the user’s computer for their own\ngain*.\n\nThis rule might seem obvious and straightforward.  It might even seem unfair to\nyou that I call the rule “unwritten”, because the rule *is*, in fact, written\ndown in a few places: for example, in the npm Acceptable Content\nPolicy,\nit says right there:\n\nA few examples of unacceptable content:\n\n…\n\n\n- Content containing malicious computer code, such as computer viruses, computer worms, rootkits, back doors, or spyware. This includes content submitted for research purposes. Tools designed and documented explicitly to assist in security research are acceptable, but exploits and malware that use the npm registry as a deployment or delivery vector are not.\n\nI think we can all agree that a script which steals your bank credentials and sends them to me to buy a totally sick jet ski would qualify as “malware”, so clearly that is forbidden.\n\nThere is also an enormous gray area here.  npm also explicitly *allows*\n“Information on how to pay, donate to, and otherwise support Package\ndevelopment”, but then goes on to explicitly *forbid* “Packages that display\nads at runtime, on installation, or at other stages of the software development\nlifecycle, such as via npm scripts.”<sup>4</sup> How are the lines drawn around these\ngray areas?  “npm will continue to apply its judgment when deciding what\ncontent is acceptable.”\n\nBut also... this is forbidden *by npm*, not by the transcendental nature of\n“open source”.  I could give away code that displays all kinds of ads to its\nusers as a “gift” on my website.  The exact structure of this policy is not\nuncommon, but it also isn’t exactly the same as other such sites.  PyPI, for\nexample,\nexplicitly bans “cryptocurrency mining”, which NPM does not.  Is cryptocurrency\nmining “not open source”?  A lot of judgement calls are happening here about\nwhat is allowable in these “gifts” that you are giving to your users.\n\nBut I digress.\n\nMy point is that policy-making around this concept is not clear, there are lots\nof little disagreements around the edges, but there is a very strong consensus\nthat while the user is giving you their trust here, that is **not a trade**.\nThe deal is not “you give the user some code, the user gives you unlimited\ncompute and access to all their financial accounts”.  The user has made\nthemselves vulnerable to your code on the strength of your reputation.\n\nThis creates an obligation for you to not do anything evil with that code, either intentionally or through negligence.\n\n#### Security Updates Are Just Command And Control In A Funny Hat\n\nAll of this is just about the initial download of some code, and that is the way that Rich Hickey describes it, as if you just grabbed some code off a web page and put it in a folder that you like on your desktop. But that is not how open source relationships work today, if indeed it ever was.\n\nThe way it works today is that you add a dependency to your `pyproject.toml` or\nyour `package.json` or your `Cargo.toml` and now your users are vulnerable not\njust to whatever you happened to upload in the first place, but to *whoever\nhappens to have your package index credentials*.\n\nThis creates an obligation to maintain an operational security posture that protects your users from malicious updates.\n\n### The Roadmap Is Someone’s Life\n\nAnother kind of trust that the user is placing in you is the trust that you are\ngoing to have at least *some* kind of regard for their usage of your software.\n\nIn a perfect world, the user’s expectations could be clearly circumscribed. Whatever ongoing maintenance you commit to perform would be encapsulated in clear policies that you’d write up in advance, about exactly what kind of security response policy you have, how you will communicate when you no longer have the resources for maintenance, and so on.\n\nBut anyone who has been involved in any project at anything but the most extreme tier of operational maturity knows that 99% of the ecosystem relies on a set of loose conventions around how all that stuff works. We expect that maintainers will generally be around, that they’ll use existing tools like an issue tracker for triaging user bugs, GHSA and CVEs for security reporting, that they will mark the project as “archived” and maybe do a final release before abandoning it, that they will maintain a ChangeLog explaining at least a little bit of what is going on.\n\nUsers assume that those conventions will be followed when there are any gaps in\nexplicit policy, or indeed if policy is lacking entirely.  This assumption is\nreasonable, because otherwise nobody could ever *use* any open source without a\nstack of service contracts that nobody has any time to write.\n\nThe strongest such convention is that an actively maintained program will, at\nleast, more or less *keep doing what it does* as time goes on.  A user who has\nelected to use a bit of open source software has made themselves vulnerable to\nchanges and breakages in that software by the mere fact of using it.  In the\ntime that they have used it and invested in it, they have *not* invested in:\n\n- *creating* alternative software to meet their needs,\n- *maintaining data* in formats that other software can read, or\n- *learning how to use* existing alternative software.\n\nThis can, and does, go badly wrong, when those expectations are mismatched.\n\n#### How It Goes Wrong\n\nLet’s say a maintainer creates an open source paint program, OpenPaint.\n\nAn artist, known for their unique style of making blended collages, switches from their previous app, ProprietaryPaint, to this new OpenPaint to make these culturally significant works of art. However, the maintainer decides that the ‘blend’ tool is kind of a pain to maintain, and they remove it in OpenPaint 2.\n\nA few months later, the artist’s operating system vendor issues a security update that breaks OpenPaint, because older versions of OpenPaint were unknowingly abusing some platform API.\n\nThe maintainer releases a new OpenPaint 2.0.1 that addresses this incompatibility, but doesn’t care about version 1.x any more so they don’t bother to update that one.\n\nThis places the artist in an impossible situation. They can stay on an old version of their operating system, putting all their personal data at risk. Or they can upgrade to the new operating system, effectively either cutting off access to their livelihood, or forcing them to change their art style entirely.\n\nNow, proprietary software can place users in similarly untenable positions (and\nin fact, it is *more often* proprietary software that does).  But does the\nopenness completely remove *any* obligation for this consideration?  Should\nthe OpenPaint team have to at least *communicate* the reasons for doing this,\nto give the artist some recourse?<sup>5</sup>\n\nThe only thing that “open source” does is that it allows the artist to pay a prohibitive amount of money to a new maintenance team to create a fork. This is rarely the kind of thing that individuals can manage.\n\nThis creates an obligation to *at least consider how your users might be\nrelying on you*.\n\nThis is the most complex obligation of the bunch.  Obviously it does not\nentitle every single user to infinite work from the maintainer, but it also\nshouldn’t entitle the user to *nothing* for having trusted these subtle implied\nclaims that the maintainer is making by making their work public.\n\nIt is a nuanced and ongoing negotiation and I do not think we have a clear moral intuition about how it should work out. But we do need to figure out a way to work it out.\n\nIt also raises a clarifying question.\n\n## Why Are We Even Doing This, and Who Are We Doing It For?\n\nPeople generally like to do things for more than one reason. We live in an economy where people need to make money, but we mostly prefer to make that money doing things that are useful, and that make other people happy.\n\nSo, yes, we create open source for self-interested reasons to improve our\nreputations, to improve our skills, to increase our influence and to share our\nmaintenance burdens.  In so doing we take on *some* level of obligation to not\nabuse the trust that is placed in us, even if that level of obligation is not\nclear.\n\nBut if we are not doing it to *serve* those users at least a *little* bit, then\nthose motivations are going to quickly ring hollow.  We will not increase our\nreputation with a person if we respond to their every request by telling them\nthat we owe them nothing and that their opinions are worthless.  We will not\ngain influence over a community if we ignore their desires.\n\nMany interactions with open source maintainers are unnecessarily adversarial. This is of course partially the fault of those users, who should calibrate their expectations appropriately.\n\nStill: maintainers could do a better job of listening *before* these\ninteractions become toxic.  There’s no reason that “open source users” should\nbe an especially toxic group of people.  At this point in history, that group\nis basically just … people with computers.\n\nIt’s like that old truism. If you meet one person who is a jerk to you, that’s their problem. But if everyone you meet, everywhere you go, is constantly abrasive to you and treats you like you’re doing something wrong, maybe it’s time to look inward.\n\nIf all open source users are entitled assholes, maybe it’s time to look for a structural problem.\n\n### Surprise, It’s About AI Again\n\nSigh.<sup>6</sup>\n\n*Users* *hate* *slop.*\n\nI know, dear AI-positive reader, *your* AI outputs are different from everyone\nelse’s, *you* aren’t pushing thoughtless slop into your code, just because\neveryone else is and it is the inevitable terminus of using those tools.  You\naren’t “lazy vibe coding” with Claude, you’re doing “responsible agentic\nengineering”, which is different because you’re just built different.\n\nStill, humor me, for a moment.  Your *users* don’t know that.  They know what\nit looks like when products that they like adopt slop.  They know that they\nwill start leaking\ndata.\nDevelopers know that it will make them personally less\nsecure.\nThey know that they can expect more\noutages\nand that your code will inexorably decline in\nquality.\n\nIn other words, your users are going to assume that this means you are\nviolating that final obligation that the software should *keep working*.\n\nYour users are going to tell you to stop, and they are probably going to get\nmad.  Maybe you, or a plurality of your team, *also* want to stop, maybe you\ndisagree with them, but in any case you need some way to *have that\nconversation* in a way that does not immediately overflow into every adjacent\ndiscussion forum.  Users need to feel welcome in some space so they can have\nthe discussion *in* that space, and not explode out into a thousand different\ngroup chats and social media threads.\n\n*This* post was inspired by yet another prominent open source community\ndiscourse where a ton of angry users showed up to yell at developers to stop\naccepting LLM-generated code.  I’m not going to link to any of these, because\nwe don’t need any more fuel for the discourse fire.  But there is more than one\nsuch case and the pattern is becoming familiar.\n\nOn social media - usually BlueSky or Mastodon, but sometimes a user group\nforum - users become aware of some AI-adjacent policy.  They show up in a horde\nto the developer forum or mailing list.  They loudly start demanding the\nproject take a hard stand<sup>7</sup> against AI. This pressure is simultaneous, but\nuncoordinated; extremely repetitive, very diverse, often inconsistent, and\npretty stressful, especially if you’re a burnt-out maintainer with other things\nto be doing who may not even like AI yourself in the first place.\n\nBelieve me, I get it. It can be very unpleasant to deal with.\n\nLike most problems that AI is causing, though, it’s not really an “AI” problem\nas much as it is a pre-existing dumpster fire that “AI” is pouring gasoline\nonto.  In this case, an online mob is the language of the unheard<sup>8</sup>.\n\n## If Users Are Mad It’s Probably Already Too Late (But Maybe You Can Get Ready For Next Time)\n\nOne day, all of a sudden, you’re getting feedback from a bunch of users that\nare using inappropriate channels to complain. But did they already have\n*appropriate* channels to use?\n\nDid you have a place for people to congregate and discuss your project? To make orderly complaints in a way that will be legible to you? Or do you just have a GitHub Issues page, which non-technical users have no idea how to interact with, and a forum for developers, where users don’t know the norms and any arriving brigade of pissed-off users will be seen as disruptive and inappropriate?\n\nI don’t want to be throwing any stones from within my particular glass house. Setting up such a place has gotten harder over the years. I don’t really have one, either.\n\n*Could* I have one, though?  IRC has been slowly dying, mailing lists are\nunpopular and present increasingly annoying moderation challenges, forum\nsoftware is expensive to operate and keep maintained, Discord is a confusing\nmess and the upshot of all of this is every community needs community\nmanagement and forum moderation.  Which means that for my own small solo\nprojects, I couldn’t possibly have such infrastructure because such\ninfrastructure requires a *dedicated second person* to maintain it, and until\nsomeone volunteers for that, it’s not really feasible.  Even for my larger\nprojects you’d be surprised how slim of a skeleton crew\nwe are getting by with, and we definitely don’t have a whole spare maintainer\nto go manage this, especially as we are under attack from the slopocalypse\nourselves.\n\nThe nature of open source community is that most communities start too small to\nneed such a thing, grow incrementally until one day they are suddenly *way* too\nbig and needed one yesterday, and then suddenly they are too small again when\ninterest wanes even a little bit.  Even as we need it more and more, building\nand maintaining community infrastructure remains a challenge.\n\nEven so, having a dedicated place for *users* — not maintainers — to converse\namongst themselves, be an actual community, and present feedback to the\ndevelopers, is fast becoming a necessary component of a successful community\nand not a nice-to-have.\n\n## In Conclusion\n\nAs trying as it can be sometimes, we maintainers all do get something out of\nopen source, and it is good to be honest with your users — and with yourself —\nexactly *what* you want to get out of it.  In order to know whether the juice\nis worth the\nsqueeze, we\nmust know both what the juice is, *and* what the squeeze is.\n\nPart of the metaphorical squeeze *is* a set of obligations, and those are the\nmost poorly defined of all.  We should try to be clear about what those are\ntoo.  Both about exactly what we believe we are signing up for, and also, about\nhow we are willing to let our users hold us to account for them.  Codes of\nconduct are a start here, but only the absolute barest bare minimum; “do not\nharass your colleagues or your users” is not a standard of excellence to aspire\nto, it’s just basic manners.\n\nI can’t tell you exactly what your obligations are, only try to gesture at my idea of the outlines of the fuzzy moral intuition we’ve all been implicitly sharing up until now.\n\nDrawing this line is not just for the benefit of the users, either.\nMaintainers already feel pressure, we already feel obligations.  We *resent*\nthat feeling of obligation. While there are a diverse array of reasons for that\nresentment, one big one is that it’s not clear, even to ourselves *where the\nobligations end*.  Lashing out by saying “I promised nothing and I owe you\nnothing!” followed by some choice expletives feels cathartic, but it doesn’t\nreally solve the problem, because we clearly don’t really believe that’s where\nthe line is, or we would have already stopped there.  We wouldn’t feel the need\nto say it.\n\nIt is going to be a very big collective endeavor to figure out exactly where that line is. The best time to have gotten started on that endeavor was 50 years ago.\n\nBut the second best time is today.\n\n## Acknowledgments\n\nThank you to my patrons who are supporting my writing on\nthis blog.  If you like what you’ve read here and you’d like to read more of\nit, or you’d like to support my various open-source\nendeavors, you can support my work as a\nsponsor!<sup>9</sup>\n\n1. \nSomewhat to everyone’s surprise, I, too, do things for money, like writing this post. Please remember to like and subscribe ↩\n2. \nWhether it was originally yours, or developed by an employee who happened to be on staff at the time, or adopted by an employee who just started contributing to it a lot, in any of these scenarios a company can benefit from increased consistency and increased familiarity. ↩\n3. \nIf the rule is that they must forever endure the searing budgetary pain of gripping the white-hot potato that they unwittingly caught when they first made a good technical choice, this creates a perverse long-term incentive. ↩\n4. \nI also find it darkly amusing that there is an explicit affordance here made for advertising, specifically, “Packages with code that can be used to display ads are fine. Packages that themselves display ads are not.” This distinction rather gives the game away, that this is a website for carnies and not for marks, and that at some level we expect our users to deserve a lower level of respect than ourselves. But a full exploration of that is another blog post, or maybe a book, that I don’t have time to write right now. ↩\n5. \nIf you want the turbocharged ultra-dramatic version of this problem, make it open source drivers for an optical prosthesis that lets the users *see* instead of an art app.  That level of immediate physical dependency could\nbe clarifying.  It does also start to edge into an area where you could say\nthat biomedical devices ought to be regulated differently, and that’s not\nreally a “software” problem but a “healthcare” problem and I’d mostly\nagree.  Except for the fact that this is a*very* short distance away from\nbreaking everyone’s screen-reader with no notice or\nrecourse. ↩\n6. \nDid you believe I could write a blog post in 2026 which wasn’t somehow about AI? I wish I could still believe that. ↩\n7. \nIt doesn’t help that many of the most pro-AI voices are starting to have an, ahem, discernible political valence that is very unpopular among users. ↩\n8. \nMy apologies to MLK. ↩\n9. \nIf you read this whole post you can see that I sure need the help with all that. ↩","body_html":"<h1 id=\"who-is-open-source-about\">Who Is Open Source About?</h1>\n<p>Open source is, at least in part, <strong>about <em>you</strong></em>, where “you” refers to the\nuser.</p>\n<h2 id=\"open-source-is-not-about-open-source-is-not-about-you\">Open Source Is Not About “Open Source Is Not About You”</h2>\n<p>In other words: Rich Hickey was wrong when he wrote “Open Source Is Not About You” and I’m tired of pretending otherwise.</p>\n<p>Of course he’s not <em>completely</em> wrong, or his famous post would not have\nresonated quite so much in the first place.  Obnoxious users who demand their\n<em>personal</em> use-cases be immediately addressed by volunteer maintainers for free\nshould indeed be viewed as the pariahs that they are.  Similarly, corporate\nusers who want free support from the community that supplies their\ninfrastructure to lower their costs.  As should those who\nprofit\nfrom this type of externalization by their own customers.</p>\n<p>But the exchange of “open source” (or even “free software”) is not as simple as “I have prepared some software for you, please enjoy it, you have no right to complain”, and maintainers ought to have a precise understanding of the costs and benefits — as well as the ethical implications — of that exchange.</p>\n<p>Right now we barely even articulate that the exchange <em>exists</em>, let alone that\nit establishes a long-term, subtle, and implicit relationship between\nmaintainer and user.</p>\n<p>Let’s fix that.</p>\n<h3 id=\"a-brief-aside-about-meta-ethics\">A Brief Aside about Meta-Ethics</h3>\n<p>When we talk about “obligations” and “rights”, of “shoulds” and “musts”, we are\nconstructing an ethical system. The <em>purpose</em> of such a system is to develop\nsocial expectations and social consequences.  There is not much use in me\ntelling you that you are <em>transcendentally evil</em> for failing to follow some\narbitrary recommendation that I have.  But I am implying that I believe there\nshould be consequences for your behavior.  I am also implying that there\nprobably already <em>are</em> some consequences, and they’re just not written down\nanywhere yet.</p>\n<p>Therefore, a post like this, where I say that we <em>should</em> view our social\nobligations in a certain way, that is the <em>beginning</em> of a broader social\nconversation.  I think there should be some consequences, so I am gesturing\ntowards that possibility.  Exactly what consequences?</p>\n<p>For now, I’m not sure. Let’s figure it out.</p>\n<h2 id=\"what-are-we-doing-when-we-do-an-open-source\">What Are We Doing When We Do An Open Source?</h2>\n<p>Hickey, and his many acolytes in the years since his fateful post, asserts that the process of “open source” goes like this:</p>\n<ol><li>Maintainer makes a thing, and makes it available to users as a gift.<ol><li>Maintainer may “love working with the team”.</li><li>Maintainer may be “proud of the work we do”.</li></ol></li><li>Users accept the gift, and extract utility from it.<ol><li>(Users MUST be grateful for this.)</li></ol></li><li>A tiny fraction of users reciprocally contribute to the thing.<ol><li>(Maintainers may be grateful for this.)</li></ol></li></ol>\n<p>He makes various oblique references to the specific activities of his company,\nwhich does things vaguely related to his projects for money&lt;sup&gt;1&lt;/sup&gt;.  These\nactivities are exclusively characterized as for “customers”, however, a subset\nof the aforementioned users so tiny (“fewer than 1%”) as to nearly be an\nentirely distinct group.</p>\n<p>Breezing past this process in an essay about obnoxious users demanding things they are not entitled to, one might nod along, as this sounds mostly sensible. Giving gifts is nice. I too love working with good teams and taking pride in things.</p>\n<p>Examined more closely, however, it starts to logically fall apart.  If you have\nconsulting clients and that’s where all of your money is coming from, why are\nyou <em>bothering</em> (as he repeatedly insists) “doing [things] for the community”?\nWhat was the point of releasing this code in the first place?  You could love\nworking with your team and be proud of the work that you do in a lot of\ndifferent contexts; why bother implicating this horde of entitled and obnoxious\npeople, if that’s all you’re getting out of it?  <em>What’s in it for you?</em></p>\n<p>If we’ve left out something as fundamental as “why is the maintainer doing\nthis”, perhaps this story leaves out some <em>other</em> important bits as well.</p>\n<h2 id=\"why-are-you-doing-this\">Why Are You Doing This?</h2>\n<p>There are <em>many</em> possible motivations for releasing and maintaining open source\nsoftware.  They are often subtle, often overlapping, and rarely clearly stated.\nMaintainers are not a monolith and not everyone does it for similar reasons.\nBut let’s review a few reasons that someone might want to contribute.</p>\n<h3 id=\"reputation\">Reputation</h3>\n<p>One reason that you might want to release some open source software is\n<em>advertising</em>.  The most common form of this is self-promotion; if you are a\nvisible, prominent contributor to an open source project, it stands to reason\nthat you will have an easier time finding work in the domain of that project.</p>\n<p>If you operate a consultancy, as Rich Hickey did at the time of his famous rant, then this reputational currency translates into advertising for your services. It’s a practical demonstration of the skills of your team.</p>\n<p>The trade in this benefit is most like the traditional “gift economy” that open source has been compared to. You give the code to your users, which has some value, but the users give you back some reputation, in the form of their attention, their esteem, and possibly even their money if they become customers or employers.</p>\n<h3 id=\"influence\">Influence</h3>\n<p>Infrastructure is the most popular type of open source for a good reason. Programmers working on a problem are often hemmed in by sclerotic architectural choices which prevent them from solving problems in the way that they’d prefer to solve them. Major infrastructural investments are difficult to justify in a planning process, as their benefits are hard to prove. Sometimes the benefits are highly personal; different engineers have different aesthetic preferences about what types of equally-valid solutions they’d prefer to work with.</p>\n<p>If you can develop your preferred type of solution and release it as open\nsource, then you can influence <em>how</em> everyone else solves this type of problem.\nAs an individual, such a position of influence can allow you to have some\ntransferable expertise between employers. You know how to use the tool you\ndeveloped, so you can be very quick and effective with it, and you can shape it\nto your ongoing taste over time.</p>\n<p>If you’re an employer, and you can get everyone <em>else</em> to use your open source\nthing&lt;sup&gt;2&lt;/sup&gt;, this can reduce <em>both</em> your hiring and training costs.  Potential\nemployees can read the code, see that it’s good, and want to work at a place\nthat produces good code like that.  They can also read the code and become\nfamiliar with it in advance of coming to work for you, which means that you\nhave a ready supply of developers who already know how your internal systems work.</p>\n<p>The trade in this benefit is more like “soft power” than a gift economy. You give the code to your users, which has some value, but the users give you back the ability to dictate their technological agenda. You gain both the ability to influence their initial direction, and, as part of ongoing maintenance, to dictate their behavior over time.</p>\n<h3 id=\"improvement\">Improvement</h3>\n<p>As an engineer, you might want to improve your own skills. Writing something proprietary and commercial cuts against this in two ways.</p>\n<p>First, you will want to build something that already exists within your skill set, so that it will attract commercial interest and actually be competitive. Within the context of a larger team, you will want to personally be able to be immediately effective for similar reasons. But you still need a way to learn new things.</p>\n<p>Second, you will want to build something somewhat secretively, so that the value you are producing is captured rather than released to the community. This means that you will be cut off from external sources of expert feedback.</p>\n<p>As an organization, you might want to build the skills of your staff in similar ways.</p>\n<p>The trade in this benefit is code for knowledge. You release the code or changes, and in return you expect your users to provide you good bug reports, and to induce at least some of them to become co-developers.</p>\n<h3 id=\"outsourcing\">Outsourcing</h3>\n<p>As an engineer, you can only do so much on your own.  Perhaps you want to have\nsome influence over your infrastructure so you want to write it, but you also\nwant to have a communal place to keep your infrastructure such that you can\n<em>make</em> a change to something to suit your needs, but you know that even if you\nwalk away, someone else will <em>maintain</em> that change and keep it working across years or even decades of changes to underlying platforms, hardware, etc.</p>\n<p>This sort of communal maintenance effort can be shared among all interested\nparticipants; if a thousand companies all need the same tool, if even a few\ndozen can share it, that reduces even their <em>own</em> load massively, let alone\neveryone else’s.</p>\n<p>The trade in this benefit is more complex, since there’s less symmetry between\nthe main maintainer and peripheral community members who also contribute code.\nThe main maintainer is actually trading a <em>namespace</em>, a central place for\npeople to contribute, coordinate, and release changes, rather than the <em>code</em>.\nThey are a sort of market maker where then all the other contributors trade\ncode <em>for</em> code within that market-ish structure.</p>\n<p>In practice, this motivation produces a game theory\nproblem where, when\nmaintenance drops below a critical threshold, it creates a big enough\ncrisis that at least <em>some</em>\nfreeloading stakeholders will be forced to start making contributions.</p>\n<p>Ultimately, however, this saves <em>all</em> involved parties a ton on maintenance,\nmore eager volunteers who do not freeload in the first place get all the other\nbenefits mentioned above as well.</p>\n<h3 id=\"a-brief-aside-about-your-chart-of-accounts\">A Brief Aside about your Chart of Accounts</h3>\n<p>Most companies account for open source maintenance work as simple overhead on ongoing projects. Sometimes it’s CapEx, sometimes it’s OpEx, but it’s just “whoever happens to be working on this thing to support whatever random product it’s a part of”.</p>\n<p>This type of accounting creates distorting incentives, because it doesn’t recognize all the benefits above. Under such a fiscal regime, ongoing healthy maintenance becomes a ZIRP because when resources are more constrained, this apparent indulgence gets corrected.</p>\n<p>The ancillary benefits that open source creates ought to be properly\nrecognized.  It shouldn’t just be buried as Wages or IT or whatever.  If it’s\nhelping you hire better engineers, some of that expense should be allocated to\nRecruitment Costs.  If it’s materially improving your reputation among your\ncustomer base, some of it should go to Goodwill.  If it’s getting your product\nin front of developers who are your customers, it should be in Marketing.  Most\nimportantly, if maintenance on an open source project is actually helping you\nmaintain your enterprise-wide platform, it should not be squirreled away in\nsome small team who happened to be the first one to adopt it.&lt;sup&gt;3&lt;/sup&gt;</p>\n<p>Exactly how these costs should be allocated and cross-charged to different departments depends heavily upon your organization and your specific chart of accounts. But “whatever, it’s just part of the software product” or “I guess it’s DevRel because the SDK is in there” is guaranteed to have your open source organization destroyed along with all those side-benefits the next time that there’s a cash crunch.</p>\n<h2 id=\"the-things-that-aren-t-supposed-to-be-benefits\">The Things that Aren’t Supposed To Be Benefits</h2>\n<p>These categories <em>could</em> be made as explicit, rational trade-offs, even if they\nare often implicit and subtle in practice.  They are transactions where the\nmaintainer gets something and the user gets something.</p>\n<p>However, not everything that you are getting as a maintainer is something you\nare actually <em>supposed to use</em> to your own benefit.  Being given trust in\nservice of a responsibility is not a transaction.</p>\n<h3 id=\"oops-all-root-shells\">“Oops, All Root Shells”</h3>\n<p>Open source code <em>is code</em>.  In our modern world of absolutely pathetic\nsandboxing,\ninstalling code from somebody else gives them control over your system, even if\nit is somewhat indirect.</p>\n<p>There is an unwritten rule that if I create an open source library, and you use\nit, it probably <em>shouldn’t</em> have a backdoor in it that gives me the credentials\nto your bank account.  There is a trust relationship between the user and the\nmaintainer, and here, we see the first <em>obligation</em> that the maintainer has.\nThe maintainer is obligated *not to use the user’s computer for their own\ngain*.</p>\n<p>This rule might seem obvious and straightforward.  It might even seem unfair to\nyou that I call the rule “unwritten”, because the rule <em>is</em>, in fact, written\ndown in a few places: for example, in the npm Acceptable Content\nPolicy,\nit says right there:</p>\n<p>A few examples of unacceptable content:</p>\n<p>…</p>\n<ul><li>Content containing malicious computer code, such as computer viruses, computer worms, rootkits, back doors, or spyware. This includes content submitted for research purposes. Tools designed and documented explicitly to assist in security research are acceptable, but exploits and malware that use the npm registry as a deployment or delivery vector are not.</li></ul>\n<p>I think we can all agree that a script which steals your bank credentials and sends them to me to buy a totally sick jet ski would qualify as “malware”, so clearly that is forbidden.</p>\n<p>There is also an enormous gray area here.  npm also explicitly <em>allows</em>\n“Information on how to pay, donate to, and otherwise support Package\ndevelopment”, but then goes on to explicitly <em>forbid</em> “Packages that display\nads at runtime, on installation, or at other stages of the software development\nlifecycle, such as via npm scripts.”&lt;sup&gt;4&lt;/sup&gt; How are the lines drawn around these\ngray areas?  “npm will continue to apply its judgment when deciding what\ncontent is acceptable.”</p>\n<p>But also... this is forbidden <em>by npm</em>, not by the transcendental nature of\n“open source”.  I could give away code that displays all kinds of ads to its\nusers as a “gift” on my website.  The exact structure of this policy is not\nuncommon, but it also isn’t exactly the same as other such sites.  PyPI, for\nexample,\nexplicitly bans “cryptocurrency mining”, which NPM does not.  Is cryptocurrency\nmining “not open source”?  A lot of judgement calls are happening here about\nwhat is allowable in these “gifts” that you are giving to your users.</p>\n<p>But I digress.</p>\n<p>My point is that policy-making around this concept is not clear, there are lots\nof little disagreements around the edges, but there is a very strong consensus\nthat while the user is giving you their trust here, that is <strong>not a trade</strong>.\nThe deal is not “you give the user some code, the user gives you unlimited\ncompute and access to all their financial accounts”.  The user has made\nthemselves vulnerable to your code on the strength of your reputation.</p>\n<p>This creates an obligation for you to not do anything evil with that code, either intentionally or through negligence.</p>\n<h4 id=\"security-updates-are-just-command-and-control-in-a-funny-hat\">Security Updates Are Just Command And Control In A Funny Hat</h4>\n<p>All of this is just about the initial download of some code, and that is the way that Rich Hickey describes it, as if you just grabbed some code off a web page and put it in a folder that you like on your desktop. But that is not how open source relationships work today, if indeed it ever was.</p>\n<p>The way it works today is that you add a dependency to your <code>pyproject.toml</code> or\nyour <code>package.json</code> or your <code>Cargo.toml</code> and now your users are vulnerable not\njust to whatever you happened to upload in the first place, but to *whoever\nhappens to have your package index credentials*.</p>\n<p>This creates an obligation to maintain an operational security posture that protects your users from malicious updates.</p>\n<h3 id=\"the-roadmap-is-someone-s-life\">The Roadmap Is Someone’s Life</h3>\n<p>Another kind of trust that the user is placing in you is the trust that you are\ngoing to have at least <em>some</em> kind of regard for their usage of your software.</p>\n<p>In a perfect world, the user’s expectations could be clearly circumscribed. Whatever ongoing maintenance you commit to perform would be encapsulated in clear policies that you’d write up in advance, about exactly what kind of security response policy you have, how you will communicate when you no longer have the resources for maintenance, and so on.</p>\n<p>But anyone who has been involved in any project at anything but the most extreme tier of operational maturity knows that 99% of the ecosystem relies on a set of loose conventions around how all that stuff works. We expect that maintainers will generally be around, that they’ll use existing tools like an issue tracker for triaging user bugs, GHSA and CVEs for security reporting, that they will mark the project as “archived” and maybe do a final release before abandoning it, that they will maintain a ChangeLog explaining at least a little bit of what is going on.</p>\n<p>Users assume that those conventions will be followed when there are any gaps in\nexplicit policy, or indeed if policy is lacking entirely.  This assumption is\nreasonable, because otherwise nobody could ever <em>use</em> any open source without a\nstack of service contracts that nobody has any time to write.</p>\n<p>The strongest such convention is that an actively maintained program will, at\nleast, more or less <em>keep doing what it does</em> as time goes on.  A user who has\nelected to use a bit of open source software has made themselves vulnerable to\nchanges and breakages in that software by the mere fact of using it.  In the\ntime that they have used it and invested in it, they have <em>not</em> invested in:</p>\n<ul><li><em>creating</em> alternative software to meet their needs,</li><li><em>maintaining data</em> in formats that other software can read, or</li><li><em>learning how to use</em> existing alternative software.</li></ul>\n<p>This can, and does, go badly wrong, when those expectations are mismatched.</p>\n<h4 id=\"how-it-goes-wrong\">How It Goes Wrong</h4>\n<p>Let’s say a maintainer creates an open source paint program, OpenPaint.</p>\n<p>An artist, known for their unique style of making blended collages, switches from their previous app, ProprietaryPaint, to this new OpenPaint to make these culturally significant works of art. However, the maintainer decides that the ‘blend’ tool is kind of a pain to maintain, and they remove it in OpenPaint 2.</p>\n<p>A few months later, the artist’s operating system vendor issues a security update that breaks OpenPaint, because older versions of OpenPaint were unknowingly abusing some platform API.</p>\n<p>The maintainer releases a new OpenPaint 2.0.1 that addresses this incompatibility, but doesn’t care about version 1.x any more so they don’t bother to update that one.</p>\n<p>This places the artist in an impossible situation. They can stay on an old version of their operating system, putting all their personal data at risk. Or they can upgrade to the new operating system, effectively either cutting off access to their livelihood, or forcing them to change their art style entirely.</p>\n<p>Now, proprietary software can place users in similarly untenable positions (and\nin fact, it is <em>more often</em> proprietary software that does).  But does the\nopenness completely remove <em>any</em> obligation for this consideration?  Should\nthe OpenPaint team have to at least <em>communicate</em> the reasons for doing this,\nto give the artist some recourse?&lt;sup&gt;5&lt;/sup&gt;</p>\n<p>The only thing that “open source” does is that it allows the artist to pay a prohibitive amount of money to a new maintenance team to create a fork. This is rarely the kind of thing that individuals can manage.</p>\n<p>This creates an obligation to *at least consider how your users might be\nrelying on you*.</p>\n<p>This is the most complex obligation of the bunch.  Obviously it does not\nentitle every single user to infinite work from the maintainer, but it also\nshouldn’t entitle the user to <em>nothing</em> for having trusted these subtle implied\nclaims that the maintainer is making by making their work public.</p>\n<p>It is a nuanced and ongoing negotiation and I do not think we have a clear moral intuition about how it should work out. But we do need to figure out a way to work it out.</p>\n<p>It also raises a clarifying question.</p>\n<h2 id=\"why-are-we-even-doing-this-and-who-are-we-doing-it-for\">Why Are We Even Doing This, and Who Are We Doing It For?</h2>\n<p>People generally like to do things for more than one reason. We live in an economy where people need to make money, but we mostly prefer to make that money doing things that are useful, and that make other people happy.</p>\n<p>So, yes, we create open source for self-interested reasons to improve our\nreputations, to improve our skills, to increase our influence and to share our\nmaintenance burdens.  In so doing we take on <em>some</em> level of obligation to not\nabuse the trust that is placed in us, even if that level of obligation is not\nclear.</p>\n<p>But if we are not doing it to <em>serve</em> those users at least a <em>little</em> bit, then\nthose motivations are going to quickly ring hollow.  We will not increase our\nreputation with a person if we respond to their every request by telling them\nthat we owe them nothing and that their opinions are worthless.  We will not\ngain influence over a community if we ignore their desires.</p>\n<p>Many interactions with open source maintainers are unnecessarily adversarial. This is of course partially the fault of those users, who should calibrate their expectations appropriately.</p>\n<p>Still: maintainers could do a better job of listening <em>before</em> these\ninteractions become toxic.  There’s no reason that “open source users” should\nbe an especially toxic group of people.  At this point in history, that group\nis basically just … people with computers.</p>\n<p>It’s like that old truism. If you meet one person who is a jerk to you, that’s their problem. But if everyone you meet, everywhere you go, is constantly abrasive to you and treats you like you’re doing something wrong, maybe it’s time to look inward.</p>\n<p>If all open source users are entitled assholes, maybe it’s time to look for a structural problem.</p>\n<h3 id=\"surprise-it-s-about-ai-again\">Surprise, It’s About AI Again</h3>\n<p>Sigh.&lt;sup&gt;6&lt;/sup&gt;</p>\n<p><em>Users</em> <em>hate</em> <em>slop.</em></p>\n<p>I know, dear AI-positive reader, <em>your</em> AI outputs are different from everyone\nelse’s, <em>you</em> aren’t pushing thoughtless slop into your code, just because\neveryone else is and it is the inevitable terminus of using those tools.  You\naren’t “lazy vibe coding” with Claude, you’re doing “responsible agentic\nengineering”, which is different because you’re just built different.</p>\n<p>Still, humor me, for a moment.  Your <em>users</em> don’t know that.  They know what\nit looks like when products that they like adopt slop.  They know that they\nwill start leaking\ndata.\nDevelopers know that it will make them personally less\nsecure.\nThey know that they can expect more\noutages\nand that your code will inexorably decline in\nquality.</p>\n<p>In other words, your users are going to assume that this means you are\nviolating that final obligation that the software should <em>keep working</em>.</p>\n<p>Your users are going to tell you to stop, and they are probably going to get\nmad.  Maybe you, or a plurality of your team, <em>also</em> want to stop, maybe you\ndisagree with them, but in any case you need some way to *have that\nconversation* in a way that does not immediately overflow into every adjacent\ndiscussion forum.  Users need to feel welcome in some space so they can have\nthe discussion <em>in</em> that space, and not explode out into a thousand different\ngroup chats and social media threads.</p>\n<p><em>This</em> post was inspired by yet another prominent open source community\ndiscourse where a ton of angry users showed up to yell at developers to stop\naccepting LLM-generated code.  I’m not going to link to any of these, because\nwe don’t need any more fuel for the discourse fire.  But there is more than one\nsuch case and the pattern is becoming familiar.</p>\n<p>On social media - usually BlueSky or Mastodon, but sometimes a user group\nforum - users become aware of some AI-adjacent policy.  They show up in a horde\nto the developer forum or mailing list.  They loudly start demanding the\nproject take a hard stand&lt;sup&gt;7&lt;/sup&gt; against AI. This pressure is simultaneous, but\nuncoordinated; extremely repetitive, very diverse, often inconsistent, and\npretty stressful, especially if you’re a burnt-out maintainer with other things\nto be doing who may not even like AI yourself in the first place.</p>\n<p>Believe me, I get it. It can be very unpleasant to deal with.</p>\n<p>Like most problems that AI is causing, though, it’s not really an “AI” problem\nas much as it is a pre-existing dumpster fire that “AI” is pouring gasoline\nonto.  In this case, an online mob is the language of the unheard&lt;sup&gt;8&lt;/sup&gt;.</p>\n<h2 id=\"if-users-are-mad-it-s-probably-already-too-late-but-maybe-you-ca\">If Users Are Mad It’s Probably Already Too Late (But Maybe You Can Get Ready For Next Time)</h2>\n<p>One day, all of a sudden, you’re getting feedback from a bunch of users that\nare using inappropriate channels to complain. But did they already have\n<em>appropriate</em> channels to use?</p>\n<p>Did you have a place for people to congregate and discuss your project? To make orderly complaints in a way that will be legible to you? Or do you just have a GitHub Issues page, which non-technical users have no idea how to interact with, and a forum for developers, where users don’t know the norms and any arriving brigade of pissed-off users will be seen as disruptive and inappropriate?</p>\n<p>I don’t want to be throwing any stones from within my particular glass house. Setting up such a place has gotten harder over the years. I don’t really have one, either.</p>\n<p><em>Could</em> I have one, though?  IRC has been slowly dying, mailing lists are\nunpopular and present increasingly annoying moderation challenges, forum\nsoftware is expensive to operate and keep maintained, Discord is a confusing\nmess and the upshot of all of this is every community needs community\nmanagement and forum moderation.  Which means that for my own small solo\nprojects, I couldn’t possibly have such infrastructure because such\ninfrastructure requires a <em>dedicated second person</em> to maintain it, and until\nsomeone volunteers for that, it’s not really feasible.  Even for my larger\nprojects you’d be surprised how slim of a skeleton crew\nwe are getting by with, and we definitely don’t have a whole spare maintainer\nto go manage this, especially as we are under attack from the slopocalypse\nourselves.</p>\n<p>The nature of open source community is that most communities start too small to\nneed such a thing, grow incrementally until one day they are suddenly <em>way</em> too\nbig and needed one yesterday, and then suddenly they are too small again when\ninterest wanes even a little bit.  Even as we need it more and more, building\nand maintaining community infrastructure remains a challenge.</p>\n<p>Even so, having a dedicated place for <em>users</em> — not maintainers — to converse\namongst themselves, be an actual community, and present feedback to the\ndevelopers, is fast becoming a necessary component of a successful community\nand not a nice-to-have.</p>\n<h2 id=\"in-conclusion\">In Conclusion</h2>\n<p>As trying as it can be sometimes, we maintainers all do get something out of\nopen source, and it is good to be honest with your users — and with yourself —\nexactly <em>what</em> you want to get out of it.  In order to know whether the juice\nis worth the\nsqueeze, we\nmust know both what the juice is, <em>and</em> what the squeeze is.</p>\n<p>Part of the metaphorical squeeze <em>is</em> a set of obligations, and those are the\nmost poorly defined of all.  We should try to be clear about what those are\ntoo.  Both about exactly what we believe we are signing up for, and also, about\nhow we are willing to let our users hold us to account for them.  Codes of\nconduct are a start here, but only the absolute barest bare minimum; “do not\nharass your colleagues or your users” is not a standard of excellence to aspire\nto, it’s just basic manners.</p>\n<p>I can’t tell you exactly what your obligations are, only try to gesture at my idea of the outlines of the fuzzy moral intuition we’ve all been implicitly sharing up until now.</p>\n<p>Drawing this line is not just for the benefit of the users, either.\nMaintainers already feel pressure, we already feel obligations.  We <em>resent</em>\nthat feeling of obligation. While there are a diverse array of reasons for that\nresentment, one big one is that it’s not clear, even to ourselves *where the\nobligations end*.  Lashing out by saying “I promised nothing and I owe you\nnothing!” followed by some choice expletives feels cathartic, but it doesn’t\nreally solve the problem, because we clearly don’t really believe that’s where\nthe line is, or we would have already stopped there.  We wouldn’t feel the need\nto say it.</p>\n<p>It is going to be a very big collective endeavor to figure out exactly where that line is. The best time to have gotten started on that endeavor was 50 years ago.</p>\n<p>But the second best time is today.</p>\n<h2 id=\"acknowledgments\">Acknowledgments</h2>\n<p>Thank you to my patrons who are supporting my writing on\nthis blog.  If you like what you’ve read here and you’d like to read more of\nit, or you’d like to support my various open-source\nendeavors, you can support my work as a\nsponsor!&lt;sup&gt;9&lt;/sup&gt;</p>\n<ol><li></li></ol>\n<p>Somewhat to everyone’s surprise, I, too, do things for money, like writing this post. Please remember to like and subscribe ↩</p>\n<ol start=\"2\"><li></li></ol>\n<p>Whether it was originally yours, or developed by an employee who happened to be on staff at the time, or adopted by an employee who just started contributing to it a lot, in any of these scenarios a company can benefit from increased consistency and increased familiarity. ↩</p>\n<ol start=\"3\"><li></li></ol>\n<p>If the rule is that they must forever endure the searing budgetary pain of gripping the white-hot potato that they unwittingly caught when they first made a good technical choice, this creates a perverse long-term incentive. ↩</p>\n<ol start=\"4\"><li></li></ol>\n<p>I also find it darkly amusing that there is an explicit affordance here made for advertising, specifically, “Packages with code that can be used to display ads are fine. Packages that themselves display ads are not.” This distinction rather gives the game away, that this is a website for carnies and not for marks, and that at some level we expect our users to deserve a lower level of respect than ourselves. But a full exploration of that is another blog post, or maybe a book, that I don’t have time to write right now. ↩</p>\n<ol start=\"5\"><li></li></ol>\n<p>If you want the turbocharged ultra-dramatic version of this problem, make it open source drivers for an optical prosthesis that lets the users <em>see</em> instead of an art app.  That level of immediate physical dependency could\nbe clarifying.  It does also start to edge into an area where you could say\nthat biomedical devices ought to be regulated differently, and that’s not\nreally a “software” problem but a “healthcare” problem and I’d mostly\nagree.  Except for the fact that this is a<em>very</em> short distance away from\nbreaking everyone’s screen-reader with no notice or\nrecourse. ↩</p>\n<ol start=\"6\"><li></li></ol>\n<p>Did you believe I could write a blog post in 2026 which wasn’t somehow about AI? I wish I could still believe that. ↩</p>\n<ol start=\"7\"><li></li></ol>\n<p>It doesn’t help that many of the most pro-AI voices are starting to have an, ahem, discernible political valence that is very unpopular among users. ↩</p>\n<ol start=\"8\"><li></li></ol>\n<p>My apologies to MLK. ↩</p>\n<ol start=\"9\"><li></li></ol>\n<p>If you read this whole post you can see that I sure need the help with all that. ↩</p>","headings":[{"level":1,"text":"Who Is Open Source About?","id":"who-is-open-source-about"},{"level":2,"text":"Open Source Is Not About “Open Source Is Not About You”","id":"open-source-is-not-about-open-source-is-not-about-you"},{"level":3,"text":"A Brief Aside about Meta-Ethics","id":"a-brief-aside-about-meta-ethics"},{"level":2,"text":"What Are We Doing When We Do An Open Source?","id":"what-are-we-doing-when-we-do-an-open-source"},{"level":2,"text":"Why Are You Doing This?","id":"why-are-you-doing-this"},{"level":3,"text":"Reputation","id":"reputation"},{"level":3,"text":"Influence","id":"influence"},{"level":3,"text":"Improvement","id":"improvement"},{"level":3,"text":"Outsourcing","id":"outsourcing"},{"level":3,"text":"A Brief Aside about your Chart of Accounts","id":"a-brief-aside-about-your-chart-of-accounts"},{"level":2,"text":"The Things that Aren’t Supposed To Be Benefits","id":"the-things-that-aren-t-supposed-to-be-benefits"},{"level":3,"text":"“Oops, All Root Shells”","id":"oops-all-root-shells"},{"level":3,"text":"The Roadmap Is Someone’s Life","id":"the-roadmap-is-someone-s-life"},{"level":2,"text":"Why Are We Even Doing This, and Who Are We Doing It For?","id":"why-are-we-even-doing-this-and-who-are-we-doing-it-for"},{"level":3,"text":"Surprise, It’s About AI Again","id":"surprise-it-s-about-ai-again"},{"level":2,"text":"If Users Are Mad It’s Probably Already Too Late (But Maybe You Can Get Ready For Next Time)","id":"if-users-are-mad-it-s-probably-already-too-late-but-maybe-you-ca"},{"level":2,"text":"In Conclusion","id":"in-conclusion"},{"level":2,"text":"Acknowledgments","id":"acknowledgments"}]}}