Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Standard JS: npm install funding (github.com/standard)
168 points by ndrake on Aug 24, 2019 | hide | past | favorite | 123 comments


> The sponsorship pays directly for maintainer time. That is, writing new features, fixing bugs, answering user questions, and improving documentation.

As far as I can tell, this project is literally just a 200 line configuration file for a linter. Not even editor integrations for the linter, just a configuration file for it.

Is it truly something that requires funding to 'add new features'? How much time does it take out of your day to add a new line of JSON to a configuration file, or is the sponsorship there to pay for all the bikeshedding that's probably happening in the issues and comments on the project?

What sort of bugs are there in a linter configuration file?

I'm really confused by all of this.

> The funds raised so far ($2,000) have paid for Feross's time to release Standard 14 which has taken around five days.

Five days to do what? Five full 8 hour days? Does it take 5 days to cut a GitHub release and push it to NPM? What about the other contributors that give up their time for free, are their contributions worthless?

Rather than feeling like a way to support FOSS developers or FOSS projects, it feels like a rather backhanded attempt at monetization by the maintainer where Standard was picked out because it was the his most popular project, and therefore would return the greatest advertising revenue.

Do JavaScript developers, or people that use this project, have a more nuanced opinion than me? I do zero web development, is this type of stuff normal?


Here's the changes between the last 13.x tag and the latest (at the moment) 14.x tag (14.0.2): https://github.com/standard/standard/compare/v13.1.0...v14.0...

Analyzing the changes I leave as an exercise to the reader.

Regardless of the effort etc. and whether or not these changes were primarily functional or related to marketing, I personally support FOS maintainers doing whatever they want with the software they offer for free. It would be trivial to make a fork of Standard without the adware if you wanted, and the MIT license explicitly allows it. So more power to feross for his free offerings! And complainers: put your fork where your mouth is.


While a lot of commits, the actual content shows very few functional changes. Actually, most of the changes are indeed ads for companies that use the package.


For a more complete look at the changes, this should also include the diffs of the project-internal dependencies that were bumped.

https://github.com/standard/eslint-config-standard/compare/v...

https://github.com/standard/eslint-config-standard-jsx/compa...

https://github.com/standard/standard-engine/compare/v11.0.1....


This honestly makes it worse. I'm not even sure how you could call this stuff major version bumps.


The main repo has a testing script to make sure changes that cause previously-passing code to fail lint checks only happen in new major versions. Like SemVer, but for linter configuration files.

This would be an admirable commitment to stability if the project wasn't on its fourteenth major version.


It just seems like they changed documentation and moved some ES5 constructs to ES6, there isn't even a behavior change in those commits. Is this what took 40 hours to update? Why is this worth a major version bump?


If you've ever tried to configure ESLint for a preexisting style guide, or to maintain a configuration's consistency across successive ESLint releases, you may have some idea what's involved. If not, take a look at the kinds of rules those files are invoking, the extent of change they've undergone across time and language versions, and their interactions.

Whether it's a code file or a configuration file doesn't accurately predict complexity. Von Neumann and all that.

As for the maintainer, we're friends. He's been involved in JavaScript and Node.js development since very early on. Standard is not by any means his only work, or his only popular work. He's also the only one I'd trust to maintain it right now---technically and design-wise---and I know he has many other demands on his time. He goes out of his way to acknowledge that he's not alone on many projects, but by any measure, Feross has done the vast majority of work on Standard thus far, for the past five years or so.

If it took him five days to get v14 out the door, it took five days. I'm not going to go and try to second-guess his hour-by-hour through amateur GitHub forensics. But I'd expect a fair amount of the labor came not just from the code itself, but from issue management, changelog, repo hygiene, and associated joys of maintaining a developer-facing tool with name recognition that's first point of contact for lots of folks who don't contribute in kind.

All software, done well, looks easy from the outside. Standard is not the Linux kernel, but it's good software that users interact with constantly. It's been carefully maintained primarily by just one dev for several years. It has been one huge, reliable constant in a language ecosystem with a lot of churn.


I completely agree with everything you said.

We pay managers salaries even though they often don't write any code, why is management of a widely used OSS project not deserving of funding on its own?

I've used standard for years, and I've never once had an issue with breaking changes. They've added features, fixed bugs, and even made changes that fixed issues that I personally raised with the project.

It's good software, and even though it looks trivial at a glance it took a LONG time and a lot of effort to get there, and every time I'm working on a project that doesn't use standard I'm quickly reminded of just how many of those edge cases they have handled for me.

I'm happy about the parts of this discussion that are about the way they are funding the project (and I don't actually like the specific way funding is being managed for this project), but all of it seems wrapped in dismissive comments about the library itself.


I don't use Standard, but I am a (mostly) frontend developer, and I agree with your take on things. It's a shame, because feross is a very productive open source developer, but it does look like this is a ill-conceived attempt at monetization of his most popular project that has the largest audience.

And hey, I'm all for monetization of open source projects: I have no problem with ads on READMEs, etc.

But no, no ads in my terminal when I'm working. Not normal and not OK.


The standard experience of maintainers trying to support their work is that everyone else makes a public point of standing in support of maintainer funding as a general matter, but strongly opposes whatever specific approach the maintainer actually happens to be trying.

To be frank, I'm not a fan of ad-based models. But it's the example here, and we see the same pattern. Ads in general? Sure. Ads where people will see them, as via popups in Atom or messages to stdout? For shame.

This is not Feross' first attempt to fund his open work. Past approaches haven't failed because Feross wasn't churning out valuable software. He's been doing that the whole time.

The "well conceived" approaches that cost consuming developers literally nothing---no money, no time, no attention---don't repeatably solve funding problems for producing developers.


> The standard experience of maintainers trying to support their work is that everyone else makes a public point of standing in support of maintainer funding as a general matter, but strongly opposes whatever specific approach the maintainer actually happens to be trying.

If you're suggesting that I'm guilty of that behavior, I should mention that I've never opposed developer using ads on their software's website, or on the software's README. In fact, I've done so myself.

I've also been a big supporter of GoFundMe, Patreon,-and like websites for open source developers.

Believe me, if there were a better way for open source software to be funded, I'd probably spend more time on my open source projects. But not by spamming ads on stdout.


jnbiche, I didn't mean to say anything about you specifically!

If you're experimenting with funding models, I support your experiments, too. But without looking into specifics, I'm guessing you had the usual experience with README and website ads, sponsorship badges, or the like. I hope it was able to cement some new relationships, and perhaps make you more aware of who's relying on your work. But I wouldn't bet it made you significant money, or significantly changed how much you could or did contribute.

As for stdout versus README and so on, the lines aren't sharp, but I think there's a basic distinction to draw between an advertisement and something more like a credit or acknowledgment. As long as those who go looking for their credit can find it and point it out to others, all seems to be right. Sponsorship in a README fits there, in my view. Ads go where people will notice them, even when they don't go looking. They're frequently invasive. I don't like invasive, but that's where `funding` seems to fit.

There are middle grounds, too. Actors often negotiate for fair billing in relation to other players, for instance. And donors to cultural centers and other physical venues often get their names on plaques or stonework in the foyer. In my mind, all of that just points out how many conventions and expectations we've developed about funding in nearly every field but software.

In my comment above, I was reacting to your mention that Feross' approach seemed ill-conceived. I thought that was one-sided: It's not just about whether user-developers like it. It's also about whether it effectively gets devs paid. It's not well conceived if it doesn't work.


Fair enough. I apologize for getting overly defensive.

That said, I do not think that this approach by Feross will work at all. Advertisers hate controversy, and given the fairly negative reception this approach has garnered, most of his sponsors (if they're aware) have now likely pulled their support or at least requested that he not put their ads on the terminal.


jnbiche, nothing to apologize for!

I've shared your concerns about the ad-based approach from the get-go. I sincerely hope ads of the kind don't become the norm for open developer funding. We know their cost from funding other kinds of open work so well.

I'm interested in this mostly because I see distaste for ads trampling respect for maintainer autonomy, and that is wrong. I've endured the cycle of harassment that follows any credible attempt to fund development work in a new way, seen friends go through it, and saw Feross going into it. It's psychologically impossible for us to experiment our way to approaches that work with peer support.


> I've endured the cycle of harassment that follows any credible attempt to fund development work in a new way, seen friends go through it, and saw Feross going into it. It's psychologically impossible for us to experiment our way to approaches that work with peer support.

I'm sorry to hear you (or any open source dev) has experienced harassment because of funding attempts. I disagree with Feross, but I condemn any organized harassment.

I would add that it's fairly predicable that any funding that hinges on innovative uses of ad technology are going to run up against heavy resistance in our communities. There's just not a lot of patience for advertising among techies.

But outside of advertising, I hope developers do experiment with new funding approaches. It's greatly needed.


I don't use standard, but FWIW I like this approach. npm install can output thousands of ads for all I care if it means software I depend on is better maintained. At that point I'd probably never see most of the ads, but, eh, I do know what LogRocket is now, so this ad at least did its job.

Edit: There are some good arguments here. I'm on the fence. In most cases I don't look at npm output, in which case the ads would be useless, and when I do need to actually look at npm output they'd be in the way. I can also get behind considering the terminal an "ad-free zone".


I think the shame is he has written some software I find valuable, and some tens of thousands others, but we refuse to value the author's ongoing commitment too.

Software that doesn't require a major ongoing effort can still be in dire need of support, like OpenSSL.

https://en.wikipedia.org/wiki/OpenSSL#Heartbleed

OpenSSL falling over was a wakeup call that we continue to ignore even as NPM, Ruby and other packages are converted to malware because there's nothing in it for the original developer except more work.


NPM and RubyGems are going to be steamrollered in short order by Github repos, so there is an opportunity to start afresh.


What do you mean? Is there some announcement/feature I was unaware of?


goatinaboat was probably talking about this: https://github.com/features/package-registry


Having read through a lot of the threads that this initiative by Feross has touched off, I've somewhat revised by opinion: I still think the terminal ads are a very bad move, but I appreciate the fact that we're all talking about this now. I'm not entitled to compensation for any open source work, but it would be nice if I could receive some compensation in order to do more maintenance/improvements and/or revive abandoned projects.

So it's good we're talking about this.


> Five days to do what? Five full 8 hour days? Does it take 5 days to cut a GitHub release and push it to NPM?

I'm not OP, but I gotta say whenever I've faced questions like these in my career, I find I'm not actually being asked any questions at all, I'm being accused of lying, and it's time to walk.


One angle to look at this: consider opportunity cost. The developer could spend X number of hours working for someone else making $Y. The value of their time to make the change might cost that much.

If OSS maintainers struggle to monetize their work, they should switch to coding for businesses if the primary objective is to code for money. If nobody wants to pay you to maintain a project, then you shouldn't maintain it (unless doing it for free makes you happy). Otherwise -- if anybody else wants work done on the project, but doesn't want to pay, they'll submit PRs themself, or assume the role of being the maintainer themself.


Keep in mind that the JS ecosystem on the whole is a garbage fire, and anything even vaguely configuration-related is likely to catch fire and explode the moment a dependency or a dependency's dependency or a dependency's dependency's dependency changes something.

For example, it recently took me most of a day just to get ESLint, Jest, and Babel working for a monorepo based off the same Babel config,


Whether this particular project deserves funding or not, I think the problem is a real one and the solution is valid. It's unfortunate that we live in a society where common goods require private funding to survive, but given that we do, (non-tracking) advertisement is, I think, a necessary evil that we need to be tolerant of.


It’s sad that this arrogant criticism of the work involved in maintaining a popular OSS package is the top comment.


[flagged]


You've provided no additional insight and answered none of the questions you quoted. Your reply is at best dismissive of the questions raised by the poster you replied to. You've complained elsewhere about the replies in this post, but yours here sets no example.


Yep, tiny packages are awfully common. The most notorious of them being `left-pad`.


While I think its great that open source projects get funded, it would eventually turn into a game of who can make as many people as possible dependent on your code using clever marketing. Dependencies are not chosen by technical merits, they are chosen by popularity.


It's interesting to think about the different motivations people have for contributing to open source. You've got ideologues like Stallman who believe that source code ought to be free and are working to achieve that belief by writing software and giving away its source code.

You've got people (and companies) who are essentially making a deal with the community: "I wrote this because it was useful to me. Maybe it'll be useful to you too. If I share the code with you and you contribute a change back, we'll both benefit."

You've got the ones who do it for marketing reasons. Either companies trying to sell "Enterprise Edition" or support/hosting services, or developers trying to build their personal brand to get hired.

You've got products that begrudgingly throw tarballs over the wall to satisfy licensing obligations, like the Nintendo Switch web browser and most of opensource.apple.com.

...And then there's this guy, who is seeking rent on a linter configuration file.


To put this as civily as I can, if you don't find any value in this tool, then don't use it. If you think it's trivial enough to not deserve funding, don't fund it.

If you really think it's just a config file and nothing more, then just ignore it and move on. It doesn't hurt you with it's existence.

There are no network effects here, this is about as far from a zero sum game as you can get.

Some of us do get value out of this "config file", quite a lot. This project handles edge cases, enforces backwards compatable changes and improvements, fixes bugs and config issues, and works on documentation to help it work with other tools and systems.

That has value, and it makes my blood boil that many people are completely disregarding the work that goes into making this project run smoothly for as many people as possible in an area that is saturated with an insane number of choices and a cost to switching which is about as close to zero as possible.

Please just go look at the repo, look at the changelog, look at the insane number of downloads, issues, PRs, look at the care taken with breaking changes, and look at how much time and effort it looks like feross puts into this.

Please look at it, because I can't possibly imagine someone seeing all the effort, time, and care that goes into this project and concluding that it's just rent seeking...


I am with you on this one. I am shocked at the outburst of negative attention this is getting.

I am sadden that so many people are judging this library on metrics like LOC instead of evaluating it based on the value it provides to the users.

It's also clear to me that the author considers this an experiment. At this point you can say it's a failed experiment, but the guy is getting way too much hate for simply trying...

I also don't understand the complete revulsion to ads. I hate ads too, but geez, people act like ads killed their grandmother or something.

I am just blown away at how this is being received. And I say this as someone who does not use this library. But I've used plenty of small, low effort, libraries that are derivatives of larger projects and I appreciate any effort put in by people to make my life easier.


> If you really think it's just a config file and nothing more, then just ignore it and move on. It doesn't hurt you with it's existence.

I think you're missunderstanding the reasoning behind the backlash. People are understandably angry at this, because they are afraid of this becoming the norm. Unlike places like the browser, the terminal is a tool that is used strictly for work reasons for most people. Not only that, but for CI logs, it's essential for day to day work.

It only takes one brave soul to try something, see if people put up with it, to become the norm.

Also, I'm really not sure of why you are calling it "config file" in quotations if we're downplaying his work, because that's literally all it really is. A thin wrapper around ESLint doesn't really count for much. And as FED, I'm not really necessary what all this "cost of running" you speak about is.

I'm sure Feross has put a lot of time and effort into his config file, but what about the developers behind ESLint? The actual tool Standard.js runs on? How much % of the funding earnings by Standard is passed to the ESLint team?

Plus, it's not like the community doesn't exactly have a bone to pick with an already controversial library already well known for deceiving beginners. Even people like Dan Abramov (Redux's creator) called out it's unfair to call this library "Standard" when it enforces coding practices well known to have many gotchas for beginners and that are far from the norm. But of course, the creator couldn't care less about this, as he is well aware that calling it "Standard" brings lots of traffic to his library.


> [...] many people are completely disregarding the work that goes into making this project run smoothly for as many people as possible in an area that is saturated with an insane number of choices and a cost to switching which is about as close to zero as possible.

It seems like you're simultaneously arguing that this project is important and valuable and a lot of work, but also there are a million other options for what it does and it's trivial to create new ones.

And even if I don't personally use this linter configuration file, it can hurt me in two ways:

1. If it's a transitive dependency of some other project I use

2. By normalizing rent-seeking behaviors like putting advertisements in a package's installation output


I'm not saying it's trivial, but that it's one of many options.

I can't make a TV myself, and I find the ability to make a TV valuable enough that I'm willing to pay good money for one, but there are literally thousands of options to choose from if I went to buy a TV.

As for the other parts, this is a linter, it offers no value as a transitive dependency and it's existence in one is a mistake in the vast majority of cases.

And I don't actually like how they are funding this. I don't like the idea of polluting the CLI output with this stuff, especially at install time. But the idea that the package is somehow undeserving of funding because it's trivial or because you personally don't see the value in it is infuriating to me.


> this is a linter

ESLint is a linter. This is a configuration file for ESLint.


>There are no network effects here, this is about as far from a zero sum game as you can get.

Does the message not display if I pull in a dependency that depends on this? It's only an issues if I'm directly and willingly using it?


That is correct. StandardJS should be installed as a devDependency and therefore downstream users will never see a sponsor message. Just direct users.


Elsewhere on Github, you tell people who want to integrate your ads specifically to include it as a regular and not a devDependency in order to cause the ad to be shown to users who transitively depend on it.

https://github.com/ssbc/ssb-server/pull/685

"@mixmix, thanks for the support! It means a lot to me and I hope that having others join in will help shift the discussion on this topic, even if (like you said) we don't like sponsor messages as the ultimate funding model here.

Btw, I think you'll want to make this a dependency if you intend for end users to see the sponsor message. Otherwise, it will only be run for folks who are developing on ssb-server."


Rent seeking is commonly defined as seeking to extract economic gain without contributing back a benefit. Whether you like the project/funding approach or not, it doesn't seem to fit the accusation of "rent seeking".


the maintainer uses rent seeking as intention himself. [0]

[0] https://github.com/feross/funding/issues/7#issuecomment-5245...


The maintainer says they have to pay for rent. Whether advertising in your open source project is good or not, wanting money to pay your landlord for rent isn't rent-seeking just because you saw the word rent in it. I'm assuming you hadn't heard of the term rent-seeking before and just read the two words and decided it must mean "looking for money to pay your rent".

Rent-seeking is a term with a specific definition [0] and "I need to pay my rent" isn't it. In simple terms, rent-seeking refers to the behavior of the landlord, not the behavior of a tenant. It may even be a term that applies to this situation, but the dev saying they need to pay their rent is entirely unrelated.

[0] https://en.wikipedia.org/wiki/Rent-seeking


Note that even the landlord is not "rent seeking" in the economics sense, even though they do literally "seek rent" as an essential element of their job.

A landlord is seeking compensation for a mutually beneficial transaction ("you get shelter; I get money") and is providing value to the tenant.

If I block off a river and charge you a toll to pass, I'm rent seeking. If I dig the Panama Canal and charge you a toll to pass, I'm not rent seeking.


Thanks for the link, I was indeed unaware of the term.

By looking through the ongoing discussion, it was interesting to find a reference to the core-js issue [0] from earlier this year. Its maintainer, with his established position in the npm community, makes use of a similar post-install script to open up a discussion and communicate his situation. This gives him a more direct communication channel to its users without directly helping his situation.

What I assume can be understood as a rent-seeking practice, is how fooreys intention, with the same political power in maintaining a popular package, seems not to be solely to raise awareness to his situation. But instead he's forced a solution to his problem by advertising unrelated 3rd party products. Whereas he interestingly also uses the term experiment, it did already render npm as a space for advertisement.

[0] https://github.com/zloirock/core-js/issues/548


In the issue the author uses the words "I" "me" and "we" 13 times, but refers to himself in the third person exactly once in this sentence:

"The funds raised so far ($2,000) have paid for Feross's time to release Standard 14 which has taken around five days."

Without the third person stuff that's

"The funds raised so far ($2,000) have paid for my time to release Standard 14 which has taken around five days."

I use dozens of development tools every day. Counting something as small as a transitive dependency on a configuration for another tool wrapped up as a package, it's probably hundreds, perhaps thousands.

I would feel embarrassed to take $2000 for a single update to put third party advertising banners in to the channels those tools use to report their operational and diagnostic status.


How much of that money will ESLint developers get, seeing as how heavily standard relies on it? Any guesses?


That question seriously resonated with me when I saw it raised in the GitHub thread. (https://github.com/standard/standard/issues/1381#issuecommen...)

Any package which transitively includes `standard/standard` also inherits the advertisement. That would seem to suggest a kind of logic like "if people are going to use my work to help make their thing successful, it's only fair that I'm rewarded too." And that really does make sense. I could totally nerd out over the idea of a graph-based incentive structure, maybe implemented with a new crypto token for extra gee-whiz spiciness. If his prototype `feross/funding` package had been launched with a built-in technical mechanism for transitive profit-sharing I think the idea might just have been intriguing enough to distract from some of the appalling terribleness of embedding ads in package post-install messages.


> Any package which transitively includes `standard/standard` also inherits the advertisement.

Fortunately there should not be too many of those. If you're using `standard/standard` to format your code, it should be in your devDependencies, so if your project relies on it, and I rely on your project, I will never see this ad.

If this model were to take off, and, say, `lodash` included an ad, that would be a different story. You'd probably see the same ad a few times over in your `npm install` because you probably have more than one version of lodash in your dependency tree.

But, I can tell you right now, if you put an ad in your package, I'm going to work pretty hard to remove your package from my dependency tree, and hopefully there are enough people like me to stop this from taking off. :P


The whole thing just reeks of a false sense of entitlement. It’s open-source, don’t go into it expecting remuneration. If you’re not comfortable with that, perhaps you should explore a different model for releasing your code.


Who are you to tell people they shouldn't open source their projects? Open source means exactly that, you can get the source. It doesn't say anything about how it's funded.

Just because you don't understand money or the guy above would be "embarrassed to charge $2000 for an update" doesn't mean other people should stay poor to make you feel better.


> I maintain 100+ open source projects which are downloaded 100+ million times per month. 🧙 ️

https://github.com/feross

I would encourage you to check for a healthy amount of community contribution being accepted before adopting an OSS project.


About half the README content: https://github.com/feross/funding#who-is-feross

And, if you grep the dependency tree of standard/standard it's pulling in at least 10 modules from the same author

And, there's plenty of ways to juice the download count... My most successful project in this regard is a private Docker image which got pulled like a million times by AWS ECS retry loop when I accidentally pushed an image that crashed+exited immediately

Which is to say, you and I would do well to emulate this Successful Winner who is also a Community Leader


Essentially, we have a public good which is consumed by huge numbers of users, but which almost no one pays for. Fortunately, there exists a funding model that usually works for public goods like this – ads.

I like how advertisements, which are inherently unethical, are now being billed as ethical because they lack the awful things piled on top of an already awful thing. I anticipate this going about as bad as it possibly can, and I'm going to find it amusing if and when it does.

It's always these JavaScript projects I see doing this stupid shit. It's amusing to see these people, many of whom participate in shoving advertisements on others, not care for the same treatment.

I write Free Software libraries and the only thing I'm currently asking for is that people share the work they base on my own, which is why it's under the GNU Affero General Public License version three.

These JavaScript projects use a great deal of Free Software, but they act as if they're important or significant enough to warrant such things. I use GNU Emacs, GCC, various other compilers, various servers, and many other things, but these code artisans put advertisements in their drivel because they don't think they're making enough money from it, and this is an attitude many of these JavaScript people share. I intend to try to make money off my future projects by either selling documentation or being paid for writing the project to start with.

I could go on a much longer rant, but why bother?


I appreciate the struggle Feross has trying to get paid for his work. simple-peer and webtorrent are both pretty nice libraries and it is a real contribution to the world that he wrote them.

But, I don’t think this is going to work. npm install ads are like popup ads; they appear when you don’t want to see them and annoy your customers. Like popups, I think they will prove to be ineffective. Does Linode even want this ad? I think respectable companies would rather not annoy their customers like this.

I also think npm will ban this practice if it becomes widespread enough for them to bother - by my reading of npm’s rules they ban it already because they ban “adware”. If console.log becomes full of ads and useless during an npm install, it is pretty simple to disallow packages from displaying messages at install time. (Many or most package managers for other languages already do this.)

While it is possible to get paid for open source work, I think this project is just not quite valuable enough to get paid for maintaining it. If you maintain something like Vue it’s a different story.


Fun fact: adware is one of the listed types of content that is considered unacceptable by npm's Terms of Service.

https://www.npmjs.com/policies/open-source-terms#acceptable-...


Actual language:

  Content containing malicious computer code,
  such as computer viruses, computer worms,
  rootkits, back doors, adware, or spyware.
  This includes content submitted for
  research purposes unless agreed to in
  advance by npm. Tools designed and documented
  explicitly to assist in security research are
  acceptable, but proof-of-concept exploits are
  not.
I'm not sure this form of advertising qualifies as the kind of adware which is associated with rootkits and spyware.


Definition of adware: "software that automatically displays or downloads advertising material (often unwanted) when a user is online."

Sounds like adware to me. The messages are certainly unwanted. The messages are automatically displayed be default. It meets all the criteria.


It doesn't say that it has to be adware that is associated with rootkits and spyware. I can say that I have contacted abuse@npmjs.com to get a confirmation on whether or not this package is within their guidelines. Because it's highly possible that it's any kind of adware and they don't want to turn NPM into an ad delivery network, since today it might be Linode, but tomorrow it might be something really shady.


But surely this software must be considered adware? And the language specifically notes that they consider adware malicious not that adware is only bad if also containing rookeries or spyware.


"This command barely outputs any text; if we display a sponsorship message here it'll get noticed - great idea! Can't believe no one thought of this before."

"The city park has tons of grass, but no one is having their cattle eat it. Missed opportunity! I'm bringing my herd over to get some sweet public grazing in."


There's a response from Linode copied to the issue now saying "This ad was not paid for or solicited by Linode"

https://github.com/standard/standard/issues/1381#issuecommen...

> I just recieved this response.

> Hello,

> We definitely understand your objection to an advertisement of this nature. This ad was not paid for or solicited by Linode. There is an open issue/thread regarding this advertisement on the package's Github repository.

> We appreciate you voicing your concerns about this ad, and I've passed along your feedback to our team who will be investigating this matter. If you have any other questions or concerns please let us know.

> Best Regards,

> ### #.

> Linode Senior Support


And now it looks like both Linode and Logrocket objected strongly enough to whatever this was that they're both removed

https://github.com/feross/funding/commit/03937d3f1178a7908d7...

https://github.com/feross/funding/commit/427bb8ffb6a1b683928...

As of now, the project has no supporters

https://github.com/feross/funding/blob/master/messages.json


Linode paid for the ad. I have the email thread, an invoice, and $1,000 sitting in my bank account to prove it. I expect this email was written by a support agent who wasn't aware of all the details of the situation.


Or, more probably: Linode paid for the ad, saw the backlash, and said please remove the ad and keep the money.

In which case you're not making them any happier by disclosing this.

But I guess we'll see whether the ad comes back when the higher-ups have realized the mistake the supporter made, right?


I'm not denying that they asked for their ad to be removed. I'm just refuting the claim that they never agreed to it in the first place.


Why are you still running the "experiment" if the response has caused you to shut down the ability for anyone to post new issues either to your "funding" project or to "standard"? Why run an experiment then shut down all the feedback channels?


off-topic:

Does anyone else hate the naming of this package, which is essentially a coding style? It's made to sound authoritative, like it's drafted by a standards committee and ratified by a large proportion of the programming population, but nope. It's yet another opinionated eslint config with some controversial parts (eg. no semicolons). Call it Feross' standard or something, don't try to make it sound like it's the standard style.


The author seems keen on things that only work if he's the only person doing them.


"Standard" was a joke.

The better you know Feross, the funnier it is.


What a tragedy that the package has far more users than it's possible for a human to know well!


Friends, you cannot have your cake and eat it too. The amount of people second guessing whether a "configuration file" is worth $2,000 is exactly why even the most popular open source packages rely on corporate buy in to justify development time.

Where do we set the fence posts? "It's just a CSS file" for Bootstrap? "It's just a packaging system" for Webpack?

Who cares? If it saves you hundreds of hours of development time, then it's a net benefit for you, and you should pay it back. The fact that nobody has asked you to do so until now does not mean you weren't supposed to do it before. You should, but you didn't, so now OSS maintainers have to put ads in your donation's place.

If you do already donate to open source - great! Set the OPEN_SOURCE_CONTRIBUTOR flag to true and be on with your day.

If we ignore `standard` and the controversy behind its "simplicity" - would you be mad if Vue came out with this model? Bootstrap? What about Webpack or ESLint itself?

Would you trade ads in the CLI in exchange for no corporate chokehold on your favorite packages? How about funding many thousands of solo developers who don't have corporate backing but can theoretically justify working on their useful packages if they were able to afford monthly expenses from it?


Perhaps people should stop making open source b2b tools, and focus on things that they actually want to make for their own use.


I like the idea of funding an open source project so it's maintained. However, I don't like the choice that feross made here, which is ads. It's very intrusive to get shown ads while I'm working and focusing on a task, even if it's just installing a package. Output and errors are already hard to read in the terminal, and having ads contribute to it makes it even harder.

I believe the correct way to solve the problem of open source funding is through sponsors and their names shown through the README or through a patreon or similar platform.


from what I hear, it's not simple to get a sponsor or enough money from patreons, even for somewhat popular projects. Open source funding is still an unsolved problem, even if a ton of people have tried.

I don't particularly like the idea of ads in terminal either, but people can decide not to use this, I suppose.


Last I attempted a systematic survey of open source developers on Patreon, I could only find seven or so reported to be making >$1k USD per month.

Of those, many of the most successful weren't simply taking donations. It's common to see substantial additional products of services as perks, like access to security alerts, work prioritization, personal time, and so on.


I made an ad blocker for this: https://github.com/kethinov/no-cli-ads


`funding` added support for suppressing the message if the env var `OPEN_SOURCE_CONTRIBUTOR` is set - these should help quiet down a variety of postinstall ads in CI envs and the like (the last two are used by core-js and opencollective-postinstall)

    export OPEN_SOURCE_CONTRIBUTOR=true
    export ADBLOCK=true
    export DISABLE_OPENCOLLECTIVE=true


Sad that we need these in our CLI now too :(


This is pretty scummy. If it becomes acceptable to display ads in the terminal, through popularization by usage in heavily relied upon packages like Standard, I imagine this will balloon fairly quickly into a common practice.

Thankfully this is all open source and standard doesn’t add much on top of eslint outside of rapid setup and a preset config, so I expect that the community will just make an ad-free version.


I think the trend was started by Babel around a year ago. Thankfully it hasn't picked up.


Of ads in documentation and installation messages, I have the same opinion as ads in websites: performance, resource usage (network, computing, memory) and tracking are what bother me; subtle, non-misleading, generic ads don't.

I'm more concerned about overeager telemetry in software. If these ads don't come with performance/network/privacy baggage, I'm OK with them.

That leaves open the chance of libraries implementing some third party library to display ads, which then starts tracking users, etc. as happened with ads on the web, but that's another debate.

And from looking at donation pages for many well-known projects, outrage outweighs donation volume.


In my own view, as an open source maintainer, aiming to gain revenue from open-source is kind of a fool’s errand, as it’s not really compatible with FOSS. It’s just not.

At the end of the day, the best way for a single developer to extract revenue from a software project is to sell licenses, which is nothing new.

Obviously, it’s just my two cents, but I’ve long realized that I will probably never see a dime from my open source work, and that’s fine by me. That’s not my goal in producing free software, to begin with, and I don’t know of many cases where that’s worked out without starting a complementary company/foundation (RedHat, MongoDB, etc.)


While I agree that ads are not a good way to fund foss development, what I find disgusting is the hate directed towards the maintainer for trying out this experiment and towards the project itself. This sort of hate is what pushes good people away from foss projects and I've seen this play out many times over the years. Please let your disagreement known to the authour with good reasoning, do not hate on his project or make personal attacks on the author.



On one hand it sounds as a totally crappy move, but on the other hand if we don't like it we're free to fork it and try to maintain our own ads free version - which most of us will not do ever, because frankly we're all lazy bastards used to someone else do that shit for us...


To me that's one of the icky aspects of this. He's parked on the very nice `standard/standard` repo, with a project named "JavaScript Standard Style," emblazoned on the iconic JavaScript yellow... If you take the time to read the readme it does say clearly about halfway down that the project isn't really a standard at all, just one guy's idea of a helpful linter configuration. But if you don't scroll down past all the company logos, it would be pretty easy to get the wrong idea.

I'm not saying that a lot of work didn't go into it, or that the repo name alone is a slam dunk for tricking tons of people. It's not like domain squatting - this is a real project. But I do wonder if a fork would be able to compete on equal footing without the advantage of the name. We like to think that the availability of at least the possibility of forking provides a sort of guarantee that projects which make enough bad decisions will always be leapfrogged by competitors and great software will rise to the top. I guess I'm not surprised that it's raising eyebrows that this maintainer at least seems to be deliberately pressing a marketing advantage which is just inaccessible to potential forks.

I'm not sure what to suggest as the solution to the underlying problem of coveted or potentially confusing package names. Namespacing library names under user/project names was supposed to be the solution to this! Just repeating the same word twice is a clever way around it. Maybe npm should step in and eliminate this loophole.


If the ads are a real world problem and there's alternative we would know about it, marketing or not. It's not a shower gel or mascara, it's a lib used by a lot of people to do their work, so people will eventually converge into using the one that does the job best (or the one that pisses them off the least)


I'm not as convinced as you are that people will simply converge to the better alternative. Sheer inertia from npm activity and accumulated GitHub stars can disadvantage new, better options from gaining traction because it's not easy for developers to take a risk on a new project that could be abandoned at any time, and because they have to be pretty comfortable with the technology to confidently decide that the current crowd wisdom is wrong - something that may not be the case if the developer is working outside of their area of expertise. standard/standard is particularly interesting because someone who's not completely in their element could easily see

  "devDependencies": {
    "standard": "*"
  }
in a package.json or

  npm install standard
in a script, either online or in another project at work, and copy it into a new project along with the rest of the boilerplate common packages they need, not realizing what they've signed up for. This would create the appearance of continuing growth and support for the package even though these users are totally oblivious. It's not clear to me that, with that kind of tailwind, an objectively inferior package couldn't continue to be ubiquitous and never be "converged" out of relevance.

Still, I have to agree that the view you describe is a plausible one. If Feross does indeed think that way - which I have no reason to doubt - then that means that he's acting at least in better faith than some are giving him credit for.


I noticed this the other day. I think, at least to me it's pretty simple; open source should be funded but the terminal is not the place to display ads.


Regardless of Feross’ choice, it’s hard to believe how bullish are many of the commenters there. It’s saddening. Manners are dead and people feel entitled.


from memory GNU parallel has been advertising on the command line for ages, specifically:

" This helps funding further development; AND IT WON'T COST YOU A CENT. If you pay 10000 EUR you should feel free to use GNU Parallel without citing."

Or words to that effect.

I haven't really been bothered about that, but I could see myself joining a riot if everyone decided that was a good idea. This guy is just bringing that closer.


If it is as easy to silence as GNU Parallel and tells you how to do it (like GNU Parallel also does), I do not see a problem.


The GitHub issue is now limited to contributors only, and perhaps rightly so as they tend to turn into total shitshows, won by the "clever" one-liner and emoji counts. This was a good reminder to send Feross $50 as a token of my appreciation for his work. Which I just did!

But please, please, Feross: NPM package installs are noisy enough as it is as every package seems to think it has VERY IMPORTANT things to say which are actually noise I could live without. Please do not add to the number of steamers that are being shat onto my terminal any time I do npm install/yarn. :( I understand that you should be rewarded for your work, but this isn't at all the way to go. And given that even on one of my own tiny personal projects, when you factor in the dependencies, there are like five hundred packages this just will not scale :/


I think the biggest issue for me, if I saw this, is that it isn't entirely clear where it is coming from... A final line with maybe a different bgcolor (dark gray or black, with light gray test) "[Ad] Thank you (sponser) for supporting standard development." Or similar.


I try to adapt to the style of the code I'm contributing to. While I do have arbitrary style preferences of my own, I think its mostly a waste of time to argue about and formatting your code like changing " to ' and vice versa. So I both hate and love these tools.


I seriously don't want this to, well, become the standard. Shoving ads/sponsorships on my face will not make me more enthusiastic about the product that the advertiser is selling, but rather will make me more reluctant to install standard.


When developing for Windows we paid for windows, windows server, msaccess, mssql, and when we needed a third party component/module we paid for that too, even when all it did was to put an email in the pickup folder. Developing for Linux and with the Node.JS ecosystem is quite a different experience.


That's a lot of downvotes :X

Agreed with the other comments that npm install will become a CLI version of annoying popups and banners that are EVERYWHERE on sites now.

Plus - who controls it? The core package author? Can the dependencies log their own messages to?


Another idea is a business model where you pay depending on your company's earning, like with taxes.


strange to see so many people say that this doesn't look like a lot of work, that it's just a linter...

Feross created webtorrent so maybe let's show some respect for the skills and commitment


[flagged]


Or suggest some public service ads -- Nobody reasonable can disagree with such messages as "cars and alcohol don't mix", "always use a thermometer when grilling", "feeling depressed? call this suicide hotline", "narcan reverses heroin overdose" etc.


I appreciate the sentiment but I think this just legitimizes the idea, unfortunately.


I don't use the library, never will, but I think people can and should get to do what they want to do with their code. Due to that I am not surprised someone decided to monetize their project, it's entitled to think that not paying for something gets you a say in how it's ran. There are multiple solutions, not using the project is one, supporting the project before ads happen is another.


> not using the project is one

If it's open-source, fork it and remove the adds is a great one too. Call the project "higher-standard."


rare instance of someone taking the lower ground and higher ground at the same time lol, bravo


As I recall, Feross' standard was the first of the JavaScript style linters for Node.js via npm to propose an immutable code style without configuration options. It became the de facto standard among many early Node.js developers, and saved tons of bikeshedding time and balkanization at a really critical, early point in JavaScript's rise.

I changed my personal coding style to adopt standard. At the time, everyone I was talking and collaborating with thought the name was hilarious.

Most of us either knew Feross personally, or knew him through open source collaboration. "Entitled" doesn't fit him. Especially compared to some of the folks posting issues on many of his popular packages.


I guess we all know to avoid Linode and LogRocket now


Linode is now saying they had nothing to do with it, which makes this seem even fishier


Linode paid for this ad. I have the email thread, an invoice, and $1,000 sitting in my bank account to prove it. I expect this email was written by a support agent who wasn't aware of all the details of the situation.


The balls on this guy!


I love this. While there is model for funding web and mobile apps there is nothing comparable for software libraries. I like the spirit of experimentation of this project.

People who disagree with this should propose alternatives that address their issues rather than shooting this down.


What’s the deal with these people acting like their terminals are some sacred advertising-free spaces?


I would rather not have to have my terminal go down the route that the web did. Next thing you know, we'll be installing TTY adblockers to block fingerprinting using the terminal window size…


TBH, any advertising free spaces left in the world probably ought to be considered sacred, as they are getting fewer and fewer every day.


They may not be intrinsically more sacred than anything else, but ads in general are still something to avoid. The difference in reaction when adding a new ad to the web vs the CLI is analogous to dumping trash in an abandoned building vs in the middle of the forest. They're both bad, but the CLI/forest feels worse because it's mostly untouched, whereas the web is already thoroughly infested with ads.


Your comment got me thinking: If anything, most terminals have functioned as dilute advertisements for the Free Software Foundation for decades now. Especially via license-mandated attribution notices.


Not sure where to begin. I'd love to see RMS weigh in on this.

1.) Ads. If you choose to fund/compensate via selling ad space you are lazy (or lack the talent/skills to innovate); period. Can you generate income/revenue, sure. Selling ad space as a primary means of revenue is where innovation and alternative options go to die; you believe you are out of options (unless a rev kicker).

2.) If you are having second thoughts about the time and/or contributions you (maintainer(s)) have been making to a F/OSS project then do exactly that...rethink what YOU (as a maintainer/project founder) want and do not want. If you need to step away..do it; I do not blame you. If you want to go "for profit"...go for it and good luck.

3.) There is no shortage of historic precedence for projects that decided, after some time, to adopt/create a business/profit model. If the project was important enough, to the community, it forked and others took it the rest of the way.

4.) Now, do I believe PEOPLE should be compensated, to a degree, for time they have donated to F/OSS; sure. People NOT project(s). The demarcation point should be very clear here. Do not drag the project/software into what is a people problem.

Incentivize project consumers to "invest" in a contributor/maintainer/founder and they should be held to a contribution count and or release/feature schedule; these are not high fives and gifts, although I am happy to give high fives. If you want to be compensated you have to be held to some deliverable; we are not "bros".

I love F/OSS and incredibly appreciate the efforts of the community. I do think it is unfortunate that contributors time is not "more valuable" (yet) in this world and am happy to support within a supplied innovative solution. I would continue to, and do currently, contribute to a number of F/OSS contributors via patreon. These maintainers are producing great libs and are VERY responsive to questions/issues/feature requests and release schedules.


How many of the developers you support on Patreon take in meaningful money, overall?


Is their contribution to an F/OSS project a "job" or guarantee of income? If you do not want to "donate" your time anymore...stop; this isn't a difficult concept. I contribute $500/year to 4 projects that are integral to implementations I support. And I am not attempting to sound like a hero or what I contribute is important...but I can assure you its MUCH more than most.


Last time I looked into it, I could count all the open software developers making more than $1k per person per month on donation platforms like Patreon, Liberapay, and Open Collective on less than two hands. Most of those weren't actually just taking donations, but using the perks system as a store for add-on products and services like ads, access to security alerts, and work prioritization.

I don't know you and I don't have anything to say about you. My point is on the funding mechanism. The evidence I've seen shows that donation-based funding a la Patreon produces a few highly funded, highly visible outliers, many of which would be far better off doing large-dollar deals with their larger supporters off the platform. So far, I don't think the evidence supports recommending the donation-platform approach as a general solution to enabling more valuable contribution from developers, even those with substantial online reputations. Supporter counts and supporter amounts don't bear donations alone out as a meaningful support for individuals.


I think you are making my point and we would support the same things. I never said I have the solution but I did say selling ad space is not it. And I am sorry that patreon works for some and not others and that the “curve” is not fair. My only point was that contributors should not make their issues the communities or the projects; it’s developer specific not project unless all agree to make it project based; then go for profit. All things are not equal and each project has its own lifecycle/ecosystem. We are both in agreement that we would like a method of rewarding efforts of contributors.


I don't know what you'd support, only what you oppose.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: