[lucasyvas]

It seems artificial at face value but the distribution model has existed for decades under the same conditions.

The argument is that we should split these two concerns explicitly to create a delineation of roles and responsibilities. We have a model for this but don’t adopt it elsewhere in the name of simplicity, but the outcome is more complex because you can’t point the finger at anyone.

It should work as you say, but it doesn’t and arguably never will. So I suggest we deliberately change everything to the distribution model to make it explicit. It then becomes clearer that the distributor is who you go to for support. If the author is the distributor, go to them. If it’s someone else, go to the entity that distributes it. If there is no distributor, it’s on you to build it and support it yourself.

It forces the build process onto the distributor which makes them best set up to deploy fixes, therefore it’s more clearly their responsibility. The shifting of where it builds actually goes a long way to solving this problem. If you are building and publishing it yourself, you are set up to fix the issue immediately which indicates you should fix it first and then upstream it.

[bee_rider]

What form does has this responsibility taken for decades? I use Ubuntu currently, if Canonical broke my computer I’d fully expect to have no recourse…

[lucasyvas]

If there’s a bug in SSH libraries that Canonical ships in Ubuntu, that is their distribution of that library even if they are not the primary authors. Canonical guarantees support for the software it ships, so they are obligated to fix it no matter what. Fixes are upstreamed to the primary author - the author never asked for their software to be included in that distribution so it’s not their problem to fix it for Ubuntu users.

This is a model that solves the problem the author is discussing.

[bee_rider]

Are we talking about, like, legal liability or just a feeling of social obligation?

I think with software supply chain, we’re talking about the former, and I don’t think Canonical has any legal liability toward me (who hasn’t paid them anything; although because I expect nothing I didn’t read the license in detail). In terms of feelings of social obligation it is much more complex, of course.

[lucasyvas]

Social obligations are inherently weak is the point I’m trying to make. Make it easy for active users of your software to distribute it and make it harder for free-loaders. The problem solves itself.

[samrus]

Where does Canonical say they guarantee support? They might for their paid program, but they dont for their free version. Which is the exact point the author made

[lucasyvas]

Ubuntu literally has LTS releases where they guarantee fixes for security issues and the like for absolutely no charge.

[samrus]

Yeah but thats not on demand support. They never say that you can demand a bugfix and they are obliged to provide it. Again, those bigfixes are provided as is. The author os talking about companies wanted to essentially raise tickets and get on demand support. Which no one in their right mind provides for free