Underfunded PHP Tools: A Global Business Threat  ## Document Notes ## Highlights - **Single Maintainer Risk** - Juliette maintains PHP_CodeSniffer alone and many critical PHP projects effectively rely on single maintainers. - This single-point-of-failure risk threatens vast parts of the web if maintainers stop or are compromised. Transcript: Anne Bobolet I hope I say it correctly. I do it. I say do it. I always remember JFR, welcome to dyslexia folks. Juliette Reinders-Folmer Well. J-R and it's Juliet Reinders-Folmer. I mean, at the end of the day, most people just know me by my nickname anyway. Anne Bobolet There are a lot of people who don't yet know who you are, Juliette, but what people should know is that if you decide to go on a long vacation, we might have a problem at world scale. And this is the reason why I asked you to come and talk at Open Channels FM. So we get a lot of people to hear what you have to say about this. Because if the project that you are maintaining has to step on the brakes, hosting companies will suffer. Banks will suffer. Insurances will suffer. It's unimaginable what will suffer if what you are doing is either stepped on the brakes or is being compromised. And we're talking about a problem at a scale. You think the Cloudflare outage was a problem? You have no clue. Now that sounds icky, huh? Welcome, Juliette. Juliette Reinders-Folmer Thank you very much for that absolutely amazing introduction. I don't feel that the impact is that direct, but that is largely because like most of open source, even if nobody touches it anymore, it will still continue to keep working for at least A little while. So until at some point, you know, something in the wider ecosphere changes, it will continue to work and people will not even notice that I've gone on holiday until it doesn't work anymore. But by then, the backlog will be so huge that it's really, really, really hard to get through and to be able to pick up again where I left off. ([Time 0:01:02](https://share.snipd.com/snip/1f733366-839e-469c-9ea8-3445767be617)) - **Massive WordPress Patch Example** - Juliette described a single WordPress commit that rewrote over 100,000 lines when CodeSniffer was enforced. - She noted nobody reviewed all those lines; only spot checks occurred. Transcript: Anne Bobolet So code is being written and PHP Sniffer, it's a sniffer. It's sniffing the code to check if there are issues, problems, security issues, other glitches. And the thing that makes this software so unique is it writes the fixes. That is the only application currently that does that. And I know there are other similar applications. Juliet can tell you about them, but I already know that they can only do one third of what PHP CodeSniffer can do. And people trust this software blindly. It's almost like people are treating ChatGPT. Here's my code, go fix it. Juliette Reinders-Folmer But ChatGPT usually doesn't fix it very well, but that's another story. And this too. Just to intersect in this, a number of years ago, we did like a really, really, really, really, really big patch to WordPress. At that time, the biggest WordPress core patch ever. We rewrote in one commit over 100,000 lines of code. That was when CodeSniffer was finally being enforced for WordPress. Wow. That was the biggest core patch ever. And believe me, nobody has reviewed those 100,000 lines. No, wow. Spot checks, yes, but nobody's reviewed all 100,000. ([Time 0:11:03](https://share.snipd.com/snip/a55e069f-74f5-417c-b749-b347dc888a89)) - **Vet Committers Rigorously** - Vet contributors thoroughly before granting commit (write) access to reduce risk of malicious or low-quality changes. - Require clear, maintainable designs and explanations for features before accepting them. Transcript: Anne Bobolet Yeah. And I mean, if there were five or six of you, none of you, also the five or six people would not take on that feature, but you would have less of a burden explaining that to people. And with five or six people, it would also help, you know, to coach something to something which is explainable. Juliette Reinders-Folmer It is a lot easier if there's five, six people having that conversation. Yeah. Or, you know, one person having that conversation on topic one, one person having that conversation in topic two, instead of all of it coming down to the one person who is there, who is Me at the moment. It's not just CodeSniffer which has this problem. I mean, a lot of the big projects in the PHP world are largely dependent on a single maintainer. Sometimes they might have a small team, two, three people, but even then there is always a lead. And if that lead would fall away, it would be very problematic for most of these projects. Yeah. Anne Bobolet It's like, I can't remember his name now. One of the singers that sings, you don't know what you've got till you lose it. Yeah. Right. And normally I don't like to come from fear and from no, but really in this hour, I really want to scare your pants off, folks, because you should be worried about this. Because right now, if I understood you correctly, and I'm only talking about the public projects here, there are between 300 and 500 projects, 500,000 projects, depending on this Software, depending. Now imagine Juliet has the key to the castle. And she told me it took eight years until anyone allowed her to even commit. And committing, for those who are not so technical, means you change the code and you are allowed to add your changed code to the system. Juliette Reinders-Folmer It's basically write access. Yeah. Before that, you have the right to propose changes, but someone else takes the decision. Commit rights means you have the right to take that decision and also to take the decision about code other people propose. Now, imagine people. More people are needed. Anne Bobolet Funding for this project is desperately needed. People who are maintaining big projects like this shouldn't be begging to get sponsorships. People should be coming in by the herds and say, here, take my money and maintain this. We're all using it. ([Time 0:15:30](https://share.snipd.com/snip/ff83fce7-1b09-4b84-bce4-de6f6e85dcf7)) - **Supply-Chain Attack Danger** - Malicious contributors can slowly insert backdoors if maintainers are overwhelmed. - Tools that rewrite code (like CodeSniffer's fixer) increase the potential impact of such attacks. Transcript: Anne Bobolet It happened, right? Excedutels. Juliette Reinders-Folmer Excedutels was a tool, intents and purposes, not proven, but very, very, very likely state-sponsored attack on open source, where someone started proposing changes. Those weren't merged quickly enough because the maintainer was overwhelmed and overworked and not paid. Uh, so then there was community pressure, but that community pressure were most likely sock puppets. The sock puppets are fake accounts, fake accounts from that same person who proposed the changes, saying, can you please merge this? So that person then got commit rights. And then very slowly, over a period of two years, they put in little bits of very innocent looking codes, which together were the building blocks for something which became a backdoor Into Linux. And it was only called just in time before it ended up on every Linux server in the world. Now, CodeSniffer is not Linux, but CodeSniffer does rewrite the code of the project it scans with its fixer. So depending on which NIFs you have running, if someone would add malicious code in one of those fixes, as in would make that fixer write malicious code into your project, we just discussed, You know, that patch to WordPress was 100,000 lines. Nobody actually reviewed that 100,000 lines. So if, presuming that most people do review, say 80% do review, 20% don't, that still means that 20% of that 500,000 PHP projects, and that includes projects like Magento, Drupal, WordPress, Typo3, all of those use CodeSniffer. Literally all of them. So all of those projects could that way accidentally get a backdoor. And of course, you hope that enough reviews being done, and you hope that people will catch that before it becomes a released version. And more than anything, I hope it will never happen and that I will catch that before it even enters PHP code. But it does mean that I have to be extremely careful and really, really validate my trust in people before I give someone else commit rights, right access to this project. ([Time 0:19:26](https://share.snipd.com/snip/56860a67-8635-468e-bde9-2e46f2cdf840)) - **AI Training Creates Legal Risk** - AI models are trained on vast open-source code without consent, creating ethical and legal issues. - Accepting AI-generated patches can force relicensing or expose projects to license conflicts. Transcript: Juliette Reinders-Folmer It's trained on open source code without asking permission, without giving credit to the original orders of the code. In other words, the ethical question here is, do we accept theft as a legitimate way to make money? Because it's literally theft what's happening. And worse than that, if you then go take it one step further and look at the legal side of things, the code I'm maintaining with CodeSniffer has a license called BSD3. That's a very open license. You can do all sorts of things with it. There are also licenses which are more restrictive or what they call viral licenses. If you use code from a viral license, your code also has to become licensed under that viral license. So now if that AI is trained on code with that viral license and that code in some way or other in a patch which gets submitted to CodeSniffer, CodeSniffer has a legal problem because I Would need to relicense a project which is over 20 years old to this viral license because that's what the viral license demands. But to relicense an existing project, which is open source and licensed under certain terms, I need permission of every single contributor who's ever contributed to the project. That's impossible, right? Exactly. In other words, unless you can guarantee that the AI you've used to create your patch has not been trained on code which has proprietary license, as in source code, or code which is under Viral licenses, as in can you guarantee that the licenses of the code this AI is being trained on are compatible with the license of the project you're trying to contribute to? I cannot accept it because I'm opening myself personally to ([Time 0:25:40](https://share.snipd.com/snip/bc7e7b4b-fe28-4c36-8b1c-f5f5ca14d0fc)) - **Handle AI PRs With Caution** - Treat AI-generated pull requests with extra scrutiny or reject them unless provenance is provable. - Expect AI PRs to cost maintainers much more review time than human PRs. Transcript: Juliette Reinders-Folmer Literally, the cost of AI for me to review an AI PR is 10 times higher than the cost of me reviewing a normal PR. Anne Bobolet Yeah. Well, that's, I mean, that is crazy. And just to put it the other way around, for example, a hosting company, right? The next big PHP version is coming and open source CMSs and even closed ones are saying, ah, we're not, you know, we're finally done PHP 5.4. I mean, hello, that's like MS-DOS under PHP. Okay. Now, if they have to decide, sometimes you have to choose between sitting it between a rock and a hard place. Right? And I think as a hosting company, we've been talking about that before because we had a nice long talk before and many talks before that. You want to know what your risk is. You want to get an estimate. So what if I now just upgrade everyone away from 5.4 and I'm upgrading them to, well, let's be courageous, 7.3. I know we're at 8.4 now, but right? This is how things go. The forums explode, social media explode. Look at what my house did. My site went down because I didn't update WordPress for the last 10 years, but who cares? It's happening. And then this is an incredible cost on the support desk of a hosting company. This is the cost they're looking at. It's not their server. It's not the gigabytes. It's not the processors. It's not even the power they're paying for. It's the people. And using a tool like Codesniffer saves them literally from hundreds of thousands, and if they're larger, even millions over the years. And I really want to appeal to anyone listening. Put your money where your mouth is. Support this project. Juliette Reinders-Folmer To make sure that people don't go and say, oh, but what you're saying is bullshit now. Something like PHP compatibility, which is an external standard built on top of PHP code sniffer, can detect in 78% of all cases whether code is compatible with certain PHP versions. By running that on a server where the PHP version is going to be upgraded for, hosts can detect which customer is going to have a problem. So this is what we're talking about. It's not just the fact that CodeSniffer exists and that the code style looks good and that a certain bug gets found by the scans before it makes it into production. Now, it's actually, you can scan a whole server and figure out, okay, which code is going to have a problem when we upgrade this to a different PHP version. And these kind of things are facilitated by PHP CodeSniffer. Anne Bobolet I mean, this is, So, you know what? I'm thinking right now, you're maintaining this all by yourself. And people are putting everything on your shoulders. And one of the things that suddenly came to my mind is, what if people are like, okay, we want to support this. Why don't we ask them to come with a plan, with a financial plan for you? So let them do that because you're busy enough as it is doing that work. I know you're doing it from morning till evening. And there's people contributing. Juliette Reinders-Folmer It's not just me, but I am the sole maintainer, yes. And that's also why things like fundraising is yet another burden because it also comes down to me, and it's a completely different skill set. I'm not a marketer. I'm a developer. Basically, maintainer time in open source. Maintainer time is the scarcest commodity of all. And a maintainer needs to be very, very selective. What do I want to spend my time on? And that's another problem with AI. It wastes maintainer time. Even just closing them and having to check, oh, this is AI close, is wasting maintainer time. ([Time 0:31:30](https://share.snipd.com/snip/610b8c3f-cf14-4340-b3c7-92f92091216a)) - **Tooling Prevents Upgrade Chaos** - PHP_CodeSniffer powers tools that can predict PHP compatibility problems across servers. - Hosts can scan servers to find sites that will break after PHP upgrades and proactively mitigate risk. Transcript: Juliette Reinders-Folmer To make sure that people don't go and say, oh, but what you're saying is bullshit now. Something like PHP compatibility, which is an external standard built on top of PHP code sniffer, can detect in 78% of all cases whether code is compatible with certain PHP versions. By running that on a server where the PHP version is going to be upgraded for, hosts can detect which customer is going to have a problem. So this is what we're talking about. It's not just the fact that CodeSniffer exists and that the code style looks good and that a certain bug gets found by the scans before it makes it into production. Now, it's actually, you can scan a whole server and figure out, okay, which code is going to have a problem when we upgrade this to a different PHP version. ([Time 0:33:36](https://share.snipd.com/snip/fa3dbdc2-d681-4b5e-a860-a58600485f79)) - **Estimate Real Funding Needs** - Budget roughly €500k/year to provide continuous, structural maintenance for PHP_CodeSniffer. - Use that funding to hire and retain multiple maintainers and avoid single-point failures. Transcript: Anne Bobolet Did you ever think about that? Because otherwise we're going to send this question out in the world to all these fancy CEOs who are really good at calculating these things, CEOs, CFOs, why don't you folks calculate With that? Juliette Reinders-Folmer Well, I haven't calculated it based on a number of people. I have calculated what it would need to have continuous maintenance of code sniffer in a structural fashion where those people will do the actual, the bulk of the actual work can get Paid. It's about half a million a year euros. That's not much. No, but we're nowhere near. Anne Bobolet That's not much. That is not much. Now ([Time 0:36:32](https://share.snipd.com/snip/afa21331-c31c-4805-90aa-5001f5be64ea)) - **Pay For Maintainer Time** - Funders should pay for maintainer time and training rather than expect free work or unpaid coaching. - Sponsor multi-person teams so maintenance and knowledge transfer scale beyond one person. Transcript: Juliette Reinders-Folmer I haven't calculated it based on a number of people. I have calculated what it would need to have continuous maintenance of code sniffer in a structural fashion where those people will do the actual, the bulk of the actual work can get Paid. It's about half a million a year euros. That's not much. No, but we're nowhere near. Anne Bobolet That's not much. That is not much. Juliette Reinders-Folmer Now we're close to that at this moment, funding-wise. Anne Bobolet No, but I mean, you're not asking for 5 million bucks. No. ([Time 0:36:48](https://share.snipd.com/snip/549f14d2-a41b-4755-9601-02d3ecd7dcc9)) - **Start Succession Early** - Start succession planning and training now because it takes years to grow reliable maintainers. - Prioritize structured mentorship and paid roles to avoid knowledge gaps when maintainers age out. Transcript: Anne Bobolet So if there's someone who says, hey, I know how to approach the EU or whatever for funding, come and find us. Juliette Reinders-Folmer I've looked at some of the forums like for Sovereign Tech and everything, and the amount you need to spend on writing all of that up is quite a lot. And there's always some clauses why you don't qualify. Anne Bobolet There are specialists for that. And so my call is to those who can support with that, getting the funding, getting the support, getting this organized. And really come with your questions and best thing is probably to ask them in writing so it can be filtered and so you get your answer because man, if someone told me or you 25 years ago, After this stupid Y2K thing, that we're going through something like this again. Juliette Reinders-Folmer Yeah, but like in 10, 15 years time, a lot of open source maintainers are reaching pension age. We need to set up that line of succession now because it takes years to train people if they're greenfields to actually be able to maintain a project. Some projects are easier than others. Some people are more experienced than others, but it takes years. ([Time 0:41:02](https://share.snipd.com/snip/f747cf45-6c8b-4236-bbfd-efceaf09b1a9))