[madeofpalk]

What would a solution to this look like?

What would it take to not fear installing software? This isn't a npm problem, its a computing problem in general. Spaces like this are generally pretty against any sort of restrictions or limitations being put on computers under the name of safety (see Manifest v3)

[dwoldrich]

For libraries, I like the Gnu Affero Public License[1]. If you run the library in software with that license, you have to publish all the source of the entire project that incorporates it.

No corporation could tolerate this, though, so the library vendor can negotiate a commercial license of their software for appropriate fees.

That said, corporations are not going to want to negotiate fees with 100's of vendors over constantly fluctuating dependencies in their software.

This is why the next big language/software ecosystem needs to integrate payments to vendors in their repository system. That way, commercial license management can occur between the ecosystem owners and the corporate customers and all the vendors get paid their fair share.

Similar to Amazon's Dynamo API, whatever the next big language/ecosystem is needs to be designed around _billing_ and automatic license management for # of deployments, seats, call volumes, etc.

[1] https://web.archive.org/web/20260712154038/https://www.gnu.o...

[skissane]

> This is why the next big language/software ecosystem needs to integrate payments to vendors in their repository system. That way, commercial license management can occur between the ecosystem owners and the corporate customers and all the vendors get paid their fair share.

I don't think this idea is going to go anywhere.

If a package is available for free, on convenient licensing terms, developers will use it.

If you make them pay, many developers will prefer to just build it themselves. Coding agents make that easier than ever.

Buying a package involves a lot more paperwork – it needs to go through procurement – and introduces new risks, e.g. what if the vendor increases their prices

There are potential exceptions – software with really advanced algorithms (e.g. solvers for optimisation problems); safety critical software; software needing regulatory certification (e.g. there are some Australian government APIs they won't let you call unless you've hired an auditor to certify the software you are calling them with, and the relevant government agency has approved the auditor's report) – but those exceptions are relatively rare, and the existing solutions are arguably adequate to handle them

I also think it is different for packaged SaaS applications [0] because there the buyer isn't a developer, it is someone non-technical, and "use a coding agent to build it yourself" isn't within their comfort zone or risk appetite (at least, not yet).

[0] conflict of interest disclaimer: work for a SaaS vendor

[dwoldrich]

I don't disagree with you that freely distributed software on conveniently licensed terms is going to be the go-to stance for the majority of solo and non-commercial developers.

I just believe I could arrange the universe such that I get to have my cake (commercial licensing) and eat it too (with default open source licensing).

It is my experience that corporations do pay handsomely for software they use, even SaaS ones as the cost of doing business. Open source communities need mechanisms for funding that are consistent and low friction.

This is why the software language/repository/platform itself needs to facilitate license tracking and billing for alternative commercial licenses, to make it easy for corporations.

A successful new language effort that provides this facility need not be an enforcer except to say if an enterprise is willing and signed up to pay for any dependencies it uses, it is obligated to pay for all of them with something like AGPL 3 as the poison pill they have to swallow otherwise if they distribute or serve from any copyleft software.

Having simple, consistent rules that vendors and consumers have to follow with no rugpulls will be important for market acceptance. Having voluntary compliance with license terms will also be important to not turn people off from the ecosystem and to let them kick the tires. If software vendors want to distribute only unencumbered free and open source, then god bless 'em, they should be able to do it.

[jchw]

Manifest v3's actual motive was so shamelessly transparent that most of us just don't allow the "safety" argument for it to really be entertained. I don't have a suspension of disbelief rich enough to pretend I don't know.

[insanitybit]

> What would a solution to this look like?

Sandboxing and auditing built into the software from the start. Browser Extensions solved this ages ago.