Our great sponsors
-
-
-
InfluxDB
Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.
Companies will use whatever is at their disposal to grow faster and more efficiently, this is the free market working as intended (and isn't a bad thing by itself: see free software companies like SourceHut benefiting as well).
I think the core of the problem lies in distribution. We've gotten so used to other people distributing our code for us (through the use of package managers and such) that we've made it hard to actually have a dialogue with our users. Many consumers of packages just know their dependencies by the npm package name, rather than actually seeing what the person has to say about the software, how they plan to maintain it and for how long, etc.
Even things like licenses are really just ignored at large. There was something I remember reading a bit ago about a Go project whose license was simply "you do not have permission to use for any reason ever" which was depended on by projects from AWS[0].
This is mostly just a rambling and I don't have any concrete way to solve this, but I think it should be taken into account when assessing whether the problem really lies in the individual license choices of developers, or whether this is some kind of effort by big market actors to keep open source solutions at a subpar level of quality in comparison to commercial offerings (for example: some of Microsoft's VsCode extensions only work on the proprietary version, not any open source forks[1]).
[0]: https://fossa.com/blog/bouk-monkey-importance-knowing-your-d...
[1]: https://github.com/VSCodium/vscodium/issues/240
Why do you think they're using log4j to any significant extent? I'd be a bit surprised if they ever did rather than rolling their own, because for something this simple the cost of writing your own is far cheaper than dealing with a dependency. We're not talking about Linux or Clang here...
In particular, from https://github.com/google/flogger#yet-another-logging-api:
> Flogger is now the sole recommended Java logging API within Google.