2024-Tidelift-State-of-the-Open-Source-Maintainer-Report  ## Metadata - Author: [[readwise.io]] - Full Title: 2024-Tidelift-State-of-the-Open-Source-Maintainer-Report - Category: #articles - Document Note: --- tags: - #opensource - #maintainers - #funding Author: Tidelift Source: 2024 Tidelift State of the Open Source Maintainer Report Reference: https://tidelift.com/ date created: 2024-09-24 12:00 --- # Title: 2024 State of the Open Source Maintainer Report ## Table of Contents: - 📝 [Summary](#-summary) - 📖 [Main Content](#-main-content) - 🗒️ [Notes](#-notes) - 🗣️ [Paraphrase](#-paraphrase) - 📰 [Newsletter](#-newsletter) - ✅ [Action Items](#-action-items) - 🧪 [Hypotheses](#-hypotheses) - 📊 [Methodology](#-methodology) - ❓ [Questions](#-questions) - 🔮 [Future Research](#-future-research) - 💡 [Implications](#-implications) - 🧠 [Learning Styles Assessment](#-learning-styles-assessment) - 📊 [Accessibility Assessment](#-accessibility-assessment) - 🌍 [DEIB Assessment](#-deib-assessment) - ✅ [Logical Validity](#-logical-validity) - 🔍 [SEO Evaluation](#-seo-evaluation) - 🎯 [Conclusion](#-conclusion) ## 📝 Summary: The 2024 Tidelift State of the Open Source Maintainer Report is a comprehensive survey of over 400 open source maintainers. It sheds light on key challenges, such as compensation for maintainers, the increasing demands around security practices, and the use of AI tools in open source development. One striking statistic remains: 60% of maintainers are still unpaid, which has not changed since the last survey. Those who are paid are making significantly more improvements to their projects, particularly in areas like security, maintenance, and documentation. The report also delves into growing concerns over AI coding tools and the shift in demographics as maintainers grow older. ## 📖 Main Content: The Tidelift State of the Open Source Maintainer Report is a deep dive into the lives, work, and challenges of open source maintainers in 2024. This year’s report highlights twelve major findings based on survey data, interviews, and analysis from over 400 maintainers. These findings reflect the diverse experiences and obstacles open source maintainers face, particularly around funding, security, and contributor dynamics. ### Funding for Maintainers Perhaps the most talked-about statistic in the report is that **60% of maintainers are not paid for their work**, a figure that has stayed consistent since the previous year. This segment is divided into two groups: 16% of maintainers do not want to be paid for their contributions, while 44% wish they could get paid. The remaining 40% are semi-professional or professional maintainers, meaning they receive some form of compensation—whether through salary, donations, or third-party sponsors. The report further discusses the **sources of income for paid maintainers**. The majority (47%) still report no pay, while 32% receive compensation from organizations like Tidelift, GitHub Sponsors, or foundations. Salaried maintainers, whose compensation is part of their job responsibilities, make up only 24% of the sample, a slight decrease from last year. Despite the lack of financial incentives for most maintainers, **those who are paid** report significant benefits: - **83% spend more time maintaining their projects.** - **64% work on new feature requests.** - **52% research and respond to security issues.** - **45% prioritize remediating security vulnerabilities.** The report underscores that paid maintainers are much more likely to implement key security and maintenance practices. For example, **maintainers who receive regular, predictable income** (like monthly payments) are significantly more likely to address security vulnerabilities compared to those who rely on one-time payments. ### Security Practices One of the most important sections of the report highlights the **dramatic increase in time spent on security**. According to the findings, maintainers are now spending **three times more time** on security compared to 2021. This shift can be attributed to both external pressures (such as the xz utils hack) and internal project demands, with more maintainers required to focus on vulnerabilities, secure development practices, and security audits. Paid maintainers are especially likely to adopt security practices like: - **Two-factor authentication (71%).** - **Static code analysis (65%).** - **Fixing vulnerabilities (60%).** - **Implementing security disclosure plans (52%).** Moreover, professional maintainers are far more likely to align their projects with **industry standards** like the **OpenSSF Scorecard** or the **NIST Secure Software Development Framework (SSDF)**. For example, almost half (49%) of Tidelift-partnered maintainers who are aware of the OpenSSF Scorecard have already begun aligning their projects with its requirements. This is three times higher than maintainers not partnered with Tidelift. ### Documentation and Maintenance Practices The report also emphasizes the importance of **documentation and maintenance**, especially for paid maintainers. Paid maintainers were found to: - **Publish contributor guides (74%)** much more frequently than unpaid maintainers (52%). - **Document release notes and upgrade considerations (76%)** compared to unpaid maintainers (63%). - **Provide a code of conduct (53%)**. When maintainers are paid, they are not only able to implement **more comprehensive documentation practices** but also engage co-maintainers and review contributions more effectively. As a result, projects with paid maintainers are generally seen as more secure and reliable, aligning with industry best practices. ### AI and Demographics This year’s report also touched on the increasing role of **AI tools** in open source development. Younger maintainers (under 35) are much more likely to use AI-based coding tools like **GitHub Copilot**, while older maintainers remain skeptical about the quality and ethical implications of AI-generated code. Many maintainers expressed concerns about the impact of AI on open-source licensing and security, and about whether AI-generated contributions meet the high standards expected in the open-source community. Interestingly, the report notes that the open source maintainer community is getting older. Compared to previous surveys, more maintainers are in their **40s and 50s**, and fewer young developers are taking up the role of maintainers. This aging demographic raises concerns about the long-term sustainability of open-source projects, particularly as maintainers approach retirement or reduce their involvement. ### The Thankless Nature of Open Source Work A common theme in the report is that almost **half of maintainers feel underappreciated** and find the work thankless. As more organizations and governments rely on open source software, the burden placed on maintainers continues to grow. This, coupled with the **lack of compensation**, leaves many feeling disillusioned. Some maintainers noted that the responsibility of maintaining popular projects is overwhelming, particularly when it comes to addressing security vulnerabilities, reviewing PRs, and managing dependencies. ### Conclusion: A Call for Change The 2024 report concludes with a call to action for organizations and individuals who rely on open source projects to **financially support maintainers**. The survey shows that paid maintainers are not only more likely to follow security best practices but also more likely to keep their projects well-documented and up-to-date. As open source software becomes increasingly integrated into critical infrastructure and corporate systems, maintaining project health and security must be a top priority. ## 🗒️ Notes: - **60% unpaid maintainers**: Of the 400+ respondents, 60% are unpaid. Among them, 16% prefer not to be paid, while 44% would appreciate compensation. - **Sources of income**: Paid maintainers get funding primarily from three sources—salary from an employer (24%), third-party programs like Tidelift or GitHub Sponsors (32%), and donation programs. 47% report no income at all. - **Paid maintainers do more**: Paid maintainers are significantly more likely to: - Spend more time maintaining their projects (83%). - Work on feature requests (64%). - Improve security practices (45% prioritize vulnerabilities). - **Security focus* - URL: https://readwise.io/reader/document_raw_content/219438602 Full text of this document omitted because this document is a PDF [Download original file →](https://readwise.io/reader/document_raw_content/219438602), 2024-Tidelift-State-of-the-Open-Source-Maintainer-Report, readwise.io, 01j8javppbyxkr56fvfnz47z0n.