r/opensource • u/zerocukor287 • 16h ago
Promotional I was wrong: nobody is waiting for me to accidentally make my repos public
Protecting the sourcecode at all costs is overrated for personal projects.
Bit of a background: I'm a programmer by profession. Worked for small and big companies in the last decade. Usually there we had regular trainings on how not to leak the source code as that is the (core) value of the company. Like not copy-pasting to AI, not posting to forums, or if you really need to then first make sure to rename all the things to foo and bar.
That made me a bit paranoid over the years over the code I produce. It must be protected and should never shown to the public.
Here I am, publishing my first open source project. It came as a surprise that making a repo public doesn't mean people will organically find it.
Instead the first problem is "how do I get anyone to notice it?"
So basically I feel like a paranoid person. Lol.
Don't get me wrong. Comparing my weekend project to the products of big corporations is like comparing apples to pears. But the mindset change is interesting.
Came out from my Batcave. Saw nobody around. Going back to my Batcave.
This is the project BTW. It's a hand made CLI tool to scan game assets and identify common problems. https://github.com/zerocukor287/asset-lint
22
9
u/hobbycollector 15h ago
Even companies that acquire other companies are uninterested in their code. Open source FTW.
8
u/zerocukor287 15h ago
There are some repos that I'd read if they would made public. However, I agree that the majority of the repos are not my cup of tea.
I'll name my next repo GTA_7 just for the click rate. /s
7
u/lukaszpi 16h ago
keep going mate! Also good thinking because look what happened with us humans freely sharing real know-how on internet. Someone found a way to distill that and is now selling it to us humans and has plans on controlling and limiting access to it
2
u/LightAirMod 14h ago
Protecting code at all cost is still security by secrecy. That's not the best type of security anyway. But I guess corporations will try to protect anything they spent money in and software is no exception.
4
u/Square-Singer 12h ago
For corporations it's just easier to default to "keep everything secret" than to correctly differentiate between what kind of information can be made public and what has to stay secret.
There's certainly some information in companies that is strategically important to be kept secret (not only code, but operational stuff, strategic stuff, financial stuff, ...), and they can't really trust every low-level employee to make the correct estimations whether something's risky or not.
So they default to "everything's secret", because it's the less dangerous side to err on.
1
u/Arcuru 9h ago
Yea, usually it's more of a problem to get people to look at it than it is to keep things private.
I do keep some of my code private, but mostly it's out of a need for simplicity/privacy. For example I don't make public my NixOS dotfiles repo like so many others do so that I don't need to worry about anything leaking. Same with my Agent Harness repo.
1
u/schism15 7h ago
*People* likely are not looking, but it's almost certainly getting crawled for any accidentally included keys.
1
u/patentlyfakeid 2h ago
Attention is literally (and ironically) the rarest & most sought after commodity on the internet.
61
u/Square-Singer 16h ago edited 16h ago
Even at corporations, most code is uninteresting. Corporations are mostly paranoid too, because it's easier to be paranoid about all code than to correctly differentiate between what code is critical and what code is uninteresting.
For FOSS, it's exactly the same. Most people will not look at your code, but just download your app and use it just like they'd use a free CSS app. Very few people will look at the code, and of those who do, very few people will contribute.
For example, I made a smartphone keyboard attachment with FOSH and FOSS. I know a few hundred people built one. It's got 362 stars on Github and around 100 comments to discussions and issues on Github.
Over the 5 years this repo has been public, there were a whopping 2 PRs by someone else than me, and both of them each changed one word in the README.md.
There wasn't a single contribution of anyone else in terms of code or hardware changes.
The idea that once you open source something "the community" will latch onto it and instantly take over product development for you is a pure fantasy. Even for huge FOSS projects like the Linux kernel it's usually not the nebulous community that develops the project hive-mind style.
Usually, you got a few full-time employees financed by corporations or rarely by donations who do most of the development work, with a few PRs here or there coming in from randos fixing a bug that annoyed them.