Ask HN: Have you ever regretted open-sourcing something?
62 comments
·August 2, 2025acheong08
I regret open sourcing my reverse engineering of Obsidian Sync. I did it mostly for personal use but thought it might be useful for others. After a bit of cat and mouse, they fixed all the "vulnerabilities" that let you change the sync and publish endpoints and now I'm still stuck using a very outdated version. I recently found another way to get it working on IOS again but definitely not publishing it.
josephcsible
Why do they consider it a "vulnerability" that you can change configuration of software running on your own computer? I've heard a lot of good things about Obsidian before, but hearing that basically burns it all up and means I'm going to strongly recommend nobody buy anything from them anymore.
dtkav
Obsidian distributes their software for free, and makes money on a core plugin called Obsidian Sync (note that it is not open source). Obsidian Sync relies on their cloud to offer e2ee file sync.
Obsidian also has a rich plugin ecosystem with lots of open source plugins that are available and serve the same purpose (and you can use gdrive, dropbox, etc too).
It makes sense to me that they released a proprietary privacy and security focused plugin (that is their core business) and they don't want other plugins to be able to arbitrarily change the server that their plugin is pointed at.
Suppose they have a government customer who is using Obsidian Sync and the sync URL can be changed easily via configuration changes -- now the customer believes they are using Obsidian Sync, but actually their data is going somewhere else.
I don't think you would be surprised to find that e.g. a dropbox daemon has protections to make sure it is pointing at dropbox.com. Why would you expect Obsidian to be different?
(disclaimer: I work on a different plugin that adds file sync and collaboration features to Obsidian)
acheong08
My opinion is that they should have a rule such that plugins from the official list can't modify the sync url to prevent abuse and phishing but the user should still be able to do whatever they want. The process for manually adding a plugin is already enough friction for users to be aware what they're doing is not "safe"
al_borland
I always just stick my Obsidian vault in iCloud and called it a day. No additional sync service required.
sshine
This worked for me until iCloud started cache clearing all my files aggressively so my vault would take ten minutes to open on iPhone. Every few days.
When I tried to copy my vault off iCloud, the copy failed and two years of notes were permanently lost.
I’m never putting anything of value in iCloud again.
carefulfungi
Flashbacks to the time I copied iCloud pointers/placeholders thinking I was actually copying files with actual data. Oh well, who needed those few years of documents anyway.
MSFT_Edging
This gets complicated when you want your vault accessible across linux/windows/android/macos/ipad.
The ipad is the real stick in the mud and I don't want to deal with an icloud staging zone for everything else, or try to get icloud syncing on linux/android.
nkrisc
This works very well, been doing it for years. Even works flawlessly for me on Windows using the iCloud client.
asciii
Really, how? When I add a new page on my Windows client, it never reaches my phone and is stuck in some weird refresh icon state.
I tried this on a windows laptop and another main machine. I just ended up keeping my iPad nearby.
nickthegreek
Can this work with a windows or nix system in the mix?
null
greyface-
I tried to open source a weekend personal project while at $BIGCO via their "Invention Assignment Review Committee". It turned into a minor bureaucratic nightmare and I was ultimately never given the OK to release it, or any clarity over whether my employer was choosing to assert an IP ownership interest in it. In retrospect, I wish I had never notified them of its existence, and released it under a pseudonym instead.
bitbasher
Whenever I join a company I always create a bunch of made up names on my “prior inventions” list. When I open source something I just name it after something I put on my list if the description is close enough.
toss1
^^^^ Excellent idea and thinking ahead.
Great suggestion to make in advance placeholders to contain side projects.
neilv
Do you think your colleagues have the same ideas of what is honest and trustworthy behavior?
In what ways do you trust, and not trust, your colleagues?
How do you feel about that?
crazygringo
What do colleagues have to do with anything?
The better question is in what ways do you trust, and not trust, the company you work for?
And the answer to that can be very complicated, and depend on the company a great deal. It also depends on who might buy the company in the future, and they might not be trustworthy at all.
nemomarx
The people approving this stuff are your bosses, not your colleagues.
ryandrake
Whenever I see someone on HN talking about their moonlighting or side/hobby project, I get chills and think to myself "Boy, I hope they don't work for $BIGCO, because in all likelihood their existing employer claims IP ownership over that work, and if they ever try to do anything substantial with it, they're going to have corporate lawyers on their case."
I've had experience with a similar "committee" (probably same company) and I concluded the safest path is to just not do side projects while employed with BigTech.
BrandoElFollito
This is insane. When I am out of work in France, I am out of work. Sure, I cannot write software that competes with my company but unrelated open source that does not being me income - yes.
lrvick
Or live in California where forced assignment of personal time IP is illegal.
ryandrake
With an exception that is important if you work at $BIGCO: https://news.ycombinator.com/item?id=44803482
lrvick
In California you can just open source it and do not need permission as long as you did it on personal time on personal hardware without referencing proprietary IP.
Sure, a company could not like you doing that and find a reason to fire you, but they have no valid legal recourse and you may even be able to sue them for wrongful termination.
We are one of the only states that prevents employers from having ownership of your brain on personal time.
Corpos have tried to claim ownership of things I did in my personal time, multiple times. I just show them this law and they back down immediately.
Having rights to my own brain is a big reason I live in California, cost of living be damned.
https://california.public.law/codes/labor_code_section_2870
IANAL, but know your rights!
ryandrake
There are two exceptions listed on 2870, the first one is going to be the gotcha. It excludes inventions that:
> (1)Relate at the time of conception or reduction to practice of the invention to the employer’s business, or actual or demonstrably anticipated research or development of the employer;
So, if you work at $BIGCO, they will argue that since they have their fingers in everything, that anything you might work on "relates" to their business or actual or demonstrably anticipated R&D. This is a truck-sized loophole.
lrvick
Ah, fair. More great reasons to never work for a megacorpo.
There is not a paycheck big enough to make me give up the freedom to do whatever I want with my personal engineering time.
I have only worked for employers that do just one thing, so this law offers me lots of protection.
throwaway889900
Got death threats because I wasn't prioritizing stuff people were requesting, said nah I'm done
pinewurst
I open sourced a portable benchmark program and was getting angry responses because I wouldn't accept changes to make it Linux-specific.
crinkly
Lovely people no?
I had death threats once for raising a github issue!
incomingpain
>Maybe it became a burden to maintain,
This is literally why i think AI coding cant touch dev jobs.
In theory you can code LOADS of projects. Want a panel widget on your desktop environment, dont even know what language its in? ask ai to produce it.
but when you have open source projects, people from all over the world bring their requests and problems to you. Some are great to just merge, others you have no clue what they are doing wrong but it's totally them; and you get paid in github stars? Now there's a bunch of open source projects that are just working for me every day, but i havent modified in years and they look stagnant.
but even in the non-open source realm, no dev wants to forever maintain a project. Its not a regret, just 1 dev can probably only be responsible for a handful of codebases/projects and ai coding isnt going to super expand this.
al_borland
Isn’t this the thing AI is going to claim to solve? A project exists, a user writes a feature request, the AI codes up the changes, pushes a new release, and everyone is happy. That’s the sales pitch.
The big issue with this, even if it works perfectly every time, is that there is no one at the core of the project with some vision and taste, who is willing to say “no” to bad ideas or things outside the scope of the project. We’d end up seeing a lot of bloat over time. I’m sure AI will claim to solve that too, just have it code up a new lightweight project. The project sprawl will be endless.
autoexec
> The big issue with this, even if it works perfectly every time, is that there is no one at the core of the project with some vision and taste, who is willing to say “no” to bad ideas or things outside the scope of the project.
Why would any user ever care about the scope of the project or how you feel about their ideas? If they want your open source software to also play MP3s and read their email they'll just ask an AI to take your code and add the features they want. It doesn't impact anyone else using your software. What you'll probably have though are a bunch of copies of your code with various changes made (some of them might even have already been available as options, but people would rather ask AI to rewrite your software than read your docs) some listed as forks and others not mentioning you or the name of your software at all.
Most people aren't going to bother sharing the changes they made to your code with anyone but eventually you'll have people reporting bugs for weird versions of the software AI screwed up.
NitpickLawyer
> there is no one at the core of the project with some vision and taste, who is willing to say “no” to bad ideas or things outside the scope of the project.
That can literally be a system prompt.
"Here are the core principles of this project [...]. Here is some literature (updated monthly?). Project aims to help in x area, but not sprawl in other areas. Address every issue/PR based on a careful read of the core principles. Blah blah. Use top5 most active users on github as a voting group if score is close to threshold or you can't make an objective judgement based on what you conclude. Blah blah."
Current models are really close to being able to do this, if not fully capable already. Sure, exceptions will happen, but this seems reasonable, no?
pavel_lishin
Everything will look like PHP functions.
plumbees
Never done open source but always wanted to. Developers of open source could always ask for a fee to add features, and easy prs are easy prs. But for those more complicated things that don't interest the main owners, could they offer a PR service where if you pay the developers or the project a fee, they'll take the time to review the PR and tell you what to do for it to be accepted, or keep a 5$ review fee and return the rest if it's just not a feature that jives with the project's overarching goals. I don't see why that cannot be a piece of the market. It would still be open source but it would add incentive to say a project is worth doing.
Albeit I'm sure that most would likely not be willing to pay to have their code reviewed and accepted in a project; but on another hand, if I wanted to contribute to GNUCash and I didn't want to read the manual, or I found the manual hard to understand, it would be like paying for training. So it can in certain cases be win-win.
And if it is a feature that is wanted, then there's no worry about it being reviewed. Or having to pay because the value will be obvious to the creators who will take it on.
In other words: Pay the developer/maintainer to care about the feature you want.
Has this ever been attempted and successful?
jasonthorsness
Here is one such story of regret for paint.net (not my project but I'm a fan). I think the author's take was quite reasonable for this project.
https://blog.getpaint.net/2009/11/06/a-new-license-for-paint...
galad87
I wrote a small app to display a bitrate graph of video files, and posted the code on GitHub with the GPL2 license. A few weeks later someone uploaded it to the Mac App Store and sold it for 7$, the only difference was the name.
3-cheese-sundae
That stings, but how many purchases do you think it's getting?
phkahler
If they're not complying with your license terms, sue them. If they are then I guess you missed the boat on money.
01HNNWZ0MV43FF
Taking that all the way to court would be like $10,000, right? Big companies will sue. For individuals it's a barrier to entry
Scene_Cast2
Not the OP, but I have a similar dilemma. I'm currently sitting on a SOTA ML model for a particular niche. I'm trying to figure whether I should try selling it to the incumbents (in some shape or form), or if I should publish a paper on the techniques, and/or if I should OSS it.
arkmm
IMO if you think you can sell to users within the niche, you can publish a blog post of benchmarks and that'll serve as strong technical marketing for your niche.
It also keeps open the option to sell to an incumbent (possibly helps maximize the value of that option as well).
systemdev
I regret open sourcing an offline patch I made for an Unreal Engine 3 game. The game was unplayable due to an always online backend that got shut down, but was still being sold so I required everyone buy a license to play with my mod. I had to reimplement stock UE3 netcode, and a bunch of other really cool stuff. Someone who was mad at me for not giving them more help when they struggled to develop on my software decided to "repack" my software and the game on a popular piracy site, both violating my AGPL license and increasing the risk that the whole project gets CnDd. I guess it's funny that a project violating a companies "no reverse engineering" clause is pissed that someone violated their OSS license, but such is life :D
doawoo
Yup.
Long long (2016 ish) ago I released an Unreal Engine 4 plugin that let people embed chromium embedded framework views into the engine via textures, so you could make fancy HUDs or whatever.
Epic Games was kind enough to give me a developer grant for open sourcing and making it, cool as hell for a college student at the time, helped pay my classes.
The number of angry game devs who basically wanted me to solve all their problems for them for free was astounding, additionally another dev grant receiver was jealous that I got money close to their grant for “just making a crappy plugin”
(paraphrasing but that was essentially what happened)
No one is ever thankful lol.
hiAndrewQuinn
I've open sourced a few things in the past that I wish I could have kept closed source for monetization purposes. Probably a failure of some imagination on my part, but also, it's really hard to make and sell good desktop software if a user can make their own for free by typing `make`.
immibis
Only if your target audience is nerds. Actually a bunch of software is like this and still somehow manages to make money. It's more complicated than typing "make", I promise - I typed "make" three times in this comment and your software didn't materialize.
rglover
I regret it only from the perspective that it opens you up to noise from smarmy, entitled, often wildly under-qualified developers trying to "get you" for not knowing something or not having some feature they claim is table stakes.
And if it's not that, it's someone (who very well may be qualified) being unnecessarily passive aggressive trying to make a failure of your own seem like a show stopping nightmare that they'd never let happen.
What I really don't like is that sharing anecdotes like the above often invites equally annoying "tHaT's NoT mY eXpErIeNcE" type comments which leads to a sort of "who cares, just do the best you can and ignore everybody" mindset (which can be helpful at times, damaging at others).
Aside from all of that nonsense, it's great because you have other sets of eyes looking around that may see something you didn't. This is incredibly valuable if you're a soloist or small team working on a big project.
dakiol
I did "open source" my static site generator. No forks, no stars, no PRs. I removed it from github since the only one who's taking advantage of it is probably Microsoft.
Open source is usually seen as a win - for learning, visibility, and the community. But have you ever regretted it?
Maybe it became a burden to maintain, attracted the wrong users, or got used in ways you didn’t expect.
Would love to hear your experience - good or bad.