# Consuming Open Source Without a Give-Back Strategy Is Free-Riding ## Claim An organization that consumes open-source software without contributing back — through code, governance participation, funding, or feedback — extracts value from a commons it is simultaneously failing to sustain. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds for direct consumers of open-source components at meaningful scale, where the organization's own health depends on the dependency's continued maintenance. - Partially offset when consuming through a curated distribution that itself funds upstream (Thomas cites Red Hat as the proof-of-concept that this can work commercially). - Does not apply to de minimis consumers — a hobbyist using one small library isn't the target of this claim. ## Evidence Jamie Thomas (IBM Enterprise Security Executive, former OpenSSF Governing Board Chair) frames "consuming with intent" as knowing what you depend on (SBOM), checking its health (OpenSSF Scorecard), and having a documented give-back plan — contrasted against the SolarWinds/Log4j pattern of enterprises discovering their exposure only after an incident. > [!quote] > "If you're a direct consumer of open source, do it with intent. And intent means that you're responsible for what that means to your organization both from a productivity perspective, but also from a security perspective." ## Links - [[3. Resources/Literature Notes/Consuming with Intent (Jamie Thomas, OpenSSF)]] — source literature note - [[3. Resources/Permanent Notes/Perm · WordPress security is now a supply-chain + dependency risk, not just plugin reviews]] — because applies-in; unmapped dependency risk is the WordPress-specific instance of the same accidental-consumption problem - [[3. Resources/Permanent Notes/Stewardship Invests in Contributor Capacity Not Just Cash]] — because extends; give-back strategy is one concrete form the stewardship-not-just-cash argument takes at the organizational level - [[3. Resources/MOCs/Open Source Governance MOC]] — because applies-in; consumption policy is governance infrastructure - [[3. Resources/Permanent Notes/An Open Source Adoption Claim Without a Dated Target and a Measurement Is Talk]] — applied in: an open source adoption claim needs a dated target and a measurement before it counts as adoption. ## Tests / falsifiers - Track whether organizations with a documented give-back strategy show measurably fewer supply-chain incidents (or faster remediation) than comparable non-contributing consumers over time. - If heavy-consuming, zero-contributing organizations show no elevated incident rate or ecosystem harm, the "free-riding" framing overstates the risk. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Readwise/Articles/Consuming with Intent Driving Enterprise Security & Career Growth Through Open Source - Jamie Thomas]] — Jamie Thomas (IBM) interview on IBM's open-source history, enterprise security stewardship, and career growth through participation.