Open-Source Software Is in Crisis  ## Metadata - Author: [[spectrum.ieee.org]] - Full Title: Open-Source Software Is in Crisis - Category: #articles - Document Tags: [[open_source]] [[sustainability]] [[developer_funding]] - Summary: Here are three ways to help it flourish into the future - URL: https://spectrum.ieee.org/amp/open-source-crisis-2669743241 [Computing](https://spectrum.ieee.org/topic/computing/) #### Here are three ways to help it flourish into the future 13 Nov 2024 [](https://spectrum.ieee.org/open-source-crisis) Moor Studio/iStock A new saga is unfolding in the [open-source](https://spectrum.ieee.org/tag/open-source) realm. [Matt Mullenweg](https://ma.tt/about/), founder of open-source web content management system [WordPress](https://wordpress.com/), which powers about [40 percent of the world’s websites](https://wordpress.org/40-percent-of-web/#2021-40-percent-of-web), has accused [WP Engine](https://wpengine.com/), a hosting provider for WordPress-built websites, of violating WordPress trademarks. They’re currently embroiled in a legal battle. As Mullenweg wrote in a [post on his personal website](https://ma.tt/2024/09/wordpress-engine/), “We offered WP Engine the option of how to pay their fair share: either pay a direct licensing fee, or make in-kind contributions to the open source project. This isn’t a money grab: it’s an expectation that any business making hundreds of millions of dollars off of an open source project ought to give back, and if they don’t, then they can’t use its trademarks.” Mullenweg also [criticized WP Engine](https://wordpress.org/news/2024/09/wp-engine/) for not contributing enough hours to the open-source project despite profiting hugely from it. WP Engine hit back and [filed a lawsuit](https://www.cnbc.com/2024/10/05/wordpress-ceo-matt-mullenweg-goes-nuclear-on-silver-lake-wp-engine-.html) against Mullenweg and [Automattic](https://automattic.com/), the company behind WordPress. “That’s the blessing and the curse of open source. Everybody gets to use it, but it puts us precisely in this position of not being able to support that directly through the market.” **—Chad Whitacre, Sentry** At the center of this debacle is what [Dries Buytaert](https://dri.es/about), founder of open-source content management system [Drupal](https://www.drupal.org/), calls the “maker-taker problem.” In a [blog post](https://dri.es/solving-the-maker-taker-problem), he writes that “creators of open source software (‘makers’) see their work being used by others, often service providers, who profit from it without contributing back in a meaningful or fair way (‘takers’).” For [Chad Whitacre](https://chadwhitacre.com/), head of open-source at application monitoring software company [Sentry](https://sentry.io/welcome/), “the point of the open-source licenses we have is this permissionless sharing—that’s the blessing and the curse of open source. Everybody gets to use it, but it puts us precisely in this position of not being able to support that directly through the market.” #### Open-source developer discontent is on the rise The clash between WordPress and WPEngine is also shining a spotlight on the transforming role of open-source technologies. What began as small, fledgling projects by enthusiastic and collaborative-minded [software developers](https://spectrum.ieee.org/faces-of-open-source-the-humans-behind-the-movement) has grown into essential components of huge computer and internet infrastructure. In fact, the [Linux Foundation](https://www.linuxfoundation.org/) estimates that about [70 to 90 percent](https://www.linuxfoundation.org/blog/blog/a-summary-of-census-ii-open-source-software-application-libraries-the-world-depends-on) of today’s apps are made up of open-source software. This increased reliance on open source is putting pressure on project maintainers, especially when it comes to providing prompt software updates and critical security fixes. In late 2021, a [vulnerability in the widely used Log4j tool](https://spectrum.ieee.org/log4j-google) was [one of the highest-profile security incidents](https://spectrum.ieee.org/log4shell-log4j-still-stings) in the open-source world. Earlier this year, a [backdoor hack on a Linux compression tool](https://daily.dev/blog/xz-backdoor-the-full-story-in-one-place) was uncovered—a result of an attacker posing as a contributor to gain the maintainer’s trust over two years, allowing the attacker to insert dangerous code into the tool. Both security flaws were in small open-source projects, maintained by small teams, or even solitary, volunteers, underlying massive enterprises. Compounding this challenge is the rising burnout maintainers experience, presenting an impending recipe for disaster. According to a 2024 [survey](https://tidelift.com/about/press-releases/tidelift-study-reveals-paid-open-source-maintainers-do-significantly-more-critical-security-and-maintenance-work-than-unpaid-maintainers) by [Tidelift](https://tidelift.com/), a company that partners with and pays open-source maintainers to implement secure software development practices, the top three things that respondents dislike about being maintainers include not being financially compensated enough or at all for their work, feeling underappreciated or “like the work is thankless,” and adding to their personal stress. It comes as no surprise then that more than half of maintainers have quit or have considered quitting. #### How to fix the open-source crisis So how can companies benefitting from open-source projects better support the community? Whitacre suggests “three levers to pull to solve the open-source sustainability crisis and quit burning out maintainers.” These three levers revolve around commercialization, taxation, and social validation. Commercialization is the traditional route, which involves finding business models to subsidize open-source projects. “You’re not directly paying for open-source software, but you’re paying for something else that is supporting or subsidizing the open-source work,” Whitacre says. He cites a classic example of making the software itself free and open-source but charging for support and services. “The key to the commercialization lever is you need something scarce to have a business. Open-source is post-scarcity by definition [and] by intention, so you have to find something else scarce.” Taxation is another way to economically sustain open-source technologies. In Germany, for instance, the Federal Ministry for Economic Affairs and Climate Action is financing the [Sovereign Tech Fund](https://www.sovereign.tech/programs/fund), a program of the [Sovereign Tech Agency](https://www.sovereign.tech/) investing in “projects that benefit and strengthen the open source ecosystem.” [Currently funded projects](https://www.sovereign.tech/tech) include [FreeBSD](https://www.freebsd.org/), a Unix-like operating system; [JUnit](https://junit.org/junit5/), a testing framework for the Java ecosystem; the [PHP Foundation](https://thephp.foundation/), which is behind the PHP [programming language](https://spectrum.ieee.org/tag/programming-languages); and the [OpenJS Foundation](https://openjsf.org/), which hosts a range of JavaScript projects. Similar programs under the Sovereign Tech Agency’s purview encompass a [fellowship](https://www.sovereign.tech/programs/fellowship) that pays open-source maintainers and services to boost open-source software [resilience](https://www.sovereign.tech/programs/bug-resilience), such as code security audits, helping with known security issues, and a bug bounty and fix platform. As the Sovereign Tech Agency [notes](https://www.sovereign.tech/programs): “The open source ecosystem, while incredibly successful, is also increasingly fragile. Many more people are using the software than contributing to it. It is time to invest in digital commons, volunteer communities and the open source ecosystem to build the digital world we want to see.” The final piece of the puzzle, according to Whitacre, is social validation. Drupal follows this approach through a [credit system](https://www.drupal.org/drupalorg/blog/ensuring-a-fair-drupal-contribution-credit-system) that recognizes and incentivizes contributors for their efforts. Individuals and organizations who contribute to Drupal—be it through code, documentation, submitting case studies that demonstrate success with the software, or financial support—earn credits for visibility and advertising on Drupal’s website, as well as early access, discounts, and sponsorships to events, among other benefits. #### Companies can pledge to help out Whitacre himself is pulling the social validation lever as a leader of the [Open Source Pledge](https://opensourcepledge.com/), a group working to directly pay maintainers. By joining the Pledge, companies pay an annual minimum of US $2,000 for each full-time developer on staff to open-source maintainers of their choosing. “That means if a company has 50 developers they employ, then they’re paying at least $100,000 per year to the maintainers of the open-source software they depend on,” explains Whitacre. Members of the Open Source Pledge are also required to publish a blog post detailing their payments to maintainers. “We need companies to be out there on their own blog, in their own voice, expressing their support for the Pledge and their participation in the Pledge to encourage other companies to do likewise,” Whitacre says. “It’s for accountability and awareness.” Having started just over a month ago, the Open Source Pledge has only two dozen or so members to date, mostly “smaller, developer-focused startups highly aligned with open source to begin with,” says Whitacre. The aim is to expand to larger enterprises, which might take some time. Looking to the future of open-source software, Whitacre hopes to see more approaches like what Drupal is doing, as well as a boost from both government bodies and the tech sector to steward open-source projects. “With the Pledge, we’re trying to get the money flowing right, but that’s only half the equation,” says Whitacre. “It’s a very important half, and it’s the part we need to start with and focus on right now. The other side of that is how do we make sure that money actually has the impact we want. We need to unlock this same kind of commitment from the whole industry, broaden it, and get other companies to join us.” *This article appears in the January 2025 print issue as “Open Source Has a “Maker-Taker” Problem.”* [careers newsletter](https://spectrum.ieee.org/) #### [Side Projects: Rekindle Your Engineering Passion](https://spectrum.ieee.org/starting-a-side-project) #### CMS Dek: Rekindle your career with projects outside of daily work [electric ships](https://spectrum.ieee.org/) #### [World’s Largest Electric Ship Begins Charging](https://spectrum.ieee.org/electric-boat-battery-ship-ferry) #### Hull 096 will ferry passengers using over 5,000 lithium-ion batteries [ieee member news](https://spectrum.ieee.org/) #### [Discover Data Manager Helps Foil Credit Card Fraudsters](https://spectrum.ieee.org/discover-manager-credit-card-fraud) #### The senior member’s AI tools spot diversions from spending habits [hyundai metaplant](https://spectrum.ieee.org/) #### [Hyundai's Metaplant Is Transforming EV Production](https://spectrum.ieee.org/hyundai-metaplant) #### In America’s most advanced car factory, robot dogs inspect welds [aquatic robots](https://spectrum.ieee.org/) #### [How Electromagnetic Fins Propel Robotic Swimmers](https://spectrum.ieee.org/underwater-robot-electromagnetic-fin) #### Novel fin design boosts aquatic agility [bioinformatics](https://spectrum.ieee.org/) #### [Why Scientists Are Hunting Moths in the Italian Alps](https://spectrum.ieee.org/lepidoptera-genome-sequencing) #### An expedition in the Alps unleashes advanced genome sequencing [robotics education](https://spectrum.ieee.org/) #### [Her Hands-On Robots Make STEM More Inclusive](https://spectrum.ieee.org/berry-hands-on-robotics-education) #### Carlotta Berry’s research and outreach support hands-on learning [humanoid robots](https://spectrum.ieee.org/) #### [A Challenge to Roboticists: My Humanoid Olympics](https://spectrum.ieee.org/humanoid-robot-olympics) #### A gold medal awaits the robot that can conquer doors, laundry, and peanut butter [volcano](https://spectrum.ieee.org/) #### [Portable SKATE System Enhances Volcanic Monitoring](https://spectrum.ieee.org/volcano-monitoring-stromboli-skate) #### The portable observatory is being incorporated in warning systems [geothermal energy](https://spectrum.ieee.org/) #### [New Geothermal Project Comes Online in Germany](https://spectrum.ieee.org/advanced-geothermal-germany) #### Startup Eavor says it reduced its drilling time by 50 percent, Open-Source Software Is in Crisis, spectrum.ieee.org, 01k9xk9559jaf59k3scafkyve4.