←back to thread

Fifty Years of Open Source Software Supply Chain Security

(queue.acm.org)
182 points yarapavan | 2 comments | 07 Apr 25 18:04 UTC | HN request time: 0.001s | source
Show context
aadhavans ◴[07 Apr 25 18:24 UTC] No.43614405[source]▶
A very well-written piece. The section on funding open source is as relevant as it's ever been, and I don't think we've learnt much since last year.

As the proportion of younger engineers contributing to open-source decreases (a reasonable choice, given the state of the economy), I see only two future possibilities:

1. Big corporations take ownership of key open-source libraries in an effort to continue their development.

2. Said key open-source libraries die, and corporations develop proprietary replacements for their own use. The open source scene remains alive, but with a much smaller influence.

replies(5): >>43614635 #>>43615318 #>>43615592 #>>43616293 #>>43618059 #
bluGill ◴[07 Apr 25 18:50 UTC] No.43614635[source]▶
Unfortunately I have no clue how to get a company to put money into the open source we use. Not just my current company, but any company. I've sometimes been able to get permission to contribute something I build on company time, but often what I really want is someone on the project to spend a year or two maintaining it. Do the boring effort of creating a release. Write that complex feature everyone (including me) wants.

In decades past companies you to pay for my license for Visual Studio (I think of a MSDN subscription), clear case, a dozen different issue/work trackers. However as soon as an open source alternative is used I don't know how to get the money that would have been spent to them.

Come to think of it I'm maintainer of a couple open source projects that I don't use anymore and I don't normally bother even looking at the project either. Either someone needs to pay me to continue maintaining it (remember I don't find them useful myself so I'm not doing it to scratch an itch), or someone needs to take them over from me - but given xz attacks I'm no longer sure how to hand maintenance over.

replies(3): >>43614804 #>>43615366 #>>43617654 #
1. RossBencina ◴[08 Apr 25 01:52 UTC] No.43617654[source]▶
As an independent maintainer I don't really know where to start trying to organise an ongoing income stream from users to support maintenance.

I thought that the idea of a funding manifest to advertise funding requests was a good idea: https://floss.fund/funding-manifest/ No idea if it works.

replies(1): >>43621393 #
2. bluGill ◴[08 Apr 25 13:10 UTC] No.43621393[source]▶
Most open source projects don't really need an income stream. It only becomes an issue when the project is large enough that there is desire for someone to work on it half time or more. Smaller projects can still be done as a hobbyist thing. (the project I "maintain" only needs a few hours of my time per year, but since I no longer use it I can't be bothered - there is a problem for those who still use it). Of course it is hard to say - curl seems like it should be a small project but in fact it is large enough to support someone full time.