The thing with old, critical software is that after some time people don’t really want to dig through decades of C code and prefer to write something new using modern tools. Those projects get plenty of support because people actually do want to work on them. If no one wants to work on rsync than what the maintainer is doing now is just prolong it’s agony a couple of years. I would say he should do the minimum work, announce end of life date and move on. People that need tools like rsync will develop something.
Also, having critical software depend on one guy is not safe. We should avoid that. If critical software depends on one guy it should be phased out.
Also, having critical software depend on one guy is not safe. We should avoid that. If critical software depends on one guy it should be phased out.
I’m sorry to say 90% of the internet’s load bearing infrastructure is in this situation. It’s just how the story goes, everybody wants to build low-stakes toy projects, nobody wants to do high-effort low-reward infrastructure work.
“Writing something new using modern tools” is all fun and sparkles, but then you run into the same issues as rsync except without the experience. Then you get attention from attackers, you get security issues, which you have to patch with defensive code which is not appealing to read and zero fun to write. Before you know it your project is “decades of Rust/Zig/Lisp” which nobody wants to touch and you’re back at square one. All you’ve accomplished is give the attackers a few years of low hanging fruit and easy exploits.
There’s a reason why we get a million shiny toys a year but solutions like rsync stay entrenched for decades.
Also, having critical software depend on one guy is not safe. We should avoid that. If critical software depends on one guy it should be phased out.
Here are the percent of commits from the top committer in each repository you mentioned, as well as rsync, over the last 3 months:
rsync: 99.0%
restic: 93.2%
rclone: 87.5%
union: 82.9%
syncthing: 74.4%
As you can see, each of this projects depends heavily on a single person, though to a lesser degree than rsync. That’s just the nature of most open-source software.
Note that I excluded dependabot commits from the calculations and counted Claude commits as the lead developer for rsync
People that rely on rsync start looking for alternatives
They try to switch and figure out what functionality is missing
They contribute to some of the alternative to fill the gaps
For example, I’m about to setup some syncing for my homelab and I will not use rsync for that. That’s why talking about the state of rsync is important. As I said, it’s not about attacking the dev for not working hard enough. It’s about long term planning.
I remember when the maintainer for discord.py stepped down. He eventually stepped back in because no one wanted took over the project and he didn’t want to see it die. This was before the current AI era, all someone had to do was continue to develop it.
I think almost everyone will do step 2 and 3 but not step 4.
The fact that open source exist and functions so well for decades shows that people do step 4. If no one wants to step in it usually means the project is not important.
I think what you’re missing is that the number of people doing step 4 has been going downhill steadily since the 2000s. People start open source projects yes, which for 99% of them don’t bring in any users and barely get maintained over the long run, but the pool of people willing to contribute to large established projects is so small it is becoming problematic.
Even Wikipedia is having its own editor crisis, where most of the power editors are greying out and barely anyone is stepping up to replace them.
And this is happening exactly because most people, like you, think that the free infrastructure around us is a fait accompli which doesn’t require us to personally get involved in their maintenance, and that we can even afford to scare away those that do contribute.
most people, like you, think that the free infrastructure around us is a fait accompli which doesn’t require us to personally get involved in their maintenance
I do contribute time and donate money to open source project so… miss?
With less contributors simply mean we will have to be smarter about which projects we supports. In open source it’s a natural process. People support projects they actually use and need. If we can’t get enough resources to support even the most basic infrastructure then the experiment will end.
I do contribute time and donate money to open source project so… miss?
You’re missing the point. Sure you do, that’s a nice anecdote, but the data shows most people don’t. You are part of a shrinking cohort that is already insufficient to maintain what we need in the long run.
If we can’t get enough resources to support even the most basic infrastructure then the experiment will end
And then what ? Only large corporations can finance their own in-house tools and they gain even greater advantage against the rest of society ? What a great outcome…
Your point of view is not crazy but i think it suffers from too much optimism in the face of bleak data.
You’re missing the point. Sure you do, that’s a nice anecdote, but the data shows most people don’t. You are part of a shrinking cohort that is already insufficient to maintain what we need in the long run.
But you accused me specifically of not contributing. If you’re making a broader point don’t single me out.
And then what ? Only large corporations can finance their own in-house tools and they gain even greater advantage against the rest of society ? What a great outcome…
Yes, that will be the outcome. And it will suck. I’m not optimistic, I’m realistic. If people wills top caring about open source it will die. Throwing AI at the problem may buy us some time but in the end LLMs also require resources and without support from community all the models will be controlled by corporations.
My sensation is that we’re doing fine for now. The community is still big enough for a decade or two. No idea what will happen after that.
https://github.com/rclone/rclone
https://github.com/restic/restic
https://github.com/bcpierce00/unison
https://syncthing.net/
The thing with old, critical software is that after some time people don’t really want to dig through decades of C code and prefer to write something new using modern tools. Those projects get plenty of support because people actually do want to work on them. If no one wants to work on rsync than what the maintainer is doing now is just prolong it’s agony a couple of years. I would say he should do the minimum work, announce end of life date and move on. People that need tools like rsync will develop something.
Also, having critical software depend on one guy is not safe. We should avoid that. If critical software depends on one guy it should be phased out.
I’m sorry to say 90% of the internet’s load bearing infrastructure is in this situation. It’s just how the story goes, everybody wants to build low-stakes toy projects, nobody wants to do high-effort low-reward infrastructure work.
“Writing something new using modern tools” is all fun and sparkles, but then you run into the same issues as rsync except without the experience. Then you get attention from attackers, you get security issues, which you have to patch with defensive code which is not appealing to read and zero fun to write. Before you know it your project is “decades of Rust/Zig/Lisp” which nobody wants to touch and you’re back at square one. All you’ve accomplished is give the attackers a few years of low hanging fruit and easy exploits.
There’s a reason why we get a million shiny toys a year but solutions like rsync stay entrenched for decades.
Here are the percent of commits from the top committer in each repository you mentioned, as well as rsync, over the last 3 months:
As you can see, each of this projects depends heavily on a single person, though to a lesser degree than rsync. That’s just the nature of most open-source software.
Note that I excluded dependabot commits from the calculations and counted Claude commits as the lead developer for rsync
How I imagine this:
For example, I’m about to setup some syncing for my homelab and I will not use rsync for that. That’s why talking about the state of rsync is important. As I said, it’s not about attacking the dev for not working hard enough. It’s about long term planning.
I remember when the maintainer for discord.py stepped down. He eventually stepped back in because no one wanted took over the project and he didn’t want to see it die. This was before the current AI era, all someone had to do was continue to develop it.
I think almost everyone will do step 2 and 3 but not step 4.
The fact that open source exist and functions so well for decades shows that people do step 4. If no one wants to step in it usually means the project is not important.
I think what you’re missing is that the number of people doing step 4 has been going downhill steadily since the 2000s. People start open source projects yes, which for 99% of them don’t bring in any users and barely get maintained over the long run, but the pool of people willing to contribute to large established projects is so small it is becoming problematic.
Even Wikipedia is having its own editor crisis, where most of the power editors are greying out and barely anyone is stepping up to replace them.
And this is happening exactly because most people, like you, think that the free infrastructure around us is a fait accompli which doesn’t require us to personally get involved in their maintenance, and that we can even afford to scare away those that do contribute.
I do contribute time and donate money to open source project so… miss?
With less contributors simply mean we will have to be smarter about which projects we supports. In open source it’s a natural process. People support projects they actually use and need. If we can’t get enough resources to support even the most basic infrastructure then the experiment will end.
You’re missing the point. Sure you do, that’s a nice anecdote, but the data shows most people don’t. You are part of a shrinking cohort that is already insufficient to maintain what we need in the long run.
And then what ? Only large corporations can finance their own in-house tools and they gain even greater advantage against the rest of society ? What a great outcome…
Your point of view is not crazy but i think it suffers from too much optimism in the face of bleak data.
But you accused me specifically of not contributing. If you’re making a broader point don’t single me out.
Yes, that will be the outcome. And it will suck. I’m not optimistic, I’m realistic. If people wills top caring about open source it will die. Throwing AI at the problem may buy us some time but in the end LLMs also require resources and without support from community all the models will be controlled by corporations.
My sensation is that we’re doing fine for now. The community is still big enough for a decade or two. No idea what will happen after that.
The trouble with some of those projects (e.g. unison and sun thing) is that they don’t solve the same problem, not really.
A rewrite with modern tooling would be better done if it was incremental.