Drew DeVault
Drew DeVault, an open-source developer behind Sway and SourceHut, writes about software, licensing, browsers, and programming languages.
What HN says
Commenters recommend it as a good programming and tech blog. His AGPL post is cited on how little the license protects against SaaS reuse.
Stats for nerds
633HN people shared it
699linked in comments
33Kstory points
May 2026last shared
Top posts on HN
- 1Firefox is on a slippery slope4 people · 2K points · first shared 2017 · 874 comments on HN
- 2Please don't use Slack for FOSS projects4 people · 1.7K points · first shared 2015 · 484 comments on HN
- 3Sr.ht, the hacker's forge, now open for public alpha9 people · 892 points · first shared 2018 · 217 comments on HN
- 4Please don't use Discord for FOSS projects9 people · 885 points · first shared 2021 · 460 comments on HN
- 5China2 people · 847 points · first shared 2019 · 455 comments on HN
- 6I don't trust Signal12 people · 587 points · first shared 2018 · 455 comments on HN
- 7We can do better than DuckDuckGo1 person · 563 points · first shared 2020 · 364 comments on HN
- 8I'm tired of this anti-Wayland horseshit6 people · 550 points · first shared 2021 · 844 comments on HN
- 9Become Shell Literate3 people · 524 points · first shared 2020 · 330 comments on HN
- 10Simple, correct, fast: in that order3 people · 521 points · first shared 2018 · 344 comments on HN
What HN people wrote when they linked it
- theamkMar 2025
The AI slop is definitely less expensive for the author, as all the efforts are expended by CF's infrastructure, while the host sees zero requests.
In the previous discussions, one of the big AI problems was that they follow every link [0], including expensive ones like "git blame" view.. as well as "every commit of every log", which can be easily in millions if you have mirrors of few repos with many branches. It's simply impossible to cache this all at CloudFlare, and solution like AI maze (or outright blocking) seem like the only way.
I feel you about "requests one-liners in python" - I am still running a few of those in crontab on some server.. but their time might be past. The "average guy" does not care about this kind of scripting, so we will get lumped together with evil AI and blocked.
[0] https://drewdevault.com/2025/03/17/2025-03-17-Stop-externalizing-your-costs-on-me.html
- 8organicbitsMay 2024
> Apache license 2.0 has to be one of the most business friendly licenses around?
Yes, in my experience it is.
Permissive licenses like Apache, MIT, and BSD are easiest for the corporate lawyers to approve but also easy for the project owner to relicense. Relicencing Monitor isn't measuring how easy it is for companies to use the software; risk is solely measuring how easy it is to relicense the software.
Copyleft licenses are lower risk than permissive licenses in this specific context as they are viral. A CLA or a very small number of contributors can negate that, as happened with Emby [1].
SourceGraph is probably the best example here (I need to add them still). They switched off Apache 2 and prompted this [2] helpful blog post.
[1] https://alexsci.com/relicensing-monitor/projects/emby/
[2] https://drewdevault.com/2023/07/04/Dont-sign-a-CLA-2.html
- x-complexityOct 2023
There's an argument to be made that the extreme breadth of scope that modern web browsers are obliged to support (in order to gain/retain market share) heavily contributes to there being no worthy contenders against Chromium's web monopoly.
https://drewdevault.com/2020/03/18/Reckless-limitless-scope.html
When you're the leader, you can further widen your lead by bolting on additional functions & features that require at least X amount of effort to implement. Any new contender will have to put in SUM(X effort for each feature) to match feature parity with the existing leader, and existing competitors will have to put in at least X effort to catch up. Existing OSS work can help bridge the gap, but only for what's already been done.
- mananaysiempreOct 2025
> I mean, we all just accept whatever the project believes is normal right?
Not in this thread we don’t? The whole thing has been about the fact that it wasn’t easy for a distro maintainer to detect the suspicious code even if they looked. Whether anyone actually does look is a worthy question, but it’s not orthogonal to making the process of looking not suck.
Of course, if we trust the developer to put software on our machine with no intermediaries, the whole thing goes out the window. Don’t do that[1]. (Oh hi Flatpak, Snap. Please go away. Also hi NPM, Go, Cargo, PyPI; no, being a “modern programming language” is not an excuse.)
[1] https://drewdevault.com/2021/09/27/Let-distros-do-their-job.html
- belterJan 2025
This is better to understand the context of the protest
""No billionaires at FOSDEM" - https://drewdevault.com/2025/01/16/2025-01-16-No-Billionares-at-FOSDEM-please.html
Also these are the recommended actions:
"To maintain the peaceful nature of our protest and minimize the disruption to FOSDEM generally, we ask participants to strictly adhere to the following instructions:
Do not touch anyone else, or anyone else’s property, for any reason.
Do not engage in intimidation.
Remain quiet and peaceful throughout the demonstration.
When the protest ends, disperse peacefully and in a timely manner.
Leave the room the way you found it. "
- eskibarsMay 2026
One thing I mention to folks that seem to think AGPL "protects you" against a major corporation incorporating your product into a SaaS product: it mostly doesn't.
It isn't written about often, but it's the reason many "open core" companies moved away from AGPL to protect their revenue from larger SaaS/IaaS/PaaS players from eating their lunch.
Some writings are:
- https://writing.kemitchell.com/2021/01/24/Reading-AGPL
- https://katedowninglaw.com/2019/09/08/the-great-open-source-shake-up/
- https://drewdevault.com/blog/Anti-AGPL-propaganda/