Resurrecting the Dead - CourtneyR.dev's 2nd Brain

Resurrecting the Dead 🔗 **Source:** [Resurrecting the Dead](https://www.youtube.com/watch?v=5spuwg-8uAQ) > [!note]+ Document Notes > tags: [open-source-maintenance, php-codesniffer, maintainer-burnout] > author: Juliette Reinders Folmer > source: WordCamp > reference: [https://www.youtube.com/watch?v=5spuwg-8uAQ] > date created: 2024-12-19 14:30 > > # 🏷️ Title: Resurrecting the Dead: Tales of an Accidental Maintainer >  ## 🧰 Action Inbox - [H1] Audit company dependencies for maintainer status — identify supply chain risks #security - [H2] Establish open source funding budget — treat as IT infrastructure cost #funding - [H3] Document succession planning for critical projects — prevent single points of failure #governance ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - [PHP CodeSniffer](https://github.com/PHPCSStandards/PHP_CodeSniffer) - [Thanks.dev](https://thanks.dev) ## 📝 Summary - Juliette Reinders Folmer shares her experience becoming an accidental maintainer of critical PHP projects including CodeSniffer, which has 300,000+ dependent projects - Companies unknowingly rely on volunteer-maintained open source with massive business risks when maintainers abandon projects due to life circumstances or burnout - The xz backdoor attack in 2024 demonstrated how vulnerable the open source ecosystem is to inadequately vetted maintainers under community pressure - Proper succession planning, funding, and contributor cultivation are essential to prevent critical infrastructure collapse - Organizations must treat open source funding as IT infrastructure costs, not marketing expenses ## 📖 Main Content Juliette explains how she became an "accidental maintainer" - someone who takes over critical open source projects not by choice, but by necessity when original maintainers abandon them. This happened with projects like PHP CodeSniffer, which has hundreds of thousands of dependent projects. The typical pattern begins when a CI dependency breaks, leading to submitting patches, then fixing the project's outdated CI, then waiting indefinitely for an unresponsive maintainer to merge changes. Eventually, either the original maintainer grants commit access or community pressure forces a takeover. This process creates serious security vulnerabilities, as demonstrated by the xz backdoor attack - a state-sponsored, multi-year effort that nearly succeeded in compromising every Linux server worldwide by exploiting exactly this maintainer succession vulnerability. Projects follow a lifecycle from creation to maturity to potential abandonment. While abandonment is natural for small projects, it becomes problematic when millions depend on the software. Life events like illness, family changes, job transitions, or death cause maintainers to step away, but these personal circumstances aren't discussed in public GitHub issues. Maintainer burnout occurs when companies respond to funding requests by assigning inexperienced developers to submit low-quality PRs, creating more work for already overwhelmed maintainers rather than providing actual relief. ## 🗒️ Notes #### ⏱️ [00:00](https://www.youtube.com/watch?v=5spuwg-8uAQ?t=0) — [H1] Introduction to Accidental Maintenance - Key idea: Accidental maintainers take over critical projects by necessity, not choice - Evidence: "This talk is not about those [deliberately created projects]. This is about projects I became accidental maintainers for" #### ⏱️ [02:30](https://www.youtube.com/watch?v=5spuwg-8uAQ?t=150) — [H2] The Typical Escalation Pattern - Key idea: Maintenance takeover follows predictable steps from broken CI to commit access - Evidence: "Somewhere in my CI something is failing because dependency is not working anymore" #### ⏱️ [04:45](https://www.youtube.com/watch?v=5spuwg-8uAQ?t=285) — [H1] The XZ Backdoor Security Lesson - Key idea: Community pressure for maintainer succession creates national security risks - Evidence: "This is how vulnerable open source is... if community pressure leads to someone being added as a maintainer when they've not been fully vetted" #### ⏱️ [06:00](https://www.youtube.com/watch?v=5spuwg-8uAQ?t=360) — [H1] PHP CodeSniffer Takeover - Key idea: CodeSniffer represents massive scale dependency with 300,000+ dependent projects - Evidence: "There's somewhere between 300,000 and 500,000 dependent projects. It is basically too big to fail" #### ⏱️ [08:15](https://www.youtube.com/watch?v=5spuwg-8uAQ?t=495) — [H2] Project Lifecycle Phases - Key idea: Projects naturally evolve from creation to maturity to potential abandonment - Evidence: "Most projects go straight from phase one to phase four, and that's okay, but by the time a project has a huge number of dependents, that becomes problematic" #### ⏱️ [10:30](https://www.youtube.com/watch?v=5spuwg-8uAQ?t=630) — [H1] Life Happens to Maintainers - Key idea: Personal life events cause maintainer abandonment but aren't publicly discussed - Evidence: "Life happens... that might be that a parent gets ill and needs caring for, or you start a family... these are not things you discuss in GitHub issues" #### ⏱️ [13:00](https://www.youtube.com/watch?v=5spuwg-8uAQ?t=780) — [H1] Maintainer Burnout Cycle - Key idea: Company attempts to help often worsen maintainer burnout through poor-quality contributions - Evidence: "Companies put inexperienced people who submit low quality PRs... community pressure amounts up... that's the road to maintainer burnout" #### ⏱️ [15:45](https://www.youtube.com/watch?v=5spuwg-8uAQ?t=945) — [H2] Business Risk Assessment - Key idea: Switching dependencies can be more expensive than funding current maintainers - Evidence: "For a lot of companies, if you switch from one dependency to another... it would mean bankrupting the company" #### ⏱️ [18:00](https://www.youtube.com/watch?v=5spuwg-8uAQ?t=1080) — [H2] Resurrection Options and Challenges - Key idea: Taking over abandoned projects faces technical and organizational obstacles - Evidence: "Fork the repo - not ideal because you lose all the issues, PRs, Wiki, GitHub Pages sites" #### ⏱️ [20:30](https://www.youtube.com/watch?v=5spuwg-8uAQ?t=1230) — [H2] What Maintaining Actually Means - Key idea: Maintenance is keeping infrastructure running, not adding features - Evidence: "Nothing ever just works... maintaining means keeping things running, unblocking other people from being able to contribute" #### ⏱️ [23:15](https://www.youtube.com/watch?v=5spuwg-8uAQ?t=1395) — [H2] Healthy vs Unhealthy Project Structure - Key idea: Sustainable projects need multiple maintainers and contributor circles - Evidence: "Healthy projects have a group of maintainers, more than one, around that a circle of regular contributors" #### ⏱️ [25:45](https://www.youtube.com/watch?v=5spuwg-8uAQ?t=1545) — [H1] Succession Management Requirements - Key idea: Next generation maintainer succession requires deliberate planning and funding - Evidence: "We need to line up the next generation of maintainers... to go through this whole process, you need funding because coaching people... costs more time than just doing it yourself" #### ⏱️ [30:00](https://www.youtube.com/watch?v=5spuwg-8uAQ?t=1800) — [H1] Funding as IT Infrastructure - Key idea: Open source funding must be treated as IT budget, not marketing expense - Evidence: "Funding is not marketing budget. Funding is part of your IT budget. If you rely on open source... you need to fund open source" #### ⏱️ [35:30](https://www.youtube.com/watch?v=5spuwg-8uAQ?t=2130) — [H2] CodeSniffer 4.0 Release and Current Status - Key idea: CodeSniffer has accelerated development but faces declining funding despite growth - Evidence: "25 new releases since I took over in December 23... the previous 25 releases took over six years" ## 📚 References - [PHP CodeSniffer](https://github.com/PHPCSStandards/PHP_CodeSniffer) - [Thanks.dev](https://thanks.dev) - [GitHub Sponsors](https://github.com/sponsors) - [Tidelift](https://tidelift.com) ## 🗣️ Paraphrase - Open source projects often become critical infrastructure with single volunteer maintainers who may abandon them due to life circumstances, creating massive business risks for dependent organizations - The process of community-pressured maintainer succession creates security vulnerabilities, as demonstrated by sophisticated attacks like the xz backdoor that nearly compromised global Linux infrastructure - Sustainable open source requires treating funding as essential IT infrastructure costs while implementing proper succession planning with multiple maintainers and structured contributor development programs ## 📰 Newsletter **Critical Infrastructure Reality Check: Why Your WordPress Dependencies Need Funding** Ever wondered what happens when a critical WordPress tool suddenly stops working? Juliette Reinders Folmer's eye-opening talk reveals the hidden fragility in our development ecosystem. As an "accidental maintainer" of PHP CodeSniffer (used by 300,000+ projects), she demonstrates how volunteer burnout and life events regularly threaten the tools we depend on daily. The 2024 xz backdoor attack showed how vulnerable this succession process is to sophisticated threats. **Key takeaway**: Companies must budget for open source funding as IT infrastructure, not marketing. When core dependencies break, rebuilding your entire tech stack costs far more than supporting current maintainers. **Action items**: Audit your dependencies with tools like Thanks.dev, establish open source funding budgets, and contribute back to projects you rely on. The WordPress ecosystem's health depends on recognizing that "free" software requires sustainable funding models. Resources: [Learn WordPress](https://learn.wordpress.org/), [Developer Docs](https://developer.wordpress.org/), [WP-CLI](https://wp-cli.org/) ## ✅ Action Items #### DevRel - Developer advocacy: Create talks highlighting dependency risks and funding importance at WordCamps and meetups - Education: Develop workshops on open source sustainability and contribution workflows - Developer experience: Improve documentation for contribution processes in WordPress projects - Developer marketing: Campaign messaging around responsible open source citizenship - Community management: Facilitate discussions on maintainer succession planning #### OSPO - Policy & Governance: Establish open source funding allocation policies and approval processes - License Compliance: Audit critical dependencies for maintainer status and succession planning - Security Management: Implement monitoring for abandoned dependencies and succession vulnerabilities - Software Inventory: Track maintainer status in SBOM documentation alongside license information - Developer Support: Provide training on identifying at-risk dependencies and contribution workflows - Community Engagement: Allocate budget for funding critical upstream dependencies - Strategic Alignment: Set KPIs for dependency health and contribution metrics #### Community - Maintainers: Provide succession planning templates and governance frameworks - Contributors: Create mentorship programs for potential future maintainers - Sponsors: Establish transparent funding models for critical infrastructure projects - Ecosystem: Coordinate cross-project funding initiatives and maintainer support networks #### WordPress - Core: Audit critical dependencies for maintainer health and establish funding support - Core Performance: Ensure performance tooling dependencies have sustainable maintenance - Community: Educate WordPress community on open source sustainability through meetup content - Training: Develop lesson plans on responsible open source citizenship and contribution - Marketing: Campaign on WordPress.org highlighting importance of upstream contribution - Documentation: Create guides for identifying and supporting critical dependencies - Meta: Implement dependency health monitoring for WordPress.org infrastructure #### The WPCC - Programs: Create microgrants for critical WordPress ecosystem dependency maintenance - Projects: Fund dependency audits and succession planning for major WordPress tools - Funding: Establish matched funding programs for companies supporting upstream dependencies #### FAIR - Technical independence: Ensure WordPress project dependencies have diverse maintainer bases - Policies: Require transparency in dependency maintainer status and succession plans - Governance artifacts: Create templates for healthy project governance and maintainer transition ## 🧪 Hypotheses - Organizations treating open source funding as IT infrastructure rather than marketing will experience fewer dependency-related outages and security vulnerabilities - Projects with documented succession plans and multiple maintainers will have longer lifespans and more stable development velocity - Early closure of inadequate pull requests with constructive feedback will result in higher-quality future contributions from the same developers - Companies that contribute both funding and developer time (rather than just inexperienced developers) will see better relationships with maintainers and project health ### 📊 Methodology - Longitudinal study tracking project health metrics (commit frequency, issue resolution time, maintainer count) across funded vs unfunded critical dependencies - Survey research on maintainer burnout factors and intervention effectiveness across different support models - Case study analysis comparing project succession outcomes with and without formal planning processes ### ❓ Questions - What early indicators can predict maintainer burnout or abandonment before projects become critical risks? - How can organizations balance contributing inexperienced developers for learning while not overwhelming maintainers? - What governance structures best prevent security vulnerabilities during maintainer transitions? ### 🔮 Future Research - Develop automated tooling for dependency health monitoring and maintainer status tracking - Create standardized frameworks for corporate open source funding allocation and impact measurement - Investigate psychological factors in maintainer sustainability and burnout prevention strategies ### 💡 Implications - Practice: Development teams need dependency auditing as regular security practice alongside vulnerability scanning - Policy: Organizations require formal open source funding policies treating critical dependencies as infrastructure - Security: Maintainer succession represents significant supply chain attack vectors requiring monitoring and controls - Education: Developer education must include open source sustainability and contribution ethics - Funding: Budget allocation models need categories for upstream dependency support separate from internal development costs ### 🧠 Learning Styles Assessment Reading level estimate: 12th grade (complex technical concepts with accessibility-focused explanations) #### 👀 Visual learners - Present: Project lifecycle diagrams, healthy vs unhealthy project structure illustrations - Improve: Dependency relationship maps, funding flow visualizations, risk assessment matrices #### 🔊 Aural learners - Present: Full video presentation with clear narration and examples - Improve: Audio summary highlighting key action items, podcast format discussion #### 🗣️ Verbal learners - Present: Clear definitions of maintainer roles, analogies to traditional infrastructure - Improve: Story-driven case studies, terminology glossary, comparison frameworks #### 🧩 Kinesthetic learners - Present: Actionable checklists for dependency auditing and funding setup - Improve: Hands-on workshops for contribution workflows, interactive assessment tools #### 🧠 Logical learners - Present: Clear problem progression from individual to systemic risks, cost-benefit analysis - Improve: Decision trees for funding prioritization, quantified risk assessment frameworks #### 🧑‍🤝‍🧑 Social learners - Present: Community discussion format with Q&A, emphasis on collaborative solutions - Improve: Group exercises for dependency auditing, peer review of funding strategies #### 🧘‍♀️ Solitary learners - Present: Comprehensive written analysis with reflection points - Improve: Self-assessment tools for organizational readiness, individual action planning worksheets #### 🌿 Naturalistic learners - Present: Ecosystem metaphors for project interdependencies and health - Improve: Sustainability analogies, lifecycle thinking applied to software dependencies ### 📊 Accessibility Assessment #### Screen reader semantics - Present: Well-structured headings, clear section navigation, descriptive timestamps -