I had such an interesting call today with someone from @ethereumfoundation about funding the #opensource ecosystem.

[gina@fosstodon.org]

I had such an interesting call today with someone from @ethereumfoundation about funding the #opensource ecosystem.

Basically, connecting a blockchain based funding system to a Software Bill of Materials (SBOM) to fund not just the sexy top project, but also the underlying libraries. Aka when you donate to or pay for a project, it would automatically donate to its dependencies as well (like the random person in Nebraska).

What do we think, #fediverse?

[projectmoon@social.agnos.is]

@Gina@fosstodon.org @ethereumfoundation@mastodon.social the question, as always when it comes to blockchains is, why does this require a blockchain?

[gina@fosstodon.org]

@projectmoon @ethereumfoundation I'm guessing because of the smart contract element and because it's cheaper.

I'm not sure, I'm in no way a blockchain expert. Also not sure how it would work with or without blockchain.

[jannem@fosstodon.org]

@Gina @ethereumfoundation
My feeling is, "blockchain" strongly implies it's a grift, not above-board.

[projectmoon@social.agnos.is]

@Gina@fosstodon.org @ethereumfoundation@mastodon.social don't know about the cost, but can't you just basically parse the dependency list and go hunting for liberapay accounts from the dep's readme? lol

[bryanredeagle@beige.party]

@Gina Generally, the idea of a donation hitting a bill of materials so the underlying tools get funded seems like a good idea. Doing it through the blockchain feels like a scam.

[sephster@fosstodon.org]

@Gina my initial thought is that because this is presumably using blockchain tech, it likely won't be great for the planet, so I'd not want it on that basis

[gnomon@mastodon.social]

@Gina I like the concept, not the idea.

1. No part of this proposal needs a blockchain or Ethereum. Proposing this idea is a marketing effort by stapling an attractive idea to the side of an unattractive one.

2. Deriving a contribution-splitting model from an SBOM is interestingly difficult! Even more so if you try to walk a dependency tree instead of a flat list. How are contributions split? Equally among dependencies? Does every library dependency contribute equal value? To whom?

1/2

[ancoghlan@mastodon.social]

@Gina My main question would be why they think their approach would work better than what Tidelift does (this is not taking a position on whether or not what Tidelift does is particularly effective at improving open source sustainability, it's just the main existing instance of a comparable concept that I am aware of)

[gina@fosstodon.org]

@ancoghlan I wasn't familiar with Tidelift yet, will look into them now, thanks!

[gnomon@mastodon.social]

@Gina presumably that "value to whom?" question is where smart contacts come in, allowing users to express their personal policy about distribution across SBOMs or dependency trees.

But the mechanism for expressing that policy doesn't exist. Will users write their own smart contracts for each project? They'll need more insight into program construction than the developers to make those decisions! The idea doesn't pass muster.

Let projects support their own dependencies. No blockchain.

2/2

[sheogorath@microblog.shivering-isles.com]

@Gina @ethereumfoundation I get the idea, but there are so many strange problems folded into it. E.g. how do you distribute the money?

E.g. if you have a node application and you have a dependency like expressjs (a full webserver thingy) and the "isEven" package, do both get the same amount of money? Do you set percentages?

And the questions with all things Blockchain:

1. How does it become real money again?
2. What happens with unclaimed dependencies?
3. How does it attract attackers?

[neil@mastodon.neilzone.co.uk]

@Gina

I have a gut feeling that this might be trying to wedge a blockchain into something where no blockchain is needed.

But if there is a way for going beyond individual developers / projects asking donations, and Tidelift in the more corporate space, excellent!

[bendoubleu@mastodon.llyxx.me]

@Gina @ethereumfoundation
I’d say this seems like a legitimate blockchain use case. open source maintainers are globally distributed across jurisdictions/countries.

automatic dependency splits across hundreds of recipients with no trusted intermediary is genuinely hard to replicate with traditional payment rails.

Using mandate-generated SBOM data as the funding graph is elegant. The hard unsolved piece is the SBOM to wallet mapping, but that's an identity problem, not a blockchain problem.

[pitrh@mastodon.social]

@neil @Gina this version I feel is a bit closer to reality -

[kineticdiplomacy@infosec.exchange]

@Gina @ethereumfoundation you lost me at blockchain.

[arod@social.coop]

@Gina @ethereumfoundation based on my knowledge of the history of music royalties, a well-meaning system won by a massive labor organizing effort, I am extremely skeptical of this idea being effective in practice. There are too many ways to game complicated systems like this and it ends up benefitting the people who have the resources to understand all the complicated pieces (in this case, coders)

[dan@tilde.zone]

@Gina @ethereumfoundation Sounds like a good use case for smart contracts. Theoretically it would allow anyone donating to a project to know how the funds get split. Practically, per transaction fees are extremely volatile, but apparently cheap now. Most people wouldn't know how to decipher a smart contact and even people who should know have been scammed in the past.

[janl@narrativ.es]

@Gina blockchain no thanks

[cy@fedicy.us.to]

Doesn't paint Cloudflare as a raging behemoth destroying privacy, torturing innocents, and ruining everything at any costs so they can have complete control.\

CC: @neil@mastodon.neilzone.co.uk @Gina@fosstodon.org