Underfunded PHP Tools: A Global Business Threat   Welcome to a new episode o**f Open Web Conversations**. This time, host **Anne Bovelett** invites **Juliette Reinders Folme**r, the sole maintainer of **PHP\_CodeSniffer**, for a deep and honest conversation about the invisible foundations of the internet. If you use online banking, submit an insurance claim, or manage a website, you’re relying on PHP. And chances are you have Juliette Reinders Folmer to thank for the stability of the code behind it. In this episode, Anne and Juliette explore why maintaining “unsexy” but essential open source projects is so difficult and discuss the global risks when they don’t get the support they need. They talk about the importance of funding, the dangers of understaffed projects, the real issues with overreliance on a single maintainer, and how AI is affecting software development. If you care about the health of the web or want a glimpse into the pressures and joys of those who keep the internet running, you won’t want to miss this episode. Find out why it’s time to recognize and support the unsung heroes behind the code that powers our everyday digital lives. **Thanks to our sponsor *[GoDaddy](https://www.godaddy.com/en-in/airo)* for supporting this show.** **Takeaways** * **PHP Is Foundational but “Boring”:** Anne Bovelett highlights that PHP powers nearly three-quarters of the internet, yet it’s often dismissed in favor of newer, flashier technologies. * **PHP\_CodeSniffer’s Massive Impact:** The project Juliette Reinders Folmer maintains, PHP\_CodeSniffer (PHPCS), checks and improves the code for around 60% of PHP online, touching everything from hosting services to banks and popular CMS platforms. * **Single Maintainer Risks:** With Juliette Reinders Folmer as the sole maintainer, PHPCS is vulnerable; the absence or burnout of a single person could have consequences for the global web ecosystem. * **The Hidden Work in Open Source:** Open source projects depend on a relatively small group of dedicated, often older contributors. Bringing up new maintainers requires significant training and investment. * **Funding Is Critically Lacking:** Most support comes from a handful of companies. While appreciated, current funding is not sufficient to ensure the project’s stability or growth. * **Why PHPCS Is Special:** PHPCS doesn’t just detect code issues. It can automatically fix many problems, making it a core tool developers trust, but also making security even more important. * **Security & The Supply Chain Threat:** If PHPCS is compromised and distributes malicious code, the effects could be devastating, as recent incidents like the Exegol attack have shown in the open source world. * **Open Source Is Not Free Labor:** There’s a myth that open source means free, voluntary work, but maintaining, reviewing, and improving code is demanding and deserves financial support. * **AI: A Double-Edged Sword:** Large language models can generate lots of code, but their output often contains errors, licensing headaches, and extra work for maintainers, making AI-generated contributions far more costly to review. * **Urgent Need for Succession & Funding:** To remain sustainable, PHPCS and similar projects need consistent funding, new maintainers, and organizational help from companies and governments that depend on them. * **The Joy in Open Source:** Despite the stress, Juliette Reinders Folmer finds satisfaction in catching bugs and seeing her hard work prevent real-world problems. * **Call to Action:** Companies and organizations benefiting from PHPCS are encouraged to provide funding, project management, or government support to ensure the project’s survival and health. **Mentioned Links and Resources** * **Open Collective & GitHub Sponsors for PHP CodeSniffer** – Support PHP CodeSniffer’s ongoing development and maintenance via Open Collective or GitHub Sponsors. <https://opencollective.com/phpcodesniffer> <https://opencollective.com/php_codesniffer> <https://github.com/sponsors/PHPCSStandards> * **Thanks.dev** – A platform where you can financially support open source maintainers, including PHP CodeSniffer. <https://thanks.dev/package/squizlabs/php_codesniffer> <https://thanks.dev/> * **PHP\_CodeSniffer** – The project at the heart of this episode, helping scan and fix PHP code for issues and compatibility. <https://github.com/squizlabs/PHP_CodeSniffer> * **PHPCSStandard**s – Community-led standards for coding with PHP\_CodeSniffer. <https://github.com/PHPCSStandards> * **Juliette Reinders Folmer (JRF**) – Connect with Juliette, the maintainer featured in this episode. GitHub: <https://github.com/jrfnl> LinkedIn: <https://www.linkedin.com/in/julietterf/> Mastodon (personal): <https://phpc.social/@jrf_nl> Mastodon (PHP\_CodeSniffer): <https://phpc.social/@phpcs> X/Twitter (personal): <https://x.com/jrf_nl> X/Twitter (PHP\_CodeSniffer): <https://x.com/PHP_CodeSniffer> **Timestamped Overview** * 00:00 “Open Source Maintenance Challenges” * 06:39 “PHP’s Role in Everyday Tech” * 08:06 “Call for Broader Sponsorship” * 12:37 “Project Sustainability and Maintenance” * 14:01 “Becoming a Thoughtful Maintainer” * 19:27 “Exegetils: Backdoor Linux Threat” * 25:29 “AI Training and Open Source Ethics” * 26:17 “Viral Licenses and Relicensing Issues” * 29:35 “AI, Trust, and Problem-Solving” * 33:33 “PHP Compatibility Detection Tool” * 37:51 “Open Channels FM Overview” * 40:27 “Seeking EU Funding Expertise” * 42:08 “Preparing Open Source Succession” Episode Transcript Anne Bovelett: Hello, welcome to Open Channels fm. My name is Anne Bovelett and usually I talk about accessibility and the ROI on that and how you should make the web accessible to everyone. But you know what? Today we’re talking about something different. 70%. I should say 72 because my guest is definitely going to correct me on that. 72% of the entire Internet runs on something that is considered boring. Php. 60% of that php is being checked and improved by a project called PHP\_CodeSniffer. With me today is Juliet FoFolmer Reiners. I hope I say it correctly. I do it. I said. I always remember JRF. Welcome to Dyslexia, folks. Juliette Reinders Folmer: Well, JRF and it’s Juliette Reinders Folmer. But you’re right, I mean, at the end of the day most people just know me by my nickname anyway. Anne Bovelett: There are a lot of people who don’t yet know who you are, Juliet, but what people should know is that if you decide to go on a long vacation, we might have a problem at world scale. And this is the reason why I asked you to come and talk at Open Channels fm. So we get a lot of people to hear what you have to say about this. Because if the project that you are maintaining has to step on the brakes, hosting companies will suffer, banks will suffer, insurances will suffer. It’s unimaginable what will suffer if what you are doing is either stepped on the brakes or is being compromised. And we’re talking about a problem at a scale. You think the cloudflare outage was a problem? You have no clue. Now that sounds icky, huh? Welcome Juliet. Juliette Reinders Folmer: Thank you very much for that absolutely amazing introduction. I mean, I don’t feel that the impact is that direct, but that is largely because like most of open source, even if nobody touches it anymore, it will still continue to keep working for at least a little while. So until at some point, you know, something in the wider ecosphere changes, it will continue to work and people will not even notice that I’ve gone on holiday until it doesn’t work anymore. But by then the backlog will be so huge that it’s really, really, really hard to get through and to be able to pick up again where I left off. So yes, it is definitely something which needs a lot of attention and the risk of if something malicious would happen with some of the codes, which I maintain. Yeah, that’s another matter. Anne Bovelett: Yeah. So I think, Juliet, maybe we should start with you telling the audience what your background is. How did you roll into PHP and this incredible knowledge that you spread. Juliette Reinders Folmer: Oh hell, sorry, I barely know how to start to answer that question. Anne Bovelett: Well, I remember we were talking just before. Okay, so for the audience, we actually have a problem. Currently in open source there’s a lot of old people. And the thing is, both Juliet and I are considered old people. We’re both past 50. We’re not old, but you know, in our spheres we’re old people. And we were just talking about the two. The Y2K, was it called Y2K problem, the 2000 problem and a language called COBOL, which is almost as big as PHP is. And people were seriously worried, and rightfully so. Nobody had ever thought through that three zeros in a software that ran I don’t know how many systems, especially salary systems, would be a problem. And we’ve all been sitting there and sweating. And this folks, this is 26 years ago. Juliette Reinders Folmer: In 11 years time we’ll have the next one, the next year 2000 problem, because then we the most of the time. Well, in a lot of systems time is represented as a timestamp, which is seconds since 1st of January 1970. Ah, right, yeah, that field runs over in 2037. And then again we have the same problem as we had with year 2000, that database columns which have a certain width will not be wide enough to hold the new value and therefore everything will break again. Anne Bovelett: Oh, this one is fun. When, I mean, when you think this sounds really geeky, maybe it won’t know your way around Excel or Google sheets and then you put in too many numbers and suddenly all you see is dashes. You know that. Well, the info is still in there, but if it doesn’t fit. Yeah, or those password fields it says that say no more than 12 characters. Chicky. Yeah. So what I’m trying to do today in our talk is Juliet is highly skilled in the technical part and I’m trying to make a translation to what others who are not so technically who are not so technical, understand. So one of the things you need to understand is that if you use a banking app, there’s PHP involved. If you are going to the website of your insurance company because you want to lay a claim, there’s PHP involved. And there’s one thing in open source, we are living much in the world of WordPress, the WordPress bubble. That’s the community that we hang in the most, especially me. I don’t know, I think Juliet hangs out in a lot of different communities as well. But there is so much more. And now here’s the thing, this is open source and this is an old language and therefore people think it’s not sexy because it’s not the next new shiny framework. Speaking of frameworks, we’ve all seen the big scare that we had with Tailwind css, right? Oh my. The whole world was on its toes. Tailwind, Tailwind. They’re in trouble. And they were and maybe still are, but I think they’re in less trouble now. And it was fantastic to see how so many companies outside redbubble, jumped in and were like, we have got to fund them. We have to make sure that they’re still there. Because there are many projects, very shiny projects, depending on Tailwind, which is a fantastic product. But. But if the product that Juliet works on stops in its tracks, it doesn’t matter what shiny framework you use, what shiny component library you have, it doesn’t matter because the cracks are going to come. And I know I sound like Doomsday, it’s a whole different episode this time than I normally do. But really, I think the world needs a wake up call and the world needs to understand that it shouldn’t always be the same five, six companies, wonderful companies within the WordPress ecosystem, for example, to fund projects of this importance because it’s always the same people and so many of them are like, rightfully so. We sponsored enough. We’re sponsoring so many things. Thank you GoDaddy, thank you automatic and thank you all the other sponsors that do their due diligence financially for PHP\_CodeSniffer. But it’s a drop on the plate. Okay, Sending people into this project, that’s kind. But then you’re asking Juliet, can you train my people for free? And that’s not right. And if we do that, Juliet is going to want to go on a long vacation much sooner. Right. And I know I’m bringing this with a laugh and a smile, but the reason we’re talking today is it is important that people understand that this project is so important. If it stops, we are in trouble up to our hips. Juliette Reinders Folmer: Yeah. To illuminate what you are saying, because I completely agree with what you’re saying is the technology which I’m working on is not sexy. And the technology of similar tools like CSFixer or PHP Stan or PHP Unit, it’s not sexy. These are tools used by developers and they’re running in the background most of the time. You don’t hear them, you don’t see them and that’s perfectly fine. That’s good. When you don’t hear or see them, because that means your code is working correctly. And it’s only when you hear them, but you hear them at a moment when you don’t want to hear them, like, hang on. But it’s now flagging something which it shouldn’t flag. When people start complaining and are unhappy with the tooling and start shouting very loudly, it doesn’t work. Anne Bovelett: Yeah, exactly. So for those not so technical, let’s keep this fun for you guys and girls as well. What PHP\_CodeSniffer does. So code is being written and PHP sniffer, it’s a sniffer, it’s sniffing the code to check if there are issues, problems, security issues, other glitches. And the thing that makes this software so unique is it writes the fixes. That is the only application currently that does that. And I know there are other similar applications, Juliet can tell you about them, but I already know that they can only do one third of what PHP\_CodeSniffer can do. And people trust this software blindly. It’s almost like people are treating ChatGPT, here’s my code, go fix it. But ChatGPT usually doesn’t fix it very well. But that’s another story. Juliette Reinders Folmer: And this too, just to intersect in this. A number of years ago we did like a really, really, really, really, really big patch to WordPress. At that time, the biggest WordPress core patch ever. We rewrote in one commitment over a hundred thousand lines of code. That was the code when code PHP\_CodeSniffer was finally being enforced for WordPress. Juliette Reinders Folmer: That was the biggest core patch ever. And believe me, nobody has reviewed those hundred thousand lines. Anne Bovelett: No. Juliette Reinders Folmer: Wow, spot checks. Yes, but nobody’s reviewed all on the thousand. Anne Bovelett: No. And, but this is, this is one of the reasons why this project is so important. Right? And it’s not just, just WordPress, it’s so many other systems as well. And one of the things we do need to worry about is I know you are currently the sole maintainer of this project and if it were my company, I would be very worried about that. I would never put one key person on a project of that significance. I would put in a lot of money to train people and I think you are open to training people, but you’re not going to do it for free. And why would you? Juliette Reinders Folmer: And it’s also the people need to be open to coaching, to being trained. There’s people who will just want to scratch their own itch and just send in a bug fix and expect you to commit it even if it’s not right. Sorry, no, I will not do that. There are also people who just, you know, will contribute in multiple places and multiple times, but only again to scratch their own edge. Anne Bovelett: That’s a logical thing that this happens. Juliette Reinders Folmer: But it’s not how I started as well. But to become a maintainer, you need to do more. You need to also want to do the grunt work. You need to also want to really understand how things work and think about, okay, if I want to create a new feature, how should it look from an architectural point of view so it can be maintainable for the future, can be expanded upon for the future, not just say, oh, but it works. We’ve been using this in house in our company for a while. It works for us. So you should just accept it. And taking into consideration the amount of users, the amount of projects which depend on this project, it’s not just your company, the fact that it works for your company, great, keep using it, but don’t expect me to maintain it. If the logic you’ve used to create this feature is something I cannot explain to the majority of users because that maintenance burden, that support burden of all the users asking. Yeah, but it doesn’t work the way I expect it to falls on me. Anne Bovelett: Yeah. Juliette Reinders Folmer: So unless I feel it’s a logical way to do it, and it’s something I can explain in the simplest terms to the most junior end user, I will not accept your feature. Anne Bovelett: Yeah. And I mean, if there were five or six of you, none of you also the five or six people would not take on that feature, but you would have less of a burden explaining that to people. Juliette Reinders Folmer: And with five or six people, it would also help, you know, to coach something to something which is explainable is a lot easier if there’s five, six people having that conversation. Anne Bovelett: Yeah. Juliette Reinders Folmer: Or, you know, one person having that conversation on topic one. One person having that conversation in topic two, instead of all of it coming down to the one person who is there, who is me at the moment. It’s not just Coach Sniffer which has this problem. I mean, a lot of the big projects in the PHP world are largely dependent on a single maintainer. Or sometimes they might have a small team, two, three people. But even then there is always elites. And if that lead would fall away, it would be very problematic for most of these projects. Yeah. Anne Bovelett: It’s like. It’s like I can’t remember his name now. One of the singers that sings, you don’t know what you’ve got till you lose it. Anne Bovelett: Right. And normally I don’t like to come from fear and from no. But really? In this hour? I really want to scare your pants off folks, because you should be worried about this. Because right now, if I understood you correctly, and I’m only talking about the public projects here, there are between 300, 500 projects, 500,000 projects, depending on this software, depending. Now imagine Juliet has the key to the castle and she told me it took eight years until anyone allowed her to even commit. And committing for those who are not so technical means you change the code and you are allowed to add your changed code to the system. Juliette Reinders Folmer: Before that you have the right to propose changes, but someone else takes the decision. Commit rights means you have the right to take that decision and also to take the decision about code other people propose. Anne Bovelett: Now imagine people, more people are needed. Funding for this project is desperately needed. People who are maintaining big projects like this shouldn’t be begging to get sponsorships. People should be coming in by the herds and say, here, take my money and maintain this. We’re all using it. But you know, it’s like that and, and I just hope we don’t have to experience what it’s like when the day comes and it is too late. Because the thing that we all need to worry about is because this is so much in the background, it’s not as present as something beautiful and shiny. We don’t realize what happens if the wrong person gets his or her fingers or their fingers on the keys. Because if an update with code that can hack backdoors into whatever systems is rolled out, even if it’s happening seven wise, drop wise, I think you had, you’ve experienced that it happened, right? Juliette Reinders Folmer: Exegetils. Exegetils was tool intents and purposes not proven, but very, very, very likely. State sponsored attack on Open source where someone started proposing changes those weren’t being merged quickly enough because the maintainer was overwhelmed and overworked and not paid. So then there was community pressure, but that community pressure were most likely sock puppets. The sock puppets are fake accounts. Fake accounts from that same person who proposed the changes saying can you please merge this? So that person then got commit rights. And then very slowly, over a period of two years, they put in little bits of very innocent looking coats which together were the building blocks for something which became a backdoor into Linux. And it was only called just in time before it ended up on every Linux server in the world. Now CodeSniffer is not Linux, but CodeSniffer does rewrite the code of the projects it scans with its fixer. So depending on which NIFs you have running. If someone would add malicious code in one of those fixes, as in would make that fixer write malicious code into your project. We just discussed, you know that patch to WordPress was 100,000 lines. Nobody actually reviewed that 100,000 lines. So if presuming that most people do review, say 80% do review, 20% don’t, that still means that 20% of that 500,000 PHP projects, and that includes projects like Magento, Drupal, WordPress, Typo 3, all of those use CodeSniffer. Literally all of them. So all of those projects could that way accidentally get a backdoor. And of course you hope that enough review is being done and you hope that people will catch that before it becomes a released version. And more than anything, I hope it will never happen and that I will catch that before it even enters PHP\_CodeSniffer. But it does mean that I have to be extremely careful and really, really validate my trust in people before I give someone else commit rights, right access to this project. Anne Bovelett: And you know what, if you’re working for bigger companies, or even if you own a bigger company that has a lot of responsibilities, the first thing you do is vet someone. And then you know how hard and how complex and how expensive it is to throw thoroughly vet someone. And this is something I do know about. I’ve been a recruiter at High Level for eight years. Vetting was the best part of my job. But that’s a whole other story. Anne Bovelett: So now I know a lot of people think, yeah, yeah, yeah, open source. All these people are crazy. They’re working for free. Juliette Reinders Folmer: And we are crazy. And I literally mean that in a lot of ways we are crazy to still believe in the old time economy when a lot of we all realize that the world doesn’t run without voluntary work. Except nowadays there’s so much pressure on, you know, everyone needs to have both people in a couple working. The economy needs to run and make more money. Make more money, make more money. That voluntary work, which used to be about 60% of the economy, is being marginalized at the same time. The work isn’t gone. The work is still there. Anne Bovelett: And this is. Correct me if I’m wrong. Can you explain a little bit about that? About. Because people are going to say, yeah, it’s all old stuff. I can take over all. Juliette Reinders Folmer: Yeah, okay. Yeah, right. And please let AI take over, because it’ll guarantee work for me for the rest of my life. More subtle, but than any human can. And most of the time it makes so many mistakes that, yeah, it just means I have work for life. Anne Bovelett: Yeah. Yeah, me too. I just said that to someone like, oh, man, I pray for the day AI puts me out of a job. I wish. I’m going to go back to painting again. Juliette Reinders Folmer: Yeah, but if we’re talking about open source and AI, let me put this to you. AI is trained on what? On most source code. It’s. It’s trained on open source code without asking permission, without giving credit to the original authors of the code. In other words, the ethical question here is do we accept theft as a legitimate way to make money? Because it’s literally theft what’s happening. And worse than that, if you then go take it one step further and look at the legal side of things. The code I’m maintaining with CodeSniffer has a license called BSD3 that’s a very open license. You can do all sorts of things with it. There are also licenses which are more restrictive or what they call viral licenses. If you use code from a viral license, your code also has to become licensed under that viral license. So now if that AI is trained on code with that viral license and uses that code in some way or other in a patch which gets submitted to CodeSniffer, CodeSniffer has a legal problem because I would need to Relicense a project which is over 20 years old to this viral license, because that’s what the FYL license demands. But to Relicense an existing project which is open source and licensed under certain terms, I need permission of every single contributor who’s ever contributed to the project. Anne Bovelett: That’s impossible, right? Juliette Reinders Folmer: Exactly. In other words, unless you can guarantee that the AI you’ve used to create your patch has not been trained on code which has proprietary lies, as in closed source code or code which is under firewall licenses, as in, can you guarantee that the licenses of the code this AI is being trained on are compatible with the license of the project you’re trying to contribute to. I cannot accept it because I’m opening myself personally to the legal risk. Anne Bovelett: Yeah, that. But it’s also. People also think that if they forget about it, people are ruthless, you know, they don’t care. It’s the same with music. I mean, everybody loves Suno, and I cry every time I hear a Suno project because I’m a musician’s daughter and I’m a musician myself. So I feel people have been stealing from us forever. But it’s also the people who believe that they can solve their PHP problems with AI. This is why I called out. It’s being trained. The LLMs are being trained on crappy code. And I can attest to that. It’s not only PHP. I mean, even something as simple as 50 semantic HTML elements, I love those developers on Twitter that are like, hey, look at my 365 day streak on Duolingo. Amen. But you can’t remember 50 semantic elements. Come on. Juliette Reinders Folmer: What I saw was even. And sorry, I don’t make fun of some specific person, so I’m not going to name names, but I had such a laugh when there was this person saying, oh, I’m using LLM’s AI to create a WordPress plugin and doing that in public and doing it while live blogging on social media, look at me going, and it’s going so well and I’m doing fantastic. And now it’s published two days after I started and it’s fantastic. One day later, sorry everyone, for the security breach. Juliette Reinders Folmer: And live blogging, the total panic about the security breach. I mean, it’s all nice and dandy, the AIs and large language models. The whole point is if I want to find the best solution for something, and I’m not 100% sure myself, because of experience, I will read like 10 blog posts and some stack overflow and some manuals and I will combine that knowledge to the best solution. And that includes that I combine my experience with do I trust this source or don’t I trust this source? Or how much value do I put on this answer? Does the reasoning which is outlined in this answer resonate with me as something which is correct, or does it resonate with me as someone who doesn’t know what the hell they’re doing? I can judge that because of experience and I combine that knowledge to find the solution which is right. With AI, you get one solution and the AI will insist it’s correct. And no, there’s nothing wrong with that code. Yeah, you don’t actually learn what you don’t learn the reasoning. You don’t understand it most of the time, okay, There are really experienced devs who use AI to go faster and I can understand that. But most of the time, most of the people using AI use it because they don’t know what the hell they’re doing and they’re not going to learn what source to trust and what not if they use AI. Anne Bovelett: Yeah, and I know that you are very eager to teach other people to share your knowledge, but it has to have a good solid financial foundation. Juliette Reinders Folmer: Talking financials. Literally the cost of AI for me to review an AIPR is 10 times higher than the cost of me reviewing a normal pr. Anne Bovelett: Yeah, well that’s, I mean that is crazy. And just to put it the other way around, for example, a hosting company, right, the next big PHP version is coming and open source CMSs and even closed ones are saying, ah, we’re not, you know, we’re finally done supporting, supporting PHP 5.4. I mean, hello, that’s like Ms. DOS under PHP, okay? Now if they have to decide, you know, sometimes you have to choose between sitting it between a rock and a hard place, right? And I think as a hosting company, that’s. We’ve been talking about that before because we had a nice long talk before and many talks before that. You want to know what your risk is, you want to get an estimate. So what if I now just upgrade everyone away from 5.4 and I’m upgrading them to, well, let’s be courageous, 7.3. I know we’re at 8.4 now, but, right, this is how things go. The forums explode, social media explode. Look at what my host did. My site went down because I didn’t update for WordPress for the last 10 years, but who cares? It’s happening. And then this is an incredible cost on the support desk of a hosting company. This is the cost they’re looking at. It’s not their server, it’s not the gigabytes, it’s not the processors, it’s not even the power they’re paying for, it’s the people. And using a tool like CodeSniffer saves them literally from hundreds of thousands and if they’re larger, even millions over the years. And I really want to appeal to anyone listening, put your money where your. Juliette Reinders Folmer: Mouth is, Support this project to make sure that people don’t say, like, don’t go and say, oh, but what you’re saying is bullshit? No, something like PHP compatibility, which is an external standard built on top of PHP\_CodeSniffer can detect whether code is, can detect in 78% of all cases where the code is compatible with certain PHP versions by running that on a server which, where the PHP version is going to be upgraded for hosts, can detect whether, which customer is going to have a problem. So this is what we’re talking about. It’s not, you know, just the fact that code sniffer exists and that the code style looks good and that a certain bug gets found by the scans before it makes it into production. Now it’s, it’s actually you can scan a whole server and figure out, okay, which code is going to have a problem when we upgrade this to a different PHP version. And these kind of things are facilitated by PHP\_CodeSniffer. Anne Bovelett: This, I mean, this is. So you know what I’m thinking right now? You’re maintaining this all by yourself and people are putting everything on your shoulders. And one of the things that suddenly came to my mind is what if people are like, okay, we want to support this, why don’t we ask them to come with a plan, with a financial plan for you, so let them do that. Because you’re busy enough as it is doing that work. I know you’re doing it from morning till evening, and, and. Juliette Reinders Folmer: And, and there’s people contributing. It’s not just me, but I am the, the sole maintainer. Yes. And that’s also why, why things like, like fundraising is yet another burden. Because it also comes down to me and it’s a completely different skill set. I, I’m not marketeer, I’m a developer, basically maintain a time in open source. Maintainer time is the scarcest commodity of all. And a maintainer needs to be very, very selective. What do I want to spend my time on? And that’s another problem with AI. It wastes maintainer time. Even just closing them and having to check, oh, this is AI Close is wasting maintainer time. And maintainer time is the scarcest, most valuable commodity in open source. Anne Bovelett: Yeah, how so? So how much? If you, if you could train five people who are really interested in doing this, who know they’re also going to get paid for doing this, and you had to train five people, how much money would you need? Did you ever think about that? Because otherwise we’re going to send this question out in the world to all these fancy CEOs who are really good at calculating these things. CEOs, CFOs, why don’t you folks calculate what that cost? Juliette Reinders Folmer: Well, I haven’t calculated it based on a number of people. I have calculated like what it would need to have continuous maintenance of CodeSniffer in a structural fashion where those people will do the. The actual. The bulk of the actual work can get paid and it’s about half a million a year. Euros. Anne Bovelett: That’s not much. Juliette Reinders Folmer: No, but we’re nowhere near much. Anne Bovelett: That is not much. Juliette Reinders Folmer: Nowhere close to that at this moment, funding wise. Anne Bovelett: No, but I mean you’re not asking for 5 million bucks. No, I mean you. The project would thrive if you had a million. Yeah, but, but given the number of. Of companies that, that depend on this and it, you know, really. I know. You know, Open Channels FM originates from do the Woo. By the way, did you hear that do the Woo has been resurrected as a podcast? Juliette Reinders Folmer: I did hear something about. Anne Bovelett: Yeah, James Kemp and Katie Keith. They had the first episode. They invited Matt Mullenweg last week to speak about WooCommerce and. Yeah, but at Open Channels FM we are more venturing out into the open source world. Broad. I mean, everybody knows us from WordPress, but come on, there’s so much more and this is a worldwide thing. So I think it would be great if people would come and I mean, maybe Juliet doesn’t want to talk to everybody because she’s too busy. They can also come to me. Don’t worry, I’ll filter them for you. Juliette Reinders Folmer: That would be very much appreciated. Yeah. I generally try to make time for people who want to help the project. I really do try and I will jump on video calls, but the one thing which I do find problematic with that is the amount of times I jump on a video call with someone who is extremely enthusiastic and then doesn’t do any. Anne Bovelett: Yeah, but this is, you know, I think this is. This is a catch 22 because I think you need the funding and some serious project management skills. People with that behind this project to carry this for you. Because you can’t do all that. You’re going to burn out if that happens. And that’s the last thing we want to happen. Right. So. Yeah. So how can people reach you? How can they find you? Juliette Reinders Folmer: I’m on all sorts of social media. I’m on the Mastodon primarily, both with my personal account as well as the coaching for account. Yes, similar. I’m on X both with a personal account as well as a Coach Never account. And yes, I do not approve of X anymore, but the follower people who follow me are still there. So I do want to Give them the information about Coach JFR. Anne Bovelett: Yeah, it’s J R F. Yeah, you. Juliette Reinders Folmer: Know what, I’ll send you all the links in a minute and then you can post them in the show notes. Yes, including the Open Collective and the GitHub sponsors links which are obviously available for Coach Sniffer to fund Coach JFR and for those people who use. Thanks staff. Yes, we’re on thanks Dev too. Anne Bovelett: Yeah, that’s wonderful. And also I would like to call out to anyone who knows how to organize EU funding, government funding, because it’s also tax systems that. And governments that run on php, especially in the Netherlands. I don’t know about Germany, but in the Netherlands a lot of people switch to open source. So this is not just a commercial thing, this is a social thing that affects us all. So if there’s someone who says, hey, I know how to approach the EU or whatever for funding, come and find us. Juliette Reinders Folmer: Yeah, I’ve looked at some of the forums like for sovereign tech and everything and the amount of time you need to spend on, on writing all of that up is quite a lot. Then there’s always some clauses why you don’t qualify. Anne Bovelett: There are specialists for that. And so my call is to those who can support with that getting the funding, getting the support, getting this organized and really come with your questions and best thing is probably to ask them in writing so it can be filtered and so you get your answer. Because man, if someone told me or you 25 years ago after this stupid Y2K thing that we’re going through something. Juliette Reinders Folmer: Like this again, but like in 10, 15 years time, a lot of open source maintainers are reaching pension age. We need to set up that line of succession now because it takes years to train people if they’re greenfields, to actually be able to maintain a project. Some projects are easier than others, some maintain, some people are more experienced than others, but it takes years. So we need to start getting that sorted now. Anne Bovelett: Tell me one last thing. What’s the joy of this project? What are moments in this project where you are like, wow, this is really. Juliette Reinders Folmer: Cool, I’m going to give an answer. Anne Bovelett: Just give me the bitter old open source maintainer answer. Juliette Reinders Folmer: A quite silly answer in a lot of ways. Basically when I use it myself for. And then I’m really happy that bug was prevented because of one of the sniffs I wrote years ago and that sniff flagged something in the code which I was analyzing for someone else or analyzing because I wrote it myself. And yeah, when it’s much so I then yeah, I prevent bugs. Anne Bovelett: Yeah, that’s joy. Oh, Juliet, I think you are amazing. I’m very honored that I know you and thank you for coming onto the show. Juliette Reinders Folmer: It was lovely speaking with you again. Anne Bovelett: Yeah. I hope to have you on here in not too much time and then maybe we can say yay, we did it. Juliette Reinders Folmer: That would be great and I would very much forward to that. Yes, that would be great. Anne Bovelett: Absolutely. Yeah. All right. Well, my dear audience, I hope you enjoyed this and I want to thank Open Channels FM also for giving us this platform to talk about this. Thank you, Bob, Don, thank you everybody else who is voluntarily working on these podcasts and the sponsors making this possible. Yes. And again, extra, extra. Thank you to GoDaddy and Automattic for sponsoring PHP\_CodeSniffer and I hope many people follow suit. Thank you so much. [](https://www.omnisend.com/openchannels/) [](https://woocommerce.com/), Underfunded PHP Tools: A Global Business Threat, Open Channels FM, 01kfzv2sz65z7t15k87rkrd0mt.