The ROI of Paying Open Source Maintainers  ## Metadata - Author: [[Lauren Hanford]] - Full Title: The ROI of Paying Open Source Maintainers - Category: #articles - Document Note: --- tags: - SoftwareSupplyChain - OpenSourceSecurity - PayMaintainers - Tidelift Author: [Author's Name] Source: [Website/Article] Reference: [N/A] date created: 2024-09-10 20:00 --- # Title: Why Paying Open Source Maintainers Matters: Lessons from the xz Utils Hack ## Table of Contents: - [Summary](#summary) - [Main Content](#main-content) - [The Problem with Volunteer Maintainers](#the-problem-with-volunteer-maintainers) - [Tidelift's Secure Development Work](#tidelifts-secure-development-work) - [Why Investment in Maintainers is Key](#why-investment-in-maintainers-is-key) - [Notes](#notes) - [References](#references) - [Paraphrase](#paraphrase) - [Newsletter](#newsletter) - [Action Items](#action-items) - [Hypotheses](#hypotheses) - [Methodology](#methodology) - [Questions](#questions) - [Future Research](#future-research) - [Implications](#implications) - [Logical Validity](#logical-validity) - [Conclusion](#conclusion) ### References: - "[Author's Name], [Source Title]" ## 📝 Summary: This article explores the security and trust concerns stemming from the xz utils backdoor hack and delves into the broader implications for the software supply chain. It argues that the solution lies not just in better tools but also in paying maintainers for their work. Tidelift, a company that contracts maintainers, ensures security and accountability by requiring maintainers to follow specific protocols and best practices. The article also highlights that without proper compensation and contracts, maintainers can become overworked, leaving critical software vulnerable. ## 📖 Main Content: ### The Problem with Volunteer Maintainers The xz utils backdoor hack raises concerns about the challenges faced by volunteer maintainers in the open-source ecosystem. Often unpaid hobbyists, maintainers are tasked with critical work they may not have the time or resources to handle. The xz maintainer mentioned that they were overwhelmed, which could have contributed to the vulnerability. ### Tidelift's Secure Development Work Tidelift’s model offers a solution by paying open-source maintainers to uphold secure development practices. These contractual agreements include multi-factor authentication, reviewing security vulnerabilities before they go public, and having security maintenance plans in place. By paying maintainers, Tidelift ensures accountability and enhances the security of the software ecosystem. ### Why Investment in Maintainers is Key Many in the open-source community argue that paying maintainers is not a silver bullet, but it is a necessary step. Without investment, maintainers burn out, vulnerabilities increase, and the overall quality of open-source software deteriorates. The article highlights the financial value of open source—estimated at $8.8 trillion—and argues that investing in its maintainers is crucial for the future of secure and reliable software. ## 🗒️ Notes - The xz utils backdoor hack has sparked conversations about the security of the software supply chain. - Tidelift's model focuses on paying maintainers for secure development practices. - The open-source community often fails to compensate maintainers adequately, contributing to burnout and vulnerabilities. - Open source software is valued at $8.8 trillion, yet maintainers are often unpaid. - Tidelift provides contractual security practices, improving the resilience of the software ecosystem. ## 📖 References: - "[Author's Name], [Source Title]" ## 🗣️ Paraphrase: 1. **Original**: "Maintainers review release managers every time a new release is made to ensure that those on the project with access to make releases are verified." **Paraphrased**: "Before any new release is made, maintainers conduct a thorough check of release managers to confirm they are authorized and verified for the task." 2. **Original**: "If the name of the game was fixing vulnerabilities, perhaps you could see this as a good thing. There are certainly people benefitting from more CVEs—but it isn’t open source maintainers." **Paraphrased**: "While increasing the number of CVEs might seem like progress in addressing vulnerabilities, the reality is that the people who benefit are not the open-source maintainers." ## 📰 Newsletter: 🛠️ **Securing Open Source: Why Paying Maintainers Matters** 🛠️ The recent xz utils hack has reignited conversations about the state of open-source security. Many volunteer maintainers are overworked and underfunded, making critical software more vulnerable. Companies like Tidelift are offering a solution by paying maintainers to uphold secure development standards. Investing in maintainers isn't just about compensation—it's about ensuring the resilience of the entire software supply chain. [Read more](#). ## ✅ Action Items: - Investigate how open-source security practices differ between paid and unpaid maintainers. - Explore models like Tidelift's that contract maintainers to implement secure development practices. - Assess the long-term impact of relying on volunteer maintainers for critical infrastructure. ## 🧪 Hypotheses: - **Hypothesis 1**: Open-source projects with paid maintainers will demonstrate fewer vulnerabilities and faster response times compared to those relying on volunteers. - **Hypothesis 2**: A lack of financial investment in open-source maintainers leads to burnout and increases the likelihood of security incidents, such as the xz utils backdoor. ### 📊 Methodology: - **Data Source**: Collect vulnerability data from open-source projects with paid maintainers versus volunteer-maintained projects. - **Design**: Conduct a comparative analysis of vulnerability frequency, patch response times, and long-term project sustainability. - **Analysis**: Evaluate whether paying maintainers reduces overall software supply chain risk. ### ❓ Questions: - How can companies effectively invest in the open-source ecosystem to ensure security and reliability? - What are the long-term consequences of failing to pay open-source maintainers? - How do financial incentives affect the adoption of secure development practices in open source? ### 🔮 Future Research: - Examine the effects of contractual agreements on the security of open-source software supply chains. - Study how increasing financial support for maintainers affects diversity and innovation within open-source communities. ### 💡 Implications: - Investing in maintainers can directly improve the security of the software supply chain, reducing vulnerabilities and associated risks. - A shift towards paying maintainers may lead to increased stability in open-source projects and long-term sustainability for critical software. ### ✅ Logical Validity: **Positive Reasoning**: - **Causal Reasoning**: The article makes a clear link between paying maintainers and improved security, arguing that financial support allows maintainers to implement robust security practices. - **Appeal to Facts**: It references specific security practices that are contractually required by Tidelift, demonstrating how paying maintainers can lead to measurable improvements. **Potential Fallacies**: - **Hasty Generalization**: The article implies that paying maintainers is a universal solution for open-source security without fully considering other systemic issues that may contribute to vulnerabilities. ## 🎯 Conclusion: The xz utils backdoor hack has highlighted the importance of supporting open-source maintainers to ensure the security of the software supply chain. While paying maintainers is not a complete solution, it is a critical step in addressing vulnerabilities and improving resilience. Companies like Tidelift demonstrate how financial investment in maintainers can lead to better security practices, ultimately benefiting the entire software ecosystem. - Document Tags: [[open source corporate contribution]] [[open source suppy chain]] [[xzutils]] - Summary: The blog discusses the importance of paying open source maintainers to improve software security and trust. Tidelift emphasizes paying maintainers for their work to ensure better software quality and security practices. Investing in open source and supporting maintainers can lead to a more secure and reliable software ecosystem. - URL: https://blog.tidelift.com/the-roi-of-paying-open-source-maintainers-in-light-of-xz-utils-backdoor As we continue to watch the attempted xz utils backdoor hack unfold, I’ve been following several conversations where questions are being raised about what this type of hack means for the software supply chain, and for security, identity, and trust. At Tidelift, for years our rallying cry has for years been to “pay the maintainers.” We believe this is an essential step in avoiding situations like xz where a volunteer maintainer who described themselves as an unpaid hobbyist was tasked with more work than they had the time or space to do. Yet some of this discussion reveals conflicting opinions about the effectiveness of paying maintainers for their work. Some have said that money is not the answer, or even part of the answer. A few examples of exchanges that caught my eye: [](https://www.google.com/url?q=https://twitter.com/ag_dubs/status/1775906345423626593&sa=D&source=docs&ust=1712583514568435&usg=AOvVaw2aCTxRnlpE_ALTwQzHTm_H)[Tweet from Ashley Williams](https://www.google.com/url?q=https://twitter.com/ag_dubs/status/1775906345423626593&sa=D&source=docs&ust=1712583514568435&usg=AOvVaw2aCTxRnlpE_ALTwQzHTm_H) [](https://www.google.com/url?q=https://twitter.com/ag_dubs/status/1775907065241682405&sa=D&source=docs&ust=1712583514569056&usg=AOvVaw2vDtVpUGR1F9mQH7BeVpGS)[Second tweet from Ashley Williams](https://www.google.com/url?q=https://twitter.com/ag_dubs/status/1775907065241682405&sa=D&source=docs&ust=1712583514569056&usg=AOvVaw2vDtVpUGR1F9mQH7BeVpGS) My colleague Luis Villa pointed out in his post about xz earlier this week that [paying maintainers should not be viewed as a magic bullet, but instead a cornerstone](https://blog.tidelift.com/xz-tidelift-and-paying-the-maintainers) of efforts to improve the security and resilience of open source. I’d like to outline the guaranteed, measurable benefits that Tidelift’s customers receive from using our software throughout their entire development lifecycle. Customers using Tidelift’s software to implement unified software supply chain policy and practices get the result of better software, and the maintainers developing their software are certified and paid. You can read more about what our software does, and how it works [here](https://tidelift.com/subscription). ### Paid, contracted secure development work Here is what is in [our agreement with every single maintainer partner](https://support.tidelift.com/hc/en-us/articles/4406309657876-Lifter-agreement). These are all explicit, contractual promises that maintainers make about their projects that customers can count on, when they are paid by Tidelift. * Multi-factor authentication is turned on. * Security policies and procedures are in place to ensure maintainers are notified of vulnerability reports before they are made public. * When a security vulnerability is reported, it is reviewed, a fixed release will be made (unless it’s determined to be a false positive), and a post-mortem review will be provided with context-specific details, available workarounds, and other critical data that saves engineering teams time and money. * Maintainers review release managers every time a new release is made to ensure that those on the project with access to make releases are verified. * There is a security maintenance plan in place, so customers can plan for the end of software’s life and know when security fixes will no longer be available. In many cases, our maintainers are willing and able to backport security fixes to older release streams—because they take the security of our customers seriously. * Maintainers commit to giving us at least 30 days notice when they decide to [stop their work on a project](https://explore.tidelift.com/the-tidelift-maintainer-advantage/case-study-sockjs-pd?__hstc=96826650.00d059d0a033fa864bf50be315bf129a.1636244870404.1712324712114.1712340850993.927&__hssc=96826650.3.1712340850993&__hsfp=1717932986). #### Multiplicative benefits Maintainers receiving reliable income often are able to go above and beyond the list above to add even more security to their projects, and to the ecosystem. These are just a few examples: * Catching critical invisible security issues like [leaked passwords, tokens, and other secrets due to attacks on the toolchains in use](https://blog.tidelift.com/urllib3-part-1). * Adding co-maintainers to projects to ensure they have backup and improve health, stability, and longevity. * Expressing willingness to take on [emerging security practices like SLSA](https://blog.tidelift.com/not-all-open-source-work-is-equal)—with commensurate income for that additional labor. * Giving [secure development templates back to the community](https://github.com/sethmlarson/secure-python-package-template) to make secure development practices easier to adopt. * Increasing the diversity of contributors and ideas by writing clear documentation and giving mentorship to the next generation of maintainers that we need to drive the global economy. #### Why is this worth investment? I’m going to make this really simple: As Ashley Williams points out in her comments above, when it comes to the open source software we use to build our businesses, we’ve become “entitled AF.” We expect volunteer open source maintainers to deliver as enterprise suppliers, but it is a contract that maintainers neither signed nor agreed to. Our collective actions are speaking louder than our words. We’ve [rated their performance](https://web.archive.org/web/20240331024907/https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/) against secure development standards without considering what resources it takes to meet those standards. We show up in their issues [demanding fixes](https://twitter.com/ffmpeg/status/1775178803129602500). We [repackage those fixes](https://edu.chainguard.dev/chainguard/chainguard-images/faq/#what-does-chainguard-do-when-a-cve-is-published-but-a-patch-is-not-available-from-the-owner-of-the-oss-code) and sell them as [secured open source](https://sethmlarson.dev/google-assured-oss), without compensating the creators. In place of [actual contractual agreements with maintainers](https://www.softwaremaxims.com/blog/not-a-supplier) to pay them for work delivered, we’ve built up an entire industry around scanning and remediating vulnerabilities in their code. [](https://www.f5.com/labs/articles/threat-intelligence/the-evolving-cve-landscape)[CVE chart](https://www.f5.com/labs/articles/threat-intelligence/the-evolving-cve-landscape) The chart here shows the number of CVEs published in the National Vulnerability Database each week since 2006. Since 2017, the number of reported vulnerabilities trend is clear. If the name of the game was fixing vulnerabilities, perhaps you could see this as a good thing. There are **certainly** people benefitting from *more* CVEs—but it isn’t open source maintainers. Let me be clear: the current model of running scans to look for known CVEs in open source code **is not working**. The idea that we should just continue patching things until we burn out the people that are creating the patches in the first place, and then just move on to another replacement package is an embarrassing, and inefficient, strategy in 2024. Don’t we ultimately want more secure, more reliable software? When software is more secure and reliable, it has *less* risk. If you are building software on top of open source that delivers revenue-generating value to customers without investing time, energy, or money to ensure that your end-to-end code is safe and reliable — you are taking unnecessary chances with your customers’ data and adding risk to your business. If your take is that any open source maintainer seeking reliable income should re-license or abandon their project, I would encourage you to review the [data Github provides on maintainers seeking sponsorship](https://github.com/search?q=is%3Asponsorable&type=Users), and hold that list up against any enterprise application dependency graph. All maintainers seeking income for their work essentially walking off the job is not a realistic solution. Investing in open source doesn’t need to be complicated. If you need to unify your approach to software supply chain security throughout the development lifecycle, CI/CD, and internal organizational policies — [Tidelift’s software does this](https://tidelift.com/subscription). If you are running an operation that could benefit from data to comply with attestation requirements, [Tidelift’s software does this](https://tidelift.com/subscription)— and we’ll pay for that data that you won’t acquire otherwise. All of our customers receive maintainer impact reports on what their money is achieving, and they are **seeing results** in their application risk posture. A recent Harvard Business School paper estimated [the demand-side value of the open source software ecosystem at $8.8 trillion](https://www.hbs.edu/ris/download.aspx?name=24-038.pdf). By comparison, the entire U.S. electrical grid is valued at [1.5- 2 trillion dollars](https://energy.utexas.edu/news/old-dirty-creaky-us-electric-grid-would-cost-5-trillion-replace-where-should-infrastructure), and the U.S. interstate highway system is valued at [750 million dollars](https://www.washingtonpost.com/business/2022/07/15/diversity-statues-highways/). Open source software is an exceptionally valuable resource, and we shouldn’t take it—or its creators—for granted. [Technology problems and data risks](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9409667/) are accelerating around us, and we will not meet these challenges without open source maintainers. They are providing the bedrock of maintenance needed to continue our progress as a civilization. [Watch a demo](https://tidelift.com/video/tidelift-validated-open-source-package-intelligence-demo) of how our partnered maintainers opt into your software supply chain, and how our superior resulting data drives better open source software supply chain security, and [come join us for a conversation](https://upstream.live/register) about new ideas for how to improve open source software security and resilience at Upstream on June 5., The ROI of Paying Open Source Maintainers, Lauren Hanford, 01hv1gnrmyp7s0y0ys8rs1mze5.