# Consuming with Intent (Jamie Thomas, OpenSSF) > [!question] Lingering Questions > - Does "consumption-proportional funding" (Tidelift, Open Collective, FOSS Fund-style covenants) actually exist as a formalized model anywhere, or is it still aspirational? > - Does OpenSSF Scorecard tooling have any integration path into the WordPress plugin review pipeline, or would that require new tooling entirely? > [!tip] Article Ideas > - Run OpenSSF Scorecard against WordPress core's top external dependencies and publish the findings. > - A one-page "give-back strategy template" for open-source-consuming organizations, generalized from Thomas's framework. > [!link] Cross Reference > - [[3. Resources/Permanent Notes/Perm · WordPress security is now a supply-chain + dependency risk, not just plugin reviews]] — same underlying concern (unmapped/unmaintained dependencies as enterprise risk) from a WordPress-specific angle > - [[3. Resources/MOCs/Open Source Governance MOC]] > - [[3. Resources/MOCs/DevRel MOC]] — the career-growth-through-participation argument overlaps DevRel's advocacy-as-career-path thread > [!quote] Vocabulary > - **OpenSSF Scorecard** — an automated health-check tool that scores open-source projects on maintenance signals, used here as an enterprise triage instrument before consumption > - **Give-back strategy** — Thomas's term for an organization's explicit, documented plan for contributing back to the open-source projects it consumes ## Author's thesis Open source is not free infrastructure to be passively consumed; it is a shared, fragile, community-maintained commons that requires enterprises to consume with intent — mapping what they depend on, assessing its health, and contributing back — and that same intentional participation is also a durable career accelerant for the individual engineers who do it. ## Key arguments (≤3) 1. **Accidental consumption is now a mapped, quantifiable liability.** SBOMs are surfacing hidden transitive dependencies that enterprises never inventoried; SolarWinds and Log4j made the cost of that blindness concrete. 2. **Project health is measurable and should gate consumption decisions.** OpenSSF Scorecard exists precisely because not every dependency stays healthy — pulling in a declining project without checking is a risk-management failure, not bad luck. 3. **Upstream participation builds influence skills unavailable inside a single company.** Governing-board work, cross-organizational persuasion, and exposure to the "collective point of view" are scarce inside most corporate reporting chains. ## Claim atoms ### Intentional open-source consumption requires active stewardship and reciprocal contribution > [!quote] ID:rw_consuming_intent_001 > "If you're a direct consumer of open source, do it with intent. And intent means that you're responsible for what that means to your organization both from a productivity perspective, but also from a security perspective." Where/why: opening thesis, repeated ~31:00 during the stewardship segment. The core prescriptive claim of the interview, directly actionable for OSPOs and CISOs building consumption policy. ### Open-source project health is measurable and should gate enterprise consumption decisions > [!quote] ID:rw_consuming_intent_002 > "Not every project maintains a healthy state over a period of time. And so that's why we created the scorecard that gives organizations a perspective of whether the project is healthy." Where/why: ~31:30, Thomas explaining OpenSSF Scorecard's rationale. Grounds the abstract stewardship principle in a concrete, available tool. ### Open-source participation builds influence skills unavailable inside single organizations > [!quote] ID:rw_consuming_intent_003 > "When I go to the OpenSSF, I don't just go there and understand what my point of view is. I'm understanding the collective point of view. And that collective point of view is very interesting and fascinating." Where/why: ~16:45, career-development segment. Explains the mechanism behind why upstream participation accelerates careers beyond technical credentialing — perspective breadth and influence practice. ## Permanent candidates - **Consuming open source without a give-back strategy is free-riding on shared infrastructure** — supported by H1 and H2; promoted below. ## Processing checklist - [x] Ported existing deep-read (Refactor Appendix) into Konik Literature Note format - [ ] Run OpenSSF Scorecard against 5 real client dependencies and document findings - [x] Connect into the relevant MOC — [[3. Resources/MOCs/Open Source Governance MOC]] ## Metadata - Source: [[3. Resources/Readwise/Articles/Consuming with Intent Driving Enterprise Security & Career Growth Through Open Source - Jamie Thomas]] ## Links - [[3. Resources/MOCs/Open Source Governance MOC]] — enterprise consumption policy and give-back obligations are core governance-MOC territory - [[3. Resources/MOCs/DevRel MOC]] — the career-growth-through-upstream-participation argument