jamietanna

That was a few days ago: https://news.ycombinator.com/item?id=48313577

*11.x

I personally prefer Free Software (FSF-approved) or Open Source (OSI-approved) licenses, but I also agree that there is a place for other licenses. It's better that there's space for kinda-open, rather than it being open vs completely closed repositories.

I've previously worked at a company using an "open source" license (Elastic, with the ELv2) and have enjoyed having to explain the difference to folks between what it meant to be "open source" vs "Open Source", and the fact that a lot of folks generally don't understand the difference and some of the nuance. Mentioning the BuSL was because it's something a lot more folks may be aware of, i.e. given Hashicorp's recent relicense (as with other companies in recent years)

Sustainability is hard, and having different ways to describe this is good! But it's a lot harder when people don't understand why something calling itself "open source" when it's "but you can't run it if you're a company" is bad

I must say, I'm honoured this commenter is so angry about this post, they've read through many of my blog posts, and gone through microsites like my Manual of Me[0], to pull this quote to attempt to criticise me

[0] https://manual.jvt.me/

Hah, yes very true!

If you've not read up on the background between the two - I'd very much recommend it (and sorry if I'm re-explaining something you understand)

With Free Software, it's "free as in freedom", not "free as in gratis". Free Software is generally a bit more strongly biased towards the users of a piece of software, but as businesses started to use it they were a bit unhappy with that, so Open Source came to reduce that a little bit, making it easier for companies to use it, without as many strong protections for a user

See also [1]

[0] https://www.gnu.org/philosophy/free-sw.en.html [1]: https://www.gnu.org/philosophy/open-source-misses-the-point....

I think using `open source`, and clarifying that it includes non-OSI-approved licenses could work.

Alternatively, "source available" is a term that's been used to imply the source is there, but it's not "open source" (which led to the Fair Source folks working on their own naming for it, so as some folks have negative views of "source available")

Nice! I've been doing similar, but prefer using Co-authored-by, especially as it allows for cases where there may be multiple models in play

As I've written elsewhere in the thread, having worked at a large Enterprise in collaboration with Legal, if there isn't tracking of what AI contributions you have, it's harder to be protected legally by ie Microsoft's indemnity clause if you're sued

Agreed they could be clearer on this

IMO (and I am biased because I have written about this before in https://news.ycombinator.com/item?id=47164481) but I believe it's to make sure they're legally covering their users, and making sure users of AI tools do at least have some attribution for AI-derived contributions

Was wondering why a few of my sites aren't CSSing, as they use https://classless.de

Both Renovate and Dependabot will raise PRs for a security fix, regardless of minimumReleaseAge/cooldown config

Ooh thanks!

Was wondering if there was a list of known opt outs as we are looking at a default opt out in Renovate[0] - we'll also look to set `DO_NOT_TRACK`

[0] https://github.com/renovatebot/renovate/discussions/42932

Glad to hear you're enjoying Renovate - I'm biased, but I agree that the SHA pinning PR updates are a very nice feature

We recently found (in Renovate) some edge cases with how tags work in GitHub Actions which was fun (https://news.ycombinator.com/item?id=47892740) and there's a few things in there Dependabot doesn't seem to support too

And GitLab, too!

https://news.ycombinator.com/item?id=47853799 for the curious

The Wayback Machine has not archived that URL.

Might have been taken down?

Very much looking forward to getting this on Renovate - we require squash-merge via Merge Queue (with no per-PR override available in GitHub, despite asking) and so when I've got multiple changes, it's a lot of wrangling and rebasing

If this works as smoothly as it sounds, that'll significantly reduce the overhead!

Eh, there are some very good reasons[0] that you would do better to track your usage of LLM derived code (primarily for legal reasons)

[0] https://www.jvt.me/posts/2026/02/25/llm-attribute/

Yep, we had to do this recently with Renovate, where we had too many releases, and new publishing hit a size limit on the registry, so we needed support to help us unpublish a load of old releases

Nice, I've thought about this in the past (https://www.jvt.me/posts/2020/08/26/static-site-private-post...) and the difficulties were always if you want others to be able to read them

See also: https://news.ycombinator.com/item?id=40949229

Yep, and we've had it for a while in Renovate too: https://docs.renovatebot.com/key-concepts/minimum-release-ag...

(I'm a Renovate maintainer)

(I agree with Filippo's post and it can also be applied to Renovate's security updates for Go modules - we don't have a way, right now, of ingesting better data sources like `govulncheck` when raising security PRs)

In the "files changed" view on GitHub you can view the PR commit-by-commit and comment on that commit's change

See also: https://news.ycombinator.com/item?id=40011111

(a blog post I wrote, prior to joining Mend and working as a Renovate maintainer)

I think the confusion is also because it's a comparison of Community Self-Hosted (CE) vs the pure Open Source CLI - the latter is what works without license key

I'll see if I can help with clarifying this in the table!

(I'm a Renovate maintainer and employee at Mend)

Always happy to self-promote!

Website: https://www.jvt.me (used for blog, but I also use as an IndieWeb site, so I i.e. reply to social media posts from my website, and they're syndicated out to the different platforms)

Blog: https://www.jvt.me/kind/articles/

Archives page: https://www.jvt.me/archives/

Feeds: https://www.jvt.me/subscribe/

I've spent a bit of time thinking about this[0] - as a maintainer (oapi-codegen, Renovate, previously Jenkins Job DSL Plugin and Wiremock), as someone who used to work on "how can we better fund our company's dependencies", and building projects and products to better understand dependency usage

As others have noted, there are a few areas to watch out for, and:

- some ecosystems have more dependencies over fewer, and so we need to consider how to apply a careful weighting in line with that - how do we handle forks? Does a % of the money go to the original maintainers who did 80% of the work? - how can companies be clever to not need to pay this? - some maintainers don't want financial support, and that's OK - some project creators / maintainers don't get into the work for the money (... because there is often very little) - there's a risk of funding requirements leading to "I'm not merging your PR without you paying me" which is /not problematic/ but may not be how some people (in particular companies) would like to operate

[0] https://www.jvt.me/posts/2025/02/20/funding-oss-product/

I'm not sure why this has been flagged - its not possible to copy code from the repo, as it defaults to All-Rights-Reserved (aka proprietary)

Unless that's explicitly the intent, in which case that's fair

Unsure if it's an intended typo: `rm -rf $HMOE/bin`