this post was submitted on 02 Jul 2026
145 points (98.7% liked)

Programming

27526 readers
354 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Rules

  • Follow the programming.dev instance rules
  • Keep content related to programming in some way
  • If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities !webdev@programming.dev



founded 3 years ago
MODERATORS
 

I saw an issue today on a fairly popular project (better-auth, see the link to the issue attached). No repro, no context, just a wall of caps and profanity ending in "fuck you". The maintainers ship this for free. People run production businesses on top of it, for free. And the thanks is someone raging into a text box because a minor bump cost them an afternoon.

I maintain and contribute to a few projects myself, so this hits a nerve a bit. Something people don't see from the outside: it's not enough to know how to build the thing. You also have to know how to defuse a thread where someone's insulting you and not fire back, even though most of us aren't paid for any of it, let alone the work of staying civil while being told to get fucked.

I'm not pretending breaking changes don't cause real pain (that's what the issue is about). But I keep coming back to a boundary question: if you're not paying for it, do you actually get to demand anything? (Obviously yes, but we still need some boundaries)

top 22 comments
sorted by: hot top controversial new old
[–] FizzyOrange@programming.dev 3 points 1 hour ago

I say thanks to open source maintainers all the time! 😄

Anyway, while a wall of profanity and fuck you is clearly not ok, I do disagree with this:

The maintainers ship this for free. People run production businesses on top of it, for free.

Just because you offer something for free doesn't absolve you of all moral responsibility. I'm not saying you have a lot of responsibility, but "it's free so you can't complain!" is pure nonsense.

Go and give some kids free poisoned sweets and see how far that gets you.

[–] auzy1@lemmy.world 4 points 2 hours ago

Yeah, I started a major project 20 years that got a lot of attention.

I gave it up after a few months because whilst there was a lot of support, you have to constantly fight against a holes who will tell you how much you suck compared to other options, or how unnecessary you are

[–] CoryCoolguy@lemmy.myserv.one 17 points 4 hours ago (1 children)

"Sorry about that. We will issue a full refund."

[–] LordCrom@lemmy.world 3 points 2 hours ago

Guarantee triple their money back

[–] Kissaki@programming.dev 26 points 6 hours ago* (last edited 6 hours ago)

I don't think there's a particular need to defuse into a productive discussion. Something like that, with no repro or respect - lock and close, with a comment on why/that onproductive and disrespectful/what it could have been.

Tone should always be respectful. Something like this should have been a respectful, open suggestion, explaining the issues no clear semver causes.

If they don't respond to your needs - you can accept it or leave/fork.

From the license:

THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

It's the necessary tradeoff of free/open source software. You get something for free and with permission to do (almost) anything with it, but you get no warranties.

If this user had simply pointed out the issue it'd have been totally fine, the dev(s) might have missed it and it'd be helpful to let them know. The entitlement shown here is not OK in any way, regardless of the validity of the point made.

[–] kibiz0r@midwest.social 21 points 7 hours ago (1 children)

Complains about improper release management.

Apparently not using lockfiles for prod.

This is not a serious developer.

[–] Kissaki@programming.dev 2 points 6 hours ago* (last edited 6 hours ago) (1 children)

What makes you think it's a lockfile issue? If they sighted a patch upgrade then updated the lockfiles but then noticed a breaking change, then lockfiles are irrelevant.

If it's actually like they claim, I understand the frustration. (Not that I know this project in particular or how it gets integrated.) Without clear versioning and/or changelogs/release notes managing upgrades is cumbersome, sometimes impossible.

In some cases I've had to ask for clarification in PRs because release notes were not clear, PR was not clear, and resolved ticket was also not clear on the thing or solution.

Apparently they had issues before, so maybe they could have expected "patch may not be patch-only".

[–] kibiz0r@midwest.social 6 points 4 hours ago (1 children)

It’s the combination of “breaking changes on minor releases” and “disregard for … production environments”.

Can you stop releasing breaking changes on minor releases? It's absolutely infuriating that you guys keep doing this over and over again with complete disregard for people downstream using this package in production environments.

By the time you’re deploying to production, you should already have your versions locked in, so semver does not factor into resolving dependencies for production deployments at all.

I can understand it being annoying for development processes. Like, if you have a dependabot-style tool that tests against new releases and submits PRs for them, that can definitely be a waste of time and attention if it fails frequently on patch-level updates.

But in between that “eager testing” step and a production rollout, there needs to be a moment where a human reviews the updates and signs off on updating the lockfile.

And at that moment, reading the changelog, it really doesn’t matter if it says “1.0.1: breaking changes!” or “2.0.0: breaking changes!”, because you need to be looking at the substance of the update.

The only way semver violations burn you in a prod env is if you’re YOLOing new versions out there, either by forgoing a lockfile or by merging lockfile updates without review.

[–] Feyd@programming.dev 1 points 1 hour ago* (last edited 1 hour ago)

The reasonableness of your assertion kind of comes down to environment. Say NPM where people go nuts with dependencies (and is the subject here). If for instance there is a security issue in a package used by the package in question and you must update the package in question to get the package with the security warning updated, then you must update the package in question, and there is every expectation in the NPM ecosystem that semver is followed.

That said, being rude to the developers is immature and counterproductive, and moving to a different solution if a package repeatedly causes problems would be the sane course of action.

[–] tgcoldrockn@lemmy.world 3 points 4 hours ago

Coming from /all, not a programmer, user of multiple FOSS, ... thank you thank you thank you! I'm grateful I've been able to leave subscription ecosystems without a loss of important tool sets.

[–] obelisk_complex@piefed.ca 12 points 7 hours ago* (last edited 7 hours ago)

Guy keeps talking about their "customers" and they don't charge a dime. I'm not sure that word means what he thinks it means. They have users, and that's exactly what he's acting like.

[–] Kissaki@programming.dev 7 points 6 hours ago

The first version included a 'Fuck you' but they edited it away.

[–] bitfucker@programming.dev 38 points 10 hours ago (1 children)

Naah, I don't really demand anything if the author breaks something on update. I just asked if the breaking changes are intentional and if there's a workaround. Failing that, I revert and look for other libraries or roll my own. To me Open Source is always about making something you love without any obligation. Not even to follow semver.

[–] WhatAmLemmy@lemmy.world 15 points 7 hours ago* (last edited 7 hours ago) (1 children)

That view of open source only applies for non-profits and hobbyists, releasing code that solves their problems altruistically.

Corporations, startups, and VC's abuse open source by using it as a means to gain goodwill and trust until they are funded or profitable, then they perform a bait and switch or other parasitic practices; they deserve the hate, and can eat shit and die.

Also, if you're not gonna follow semver don't use semver. Just use YYYY-MM-DD or whatever. Quite simple really.

Regarding this project; anyone who chooses to use new (thus untrustworthy) foss libraries in prod without version pinning and thorough integration testing is an idiot.

[–] Feathercrown@lemmy.world 1 points 3 hours ago

Yeah, choosing to establish the semver social contract and then break it is not great

[–] devaly@ani.social 19 points 9 hours ago* (last edited 9 hours ago) (2 children)

This guy has a public identity and even has some very starred repos. I wonder if he gave so much as a thought regarding his whole company seeing his disgusting attitude.

[–] manxu@piefed.social 13 points 8 hours ago

I was surprised to find out that he actually stuck with his original issue text and defended it later on. I understand being frustrated and all, but an apology about the tone was definitely in order.

[–] olenkoVD@lemmy.dbzer0.com 5 points 7 hours ago

this is the Next.JS dev

[–] mycodesucks@lemmy.world 6 points 7 hours ago* (last edited 7 hours ago)

I thought the proper way to treat maintainers was to shamelessly and immediately volunteer other people's labor for endless forks every time something we don't like happens?

[–] Feathercrown@lemmy.world 0 points 3 hours ago

I don't think it's valid to simultaneously present open-source as a legitimate alternative for paid software, while also saying you can't have expectations of the software or trust its guarantees (ie. semver) because it's just a volunteer project. If you're presenting your OSS in the serious space of choices for its niche, it will (and should be!) held to a high standard. If it can't be, then don't present it as a real alternative. I've noticed this (mostly-unintentional) conflation between serious OSS competitors and hobby projects in almost every discussion on this topic I've seen.

[–] Marija@programming.dev 2 points 8 hours ago

Optimocracy depends on respecting maintainers.