Open-Source Software Is in Crisis  ## Metadata - Author: [[ieeespectrum]] - Full Title: Open-Source Software Is in Crisis - Category: #articles - Document Note: --- tags: - #open_source - #sustainability - #developer_funding Author: [IEEE Spectrum Staff] Source: [IEEE Spectrum] Reference: [https://spectrum.ieee.org/open-source-crisis] date created: 2024-11-16 11:15 --- # Title: The Open-Source Crisis and the Path to Sustainability ## Table of Contents: - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#-notes) - [📖 References](#-references) - [🗣️ Paraphrase](#-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🔍 DARVO Analysis](#-darvo-analysis) - [🔍 SEO Evaluation](#-seo-evaluation) - [🎯 Conclusion](#-conclusion) ## 📝 Summary: The article explores the current crisis in the open-source ecosystem. Challenges such as maintainers' burnout, security vulnerabilities, and the "maker-taker" dynamic threaten the sustainability of open-source software (OSS), despite its role in powering 70%–90% of modern applications. Solutions proposed include commercialization, government-backed initiatives, and systems for social validation to ensure fair contributions and funding. ## 📖 Main Content: The ongoing debate over the sustainability of OSS has been amplified by high-profile disputes like the legal conflict between WordPress founder Matt Mullenweg and WP Engine. The broader issue lies in the "maker-taker" dynamic, where contributors ("makers") see their work utilized by corporations ("takers") without reciprocal support. This tension is compounded by systemic challenges such as security vulnerabilities, underfunded maintainers, and burnout. Proposed solutions aim to address these issues through financial support, government programs, and incentive structures. ### 🗒️ Notes #### **The Open-Source Landscape** - **Adoption Rate**: - 70%–90% of modern applications rely on OSS components. - OSS is fundamental to critical internet and software infrastructure. - **Key Players in Open Source**: - WordPress: Powers 40% of websites globally. - WP Engine: Hosting provider profiting from WordPress-related services. - Sovereign Tech Fund: Government-backed initiative supporting OSS sustainability. #### **The "Maker-Taker" Problem** - **Definition**: - "Makers" are the contributors who create and maintain OSS. - "Takers" are entities (usually corporations) profiting from OSS without contributing back. - Example: WP Engine's use of WordPress trademarks and OSS without sufficient contribution led to a legal dispute with Matt Mullenweg. - **Implications**: - OSS creators often lack resources to sustain their projects while seeing their work generate significant corporate profits. - The dynamic creates resentment and highlights systemic inequities. #### **Challenges Facing Open Source** - **Security Vulnerabilities**: - **Log4j Vulnerability (2021)**: A high-profile security flaw in a widely-used OSS component. - **Linux Compression Tool Hack**: Exploited trust by posing as a contributor, resulting in malicious code insertion. - Small teams or individual maintainers often lack the capacity to address security issues promptly. - **Maintainer Burnout**: - **Tidelift Survey (2024)**: - 3 Top Dislikes: - Lack of financial compensation. - Feeling underappreciated. - Increased stress from the "thankless" nature of work. - Over 50% of maintainers have quit or considered quitting. #### **Solutions for Open-Source Sustainability** 1. **Commercialization**: - Monetizing services like support or extended features. - Requires identifying "scarce" resources to create viable business models. - Example: OSS software remains free while charging for premium support. 2. **Government Funding**: - Germany's Sovereign Tech Fund: - Funds major OSS projects like FreeBSD and PHP. - Provides fellowships and resilience services like security audits and bug bounties. - Advocacy for more national and international programs to support OSS ecosystems. 3. **Social Validation**: - **Drupal Credit System**: - Rewards contributions with visibility, early access, discounts, and sponsorships. - Recognizes both code and non-code contributions (e.g., documentation). - **Open Source Pledge**: - Companies pay maintainers directly based on the number of developers they employ. - Requires transparency via blog posts detailing contributions. #### **Future Considerations** - Expanding OSS funding mechanisms to larger enterprises and governmental bodies. - Aligning contributions with outcomes to maximize the impact of financial and social support. ## 📖 References: - IEEE Spectrum. "The Open-Source Crisis." ([Read Here](https://spectrum.ieee.org/open-source-crisis)) ## 🗣️ Paraphrase: 1. The "maker-taker" problem illustrates the disparity between contributors who create OSS and corporations that profit from it without making fair contributions. This dynamic has led to significant tension and legal disputes, such as the one between WordPress and WP Engine. 2. Solutions like commercialization, government support (e.g., Germany’s Sovereign Tech Fund), and social validation (e.g., Drupal’s credit system) are being implemented to address sustainability challenges and reduce maintainer burnout. ## 📰 Newsletter: **Subject**: The Open-Source Crisis: What It Means for the Future Open-source software powers up to 90% of applications today, but its creators face mounting challenges. From security breaches to maintainer burnout, the OSS ecosystem needs urgent reforms. Solutions like Germany's Sovereign Tech Fund and initiatives such as the Open Source Pledge are paving the way for sustainable open source. Learn how these efforts aim to ensure the longevity of the software we all rely on. Stay informed and be part of the solution in this week’s edition! ## ✅ Action Items: 1. Advocate for OSS funding programs and promote the Open Source Pledge to larger enterprises. 2. Educate OSS users on the importance of contributing back, financially or otherwise. 3. Develop campaigns to recognize and reward non-code contributions, fostering inclusivity in the OSS community. ## 🧪 Hypotheses: 1. Financial incentives will improve maintainer retention and reduce burnout. 2. Expanding credit systems across OSS communities will enhance contribution diversity and volume. ### 📊 Methodology: - Conduct longitudinal studies on the effects of funding initiatives like the Open Source Pledge on maintainer retention. - Analyze the correlation between security vulnerabilities and underfunded OSS projects. ### ❓ Questions: - How can governments outside Europe adopt and scale funding models like Germany’s Sovereign Tech Fund? - What incentives can encourage larger corporations to adopt the Open Source Pledge? ### 🔮 Future Research: - Examine the impact of credit systems on contributor demographics. - Investigate the effectiveness of government and corporate partnerships in securing OSS sustainability. ### 💡 Implications: - Sustainable funding and recognition systems will stabilize OSS ecosystems and ensure security. - Inclusion of non-code contributions can broaden community engagement and project diversity. ## 🧠 Learning Styles Assessment: - **Visual Learners**: Add flowcharts to show funding flows in OSS sustainability. - **Logical Learners**: Include more empirical data and statistics. - **Social Learners**: Encourage discussions around case studies like Drupal’s credit system. ## 📊 Accessibility Assessment: - Provide text-to-speech versions of the article. - Add captions and summaries for visual media to improve inclusivity. ## 🌍 DEIB Assessment: - Use examples from diverse OSS contributors to ensure representation. - Simplify language to avoid jargon that may exclude non-native English speakers. ## ✅ Logical Validity: - The article makes - Document Tags: [[Dries]] [[Matt Mullenweg]] [[open source]] [[open source corporate contribution]] [[sustainability]] - Summary: Here are three ways to help it flourish into the future - URL: https://search.app/PTgC3WpgKQPPVmQf8 [Illustration of Greek goddess Themis holding the scales of justice against a background of binary code.](https://spectrum.ieee.org/open-source-crisis) Moor Studio/iStock A new saga is unfolding in the [open-source](https://spectrum.ieee.org/tag/open-source) realm. [Matt Mullenweg](https://ma.tt/about/), founder of open-source web content management system [WordPress](https://wordpress.com/), which powers about [40 percent of the world’s websites](https://wordpress.org/40-percent-of-web/#2021-40-percent-of-web), has accused [WP Engine](https://wpengine.com/), a hosting provider for WordPress-built websites, of violating WordPress trademarks. They’re currently embroiled in a legal battle. As Mullenweg wrote in a [post on his personal website](https://ma.tt/2024/09/wordpress-engine/), “We offered WP Engine the option of how to pay their fair share: either pay a direct licensing fee, or make in-kind contributions to the open source project. This isn’t a money grab: it’s an expectation that any business making hundreds of millions of dollars off of an open source project ought to give back, and if they don’t, then they can’t use its trademarks.” Mullenweg also [criticized WP Engine](https://wordpress.org/news/2024/09/wp-engine/) for not contributing enough hours to the open-source project despite profiting hugely from it. WP Engine hit back and [filed a lawsuit](https://www.cnbc.com/2024/10/05/wordpress-ceo-matt-mullenweg-goes-nuclear-on-silver-lake-wp-engine-.html) against Mullenweg and [Automattic](https://automattic.com/), the company behind WordPress. “That’s the blessing and the curse of open source. Everybody gets to use it, but it puts us precisely in this position of not being able to support that directly through the market.” **—Chad Whitacre, Sentry** At the center of this debacle is what [Dries Buytaert](https://dri.es/about), founder of open-source content management system [Drupal](https://www.drupal.org/), calls the “maker-taker problem.” In a [blog post](https://dri.es/solving-the-maker-taker-problem), he writes that “creators of open source software (‘makers’) see their work being used by others, often service providers, who profit from it without contributing back in a meaningful or fair way (‘takers’).” For [Chad Whitacre](https://chadwhitacre.com/), head of open-source at application monitoring software company [Sentry](https://sentry.io/welcome/), “the point of the open-source licenses we have is this permissionless sharing—that’s the blessing and the curse of open source. Everybody gets to use it, but it puts us precisely in this position of not being able to support that directly through the market.” #### Open-source developer discontent is on the rise The clash between WordPress and WPEngine is also shining a spotlight on the transforming role of open-source technologies. What began as small, fledgling projects by enthusiastic and collaborative-minded [software developers](https://spectrum.ieee.org/faces-of-open-source-the-humans-behind-the-movement) has grown into essential components of huge computer and internet infrastructure. In fact, the [Linux Foundation](https://www.linuxfoundation.org/) estimates that about [70 to 90 percent](https://www.linuxfoundation.org/blog/blog/a-summary-of-census-ii-open-source-software-application-libraries-the-world-depends-on) of today’s apps are made up of open-source software. This increased reliance on open source is putting pressure on project maintainers, especially when it comes to providing prompt software updates and critical security fixes. In late 2021, a [vulnerability in the widely used Log4j tool](https://spectrum.ieee.org/log4j-google) was [one of the highest-profile security incidents](https://spectrum.ieee.org/log4shell-log4j-still-stings) in the open-source world. Earlier this year, a [backdoor hack on a Linux compression tool](https://daily.dev/blog/xz-backdoor-the-full-story-in-one-place) was uncovered—a result of an attacker posing as a contributor to gain the maintainer’s trust over two years, allowing the attacker to insert dangerous code into the tool. Both security flaws were in small open-source projects, maintained by small teams, or even solitary, volunteers, underlying massive enterprises. Compounding this challenge is the rising burnout maintainers experience, presenting an impending recipe for disaster. According to a 2024 [survey](https://tidelift.com/about/press-releases/tidelift-study-reveals-paid-open-source-maintainers-do-significantly-more-critical-security-and-maintenance-work-than-unpaid-maintainers) by [Tidelift](https://tidelift.com/), a company that partners with and pays open-source maintainers to implement secure software development practices, the top three things that respondents dislike about being maintainers include not being financially compensated enough or at all for their work, feeling underappreciated or “like the work is thankless,” and adding to their personal stress. It comes as no surprise then that more than half of maintainers have quit or have considered quitting. #### How to fix the open-source crisis So how can companies benefitting from open-source projects better support the community? Whitacre suggests “three levers to pull to solve the open-source sustainability crisis and quit burning out maintainers.” These three levers revolve around commercialization, taxation, and social validation. Commercialization is the traditional route, which involves finding business models to subsidize open-source projects. “You’re not directly paying for open-source software, but you’re paying for something else that is supporting or subsidizing the open-source work,” Whitacre says. He cites a classic example of making the software itself free and open-source but charging for support and services. “The key to the commercialization lever is you need something scarce to have a business. Open-source is post-scarcity by definition [and] by intention, so you have to find something else scarce.” Taxation is another way to economically sustain open-source technologies. In Germany, for instance, the Federal Ministry for Economic Affairs and Climate Action is financing the [Sovereign Tech Fund](https://www.sovereign.tech/programs/fund), a program of the [Sovereign Tech Agency](https://www.sovereign.tech/) investing in “projects that benefit and strengthen the open source ecosystem.” [Currently funded projects](https://www.sovereign.tech/tech) include [FreeBSD](https://www.freebsd.org/), a Unix-like operating system; [JUnit](https://junit.org/junit5/), a testing framework for the Java ecosystem; the [PHP Foundation](https://thephp.foundation/), which is behind the PHP [programming language](https://spectrum.ieee.org/tag/programming-languages); and the [OpenJS Foundation](https://openjsf.org/), which hosts a range of JavaScript projects. Similar programs under the Sovereign Tech Agency’s purview encompass a [fellowship](https://www.sovereign.tech/programs/fellowship) that pays open-source maintainers and services to boost open-source software [resilience](https://www.sovereign.tech/programs/bug-resilience), such as code security audits, helping with known security issues, and a bug bounty and fix platform. As the Sovereign Tech Agency [notes](https://www.sovereign.tech/programs): “The open source ecosystem, while incredibly successful, is also increasingly fragile. Many more people are using the software than contributing to it. It is time to invest in digital commons, volunteer communities and the open source ecosystem to build the digital world we want to see.” The final piece of the puzzle, according to Whitacre, is social validation. Drupal follows this approach through a [credit system](https://www.drupal.org/drupalorg/blog/ensuring-a-fair-drupal-contribution-credit-system) that recognizes and incentivizes contributors for their efforts. Individuals and organizations who contribute to Drupal—be it through code, documentation, submitting case studies that demonstrate success with the software, or financial support—earn credits for visibility and advertising on Drupal’s website, as well as early access, discounts, and sponsorships to events, among other benefits. #### Companies can pledge to help out Whitacre himself is pulling the social validation lever as a leader of the [Open Source Pledge](https://opensourcepledge.com/), a group working to directly pay maintainers. By joining the Pledge, companies pay an annual minimum of US $2,000 for each full-time developer on staff to open-source maintainers of their choosing. “That means if a company has 50 developers they employ, then they’re paying at least $100,000 per year to the maintainers of the open-source software they depend on,” explains Whitacre. Members of the Open Source Pledge are also required to publish a blog post detailing their payments to maintainers. “We need companies to be out there on their own blog, in their own voice, expressing their support for the Pledge and their participation in the Pledge to encourage other companies to do likewise,” Whitacre says. “It’s for accountability and awareness.” Having started just over a month ago, the Open Source Pledge has only two dozen or so members to date, mostly “smaller, developer-focused startups highly aligned with open source to begin with,” says Whitacre. The aim is to expand to larger enterprises, which might take some time. Looking to the future of open-source software, Whitacre hopes to see more approaches like what Drupal is doing, as well as a boost from both government bodies and the tech sector to steward open-source projects. “With the Pledge, we’re trying to get the money flowing right, but that’s only half the equation,” says Whitacre. “It’s a very important half, and it’s the part we need to start with and focus on right now. The other side of that is how do we make sure that money actually has the impact we want. We need to unlock this same kind of commitment from the whole industry, broaden it, and get other companies to join us.” From Your Site Articles * [We Need to Decarbonize Software ›](https://spectrum.ieee.org/green-software) * [Open-Source Warfare ›](https://spectrum.ieee.org/opensource-warfare) Related Articles Around the Web * [The Open Source Sustainability Crisis Open Path by Chad Whitacre ›](https://openpath.quest/2024/the-open-source-sustainability-crisis/) * [The Open Source Sustainability Crisis | Lobsters ›](https://lobste.rs/s/sm3t1o/open_source_sustainability_crisis) [wordpress](https://spectrum.ieee.org/tag/wordpress)[software](https://spectrum.ieee.org/tag/software)[linux](https://spectrum.ieee.org/tag/linux)[developers](https://spectrum.ieee.org/tag/developers)[open source](https://spectrum.ieee.org/tag/open-source) [Rina Diane Caballar](https://rinacaballar.com/) is a writer covering tech and its intersections with science, society, and the environment. An *IEEE Spectrum* Contributing Editor, she's a former software engineer based in Wellington, New Zealand., Open-Source Software Is in Crisis, ieeespectrum, 01jcp2p6j5ap0ypqpyzg0ye33k.