Jun 22, 2025, 10:03 AMWhen we had the xz issue last year, I proposed a solution to help upstream maintainers by giving them access to paid experts. A kind of reverse 0day approach. Maybe it's time to look at it again.
And to make this perfectly clear: This is my personal opinion, based on my years of experience in the FOSS galaxy.
3/3
Jun 22, 2025, 11:22 AMAddendum: Again, IMHO (In My Humble Opinion), Nick Wellnhofer made the right decision here. I fully understand his frustration about effectively being forced to work under stress to come up with a fix and getting nothing in return.
He is also giving her maintainers from other projects a well-thought out set of arguments to do the same. Before the burnout comes knocking.
@jwildeboer
Thank you for sharing this. From my POV this is what the EU Commission is trying to fix with the CRA. Manufacturers are responsible for everything they put into a product. They have to fix the sec vuln and have to upstream fixes if they use OSS
If it works, time will tell.
Jun 22, 2025, 1:10 PM@jwildeboer essentially, OSS is a common good. That means everyone profiting from it must put some work in maintaining it. This is just like a shared meadow in a village. All farmers have to do upkeep in order that their cows can be there. This includes also the big farmers. The same should apply here. So Google can easily pay a couple of people to support maintenance of the library, so can M$.
@jwildeboer yeah, while businesses are limited to money as the only true expression of value, open source has always held up participation as an expression of the same. Money is one of many tools to achieve greater participation, and is nearly worthless when it doesn’t lead to more participation.
@jwildeboer tbh, companies (esp. the very big ones) should just stop being freeloaders and actually have internal staff doing reviews and testing. And for each bug (or security issue encountered) actually propose a fix upstream.
If your ROI or even just internal processes depend upon some open source project you should have at leat one developer reviewing that projects changes and stay in touch with that projects community AND also contribute hardening and security audits+fixes...
@jwildeboer I think the @sovtechfund has a program like that: https://www.sovereign.tech/programs/bug-resilience#how-to-apply