Not Paying Open Source Maintainers Is Expensive  ## Metadata - Author: [[Open Source Pledge]] - Full Title: Not Paying Open Source Maintainers Is Expensive - Category: #articles - Document Note: --- tags: - #OpenSource - #Sustainability - #Funding - #WordPress - #Community - #Cybersecurity - #ContributorEngagement Author: Open Source Pledge Source: Open Source Pledge Blog Reference: https://opensourcepledge.com/blog/not-paying-open-source-maintainers-is-expensive/ date created: 2025-06-19 09:07 --- # Title: Not Paying Open Source Maintainers Is Expensive ## Table of Contents: - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#-notes) - [📖 References](#-references) - [🗣️ Paraphrase](#-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB (Diversity, Equity, Inclusion, and Belonging) Assessment](#-deib-diversity-equity-inclusion-and-belonging-assessment) - [✅ Logical validity](#-logical-validity) - [🔍 DARVO Analysis Prompt](#-darvo-analysis-prompt) - [🔍 SEO Evaluation](#-seo-evaluation) - [🎯 Conclusion](#-conclusion) --- ## 📝 Summary: This article argues that while open source software is free to use, not financially supporting its maintainers is ultimately costly for companies. It outlines how paying maintainers reduces business risk, ensures software stability and security, supports ongoing innovation, helps with regulatory compliance, enhances company reputation, strengthens contributor relationships, and improves recruitment. The piece advocates for a proactive, values-driven approach to open source sustainability, urging companies to join initiatives like the Open Source Pledge and directly support the maintainers and foundations that underpin their technology stacks. --- ## 📖 Main Content: The article challenges the misconception that open source software, being free, requires no financial investment from its users. It highlights the hidden costs of neglecting maintainers—burnout, instability, and security vulnerabilities—and frames financial support as a strategic investment in risk reduction and innovation. The author details the cascading benefits of paying maintainers: compliance with new cybersecurity laws, enhanced brand reputation, stronger contributor networks, and easier recruitment. The call to action is clear: companies should pay maintainers and join collective efforts like the Open Source Pledge to ensure a sustainable, secure, and innovative open source ecosystem. ### 🗒️ Notes - **Stability & Security** - Unpaid maintainers face burnout, leading to unstable and insecure software. - High-profile security incidents (e.g., Log4Shell, XZ Utils backdoor) are linked to maintainer burnout. - Early detection of vulnerabilities is often luck; systemic risk remains high. - Paying maintainers is a proactive risk management strategy. - **Innovation** - Open source drives major technological advances (e.g., streaming, space exploration, healthcare). - Global contributor base enables rapid innovation. - Lack of financial support discourages maintainership, threatening future innovation. - **Regulatory Compliance** - EU Cyber Resilience Act mandates cybersecurity standards for all software, including open source dependencies. - Compliance requires auditing entire software supply chains. - Foundations are best positioned to certify compliance but are underfunded. - Financial support for foundations is essential for legal compliance. - **Thought Leadership & Brand** - Supporting maintainers signals long-term commitment and industry leadership. - Public recognition (e.g., Nasdaq tower features) enhances brand reputation. - Membership in initiatives like the Open Source Pledge offers promotional benefits. - **Contributor Engagement** - Contributors are vital for feature development and project sustainability. - Fair compensation increases contributor retention and engagement. - Payment is not the primary motivator, but it matters for sustainability. - **Recruitment** - Developers value companies that support open source sustainability. - Membership badges and job board listings attract talent. - Demonstrating values alignment is a competitive advantage in hiring. - **Call to Action** - Use platforms like thanks.dev, Open Collective, GitHub Sponsors, and ecosyste.ms Funds to support maintainers. - Companies paying at least $2,000 per FTE developer per year can join the Open Source Pledge. --- ## 📖 References: - Open Source Pledge Blog: https://opensourcepledge.com/blog/not-paying-open-source-maintainers-is-expensive/ - EU Cyber Resilience Act - Log4Shell, XZ Utils backdoor incidents --- ## 🗣️ Paraphrase: 1. **Original:** "Maintainer burnout means the Open Source software you rely on becomes less stable and secure. Issues with widely-used Open Source software are always being uncovered, be they bugs, accidental security issues such as Log4Shell, or maliciously introduced exploits such as the XZ Utils backdoor." **Paraphrased:** When maintainers are overworked and unsupported, the open source tools you depend on become more prone to instability and security flaws. Problems—ranging from accidental bugs to deliberate attacks like the XZ Utils backdoor—are continually surfacing in widely used open source projects. 2. **Original:** "Open Source foundations are your greatest ally in ensuring you comply with EU law, but they can't do this if they don't get paid. That's why your company should pay the Open Source foundations relevant to your ecosystem." **Paraphrased:** To meet EU legal requirements, open source foundations are invaluable partners, but they need adequate funding to fulfill this role. Therefore, it’s crucial for companies to financially support the foundations that are central to their technology stack. --- ## 📰 Newsletter: **Open Source Pulse: Why Paying Maintainers Pays Off** Hey, web creators! Ever wondered why “free” open source software can end up costing your business big time? This week, we’re spotlighting the real price of not supporting the maintainers who keep your favorite tools running. From headline-grabbing security scares (Log4Shell, anyone?) to looming EU cybersecurity laws, the message is clear: investing in open source maintainers isn’t just good karma—it’s smart business. Supporting maintainers means more stable, secure, and innovative software, plus a leg up in compliance, recruitment, and brand reputation. Want to be seen as a thought leader? Join the Open Source Pledge and get your logo on the Nasdaq - Summary: Not paying for the Open Source software you use can seem like a great deal — but it can end up costing you money. - URL: https://opensourcepledge.com/blog/not-paying-open-source-maintainers-is-expensive/ [Skip to main content](https://opensourcepledge.com/blog/not-paying-open-source-maintainers-is-expensive/#main-content) Because Open Source software is free, some companies struggle to understand why it would make financial sense to pay for the Open Source software they use. But [more and more companies](https://opensourcepledge.com/members/) are starting to see that paying the maintainers of the Open Source software they rely on reduces their company's exposure to risk, saving them money in the long run. This is because paying maintainers helps companies safeguard the stability, security and innovation that keeps their products going. Paying maintainers enables them to help you comply with upcoming cybersecurity legislation. And companies that pay maintainers get a competitive advantage by attracting customers, employees and contributors. Here's a breakdown of the reasons why you will benefit from paying the maintainers your company depends on, and, in doing so, becoming one of the pioneers of a better Open Source ecosystem. #### 1. Pay maintainers to avoid stability and security problems Why does software become unstable and insecure if we don't pay maintainers? Well, if you [don't pay for the Open Source software](https://x.com/FFmpeg/status/1847872777748951311) you use, someone else has to bear the cost of developing it. Most often, this cost takes the form of a reduction in living standards for Open Source maintainers, who have to work an [unpaid](https://www.fordfoundation.org/work/learning/research-reports/roads-and-bridges-the-unseen-labor-behind-our-digital-infrastructure/) and [burnout-inducing](https://www.drmaciver.com/2015/08/throwing-in-the-towel/) second shift after their day job. This arrangement harms the maintainers that your work relies on. But it harms you too, even if most of the time it's hard to notice. Maintainer burnout means the Open Source software you rely on [becomes less stable and secure](https://openpath.quest/2024/the-open-source-sustainability-crisis/). Issues with widely-used Open Source software are always being uncovered, be they bugs, accidental security issues such as [Log4Shell](https://en.wikipedia.org/wiki/Log4Shell#Usage), or maliciously introduced exploits such as the [XZ Utils backdoor](https://en.wikipedia.org/wiki/XZ_Utils_backdoor). These two exploits were enabled by [mental-health-harming maintainer burnout](https://www.mail-archive.com/[email protected]/msg00567.html), with some maintainers of critical software at times [working 22 hour days for free](https://www.technologyreview.com/2021/12/17/1042692/log4j-internet-open-source-hacking/). The only reason these exploits didn't cause a catastrophe affecting [hundreds of millions of people](https://www.nytimes.com/2024/04/03/technology/prevent-cyberattack-linux.html) is that they were discovered early. But how many more vulnerabilities in industry-wide infrastructure lurk undiscovered? As soon as maintainers burn out, supply chain attacks become easy. Don't let your business rely on at-risk software — pay the maintainers who can make your stack sustainable and secure. Paying to avoid the liability caused by unstable and insecure software [just makes financial sense](https://opensourcepledge.com/blog/CFOs-care-about-OSS/). #### 2. Pay maintainers to safeguard the Open Source innovation you rely on Innovative Open Source projects have enabled us to [watch YouTube videos](https://en.wikipedia.org/wiki/FFmpeg), [go to space](https://en.wikipedia.org/wiki/NumPy), [exchange medical records](https://en.wikipedia.org/wiki/Health_Level_7) and [keep in touch with friends and family](https://en.wikipedia.org/wiki/Signal_(software)). Open Source projects have a competitive advantage in innovation, since they have access to a global contributor base of subject matter experts. Microsoft's own managers [have remarked that](https://en.wikipedia.org/wiki/Halloween_documents#Documents_I_and_II) “commercial quality can be achieved / exceeded by OSS projects”. But if only those who make personal sacrifices can be maintainers, maintainership is discouraged, which leads to a decrease in Open Source innovation. If you want your business to be able to continue leveraging innovative Open Source software, the most sustainable way is to pay the maintainers who do the innovating. #### 3. Pay maintainers to conform to new cybersecurity legislation The EU's [Cyber Resilience Act](https://en.wikipedia.org/wiki/Cyber_Resilience_Act), which sets out minimum cybersecurity requirements that must be met before software is placed on the EU market, has come into force. By December 2027, companies will have to ensure that both their internally authored software, and the entire Open Source supply chain their software depends on, complies with these regulations. Auditing all of the Open Source packages you depend on, and all of the packages they depend on, is daunting. The most reliable way to ensure compliance is to collaborate with [Open Source software stewards](https://github.blog/open-source/maintainers/what-the-eus-new-software-legislation-means-for-developers/#lighter-regulation-of-open-source-stewards) — basically, [foundations](https://openpath.quest/2024/the-future-of-foss-foundations/) — that take on the work of certifying certain Open Source packages. But at least 50% of foundations [say they have insufficient financial support](https://www.linuxfoundation.org/hubfs/LF%20Research/lfr_cra_readiness_031725a.pdf?hsLang=en) to actually ensure CRA compliance. Open Source foundations are your greatest ally in ensuring you comply with EU law, but they can't do this if they don't get paid. That's why your company should pay the Open Source foundations relevant to your ecosystem. #### 4. Pay maintainers to demonstrate thought leadership Being a forward-thinking Open Source pioneer that pays maintainers reflects positively on your company's brand, which can persuade customers to choose you over a competitor. Paying maintainers tells customers that you care about the health of your industry, because you're in it for the long haul, instead of focusing on short-term profits. It shows that you're connected to the prominent [companies](https://opensourcepledge.com/members/), [foundations](https://opensourcepledge.com/endorsements/), [maintainers](https://bsky.app/profile/joshuakgoldberg.com/post/3lh22q274rk2z), [CEOs](https://x.com/xdamman/status/1837021472499343492) and [writers](https://www.ericholscher.com/blog/2018/mar/9/one-percent-for-open-source/) that recognise the [Open Source sustainability crisis](https://openpath.quest/2024/the-open-source-sustainability-crisis/). Most of all, it shows that you are a thought leader that understands their field deeply and anticipates problems before they occur. To communicate these values to customers, the Open Source Pledge regularly promotes member companies, be it [on the Nasdaq tower in Times Square](https://opensourcepledge.com/images/[email protected]), in [outdoor advertising campaigns in San Francisco](https://x.com/ThePledge/status/1847333373074952354), or [online](https://opensourcepledge.com/blog/sanity-io-origin-story/). [Join us](https://opensourcepledge.com/join/) by paying maintainers.  Open Source Pledge members being promoted on the Nasdaq tower in Times Square. Join the Pledge by 30 Apr 2025 to be featured in our second round on the Nasdaq screen #### 5. Pay maintainers to build connections with contributors Your company probably depends on Open Source contributors in one way or another. Often these are the contributors that add features to the Open Source libraries you depend on, but they could also be contributors that improve Open Source or source-available projects that your company has published. These contributors are important to your business, because they enable you to leverage not only your employees' skills, but also the skills of a global base of specialised developers, which is a real business advantage. It's in your interest to not only attract contributors, but also to ensure contributors stick around to help. Though Open Source contributors are not primarily motivated by money, people will be more likely to contribute if they know they will be paid fairly for their work. #### 6. Pay maintainers to make recruiting easier Developers are aware of the crisis that Open Source sustainability faces. If developers looking for work know that you take seriously the sustainability of the Open Source ecosystem they work within, they'll be happier working for you than for your competitor. Becoming a member of the Open Source Pledge is a great way to convey your values to prospective employees. Open Source Pledge members are eligible to use [our member badges](https://opensourcepledge.com/resources/member-badges/) on their website and job board, and also get their job postings listed on the [Open Source Pledge job board](https://opensourcepledge.com/jobs/). If these arguments make sense to you, use platforms like [thanks.dev](https://thanks.dev/home), [Open Collective](https://opencollective.com/), [GitHub Sponsors](https://github.com/sponsors) and [ecosyste.ms Funds](https://funds.ecosyste.ms/) to pay the maintainers you rely on. If you pay these maintainers at least $2000 per full-time equivalent developer you employ per year, you'll be eligible to become a member of the Open Source Pledge. #### Ready to become an Open Source pioneer?, Not Paying Open Source Maintainers Is Expensive, Open Source Pledge, 01jy44r1fjm1t5qe3cfm44kjva.