Watching this log4j bug metastasize, I’m seeing people ask why industry doesn’t fund open source. I don’t have a great answer, but I have some thoughts following the experience with Heartbleed in ‘14. 1/
When Heartbleed dropped, it was very similar to log4j: an underfunded OSS project (OpenSSL) that nobody thought about, but was *everywhere*. It took everyone by surprise, and even woke industry up. The result was a surge of funding. 2/
Industry (not the government, who still though “infrastructure” meant dams and bridges) suddenly realized they were using this stuff everywhere. So the Linux Foundation created the Core Infrastructure Initiative (now the OpenSSF). coreinfrastructure.org 3/
Money that was presumably hanging out in couch cushions suddenly became available to fund OSS teams. But there was a problem: nobody quite knew who to fund! 4/
One answer was OpenSSL, obviously. But once you’ve searched for your keys under the streetlamp, where do you go next? So the answer was to pick a handful of obvious targets and throw some money at them. 5/
You might imagine that there’s a huge database out there that lists every widely-used OSS dependency along with the current team funding status, plus some measure of the “impact” a serious vuln would have. Weirdly, there isn’t. 6/
A bunch of people have a list in their heads. But almost by definition, the real surprises aren’t on that list. If they were, maybe the problems would already be solved. 7/
Ok, so what I’m saying is that if you want to solve this problem, to me the missing resource is not money. It’s *visibility*. We all know the landmines are out there — but we can’t see them. 8/
Maybe there’s someone doing the analysis already. Maybe these resources exist now (they didn’t 7 years ago!) But if they don’t exist, they should. It would do more good than any number of millions of $. 8/
If they don’t exist, it would be very useful to retask some government resources away from E5 licenses or whatever towards building those resources. //
As a follow-up: @FiloSottile has a nice post about professionalizing the role of OSS maintainer. This is great! But I would still argue that money is finite, and knowing which projects need help is a basic missing ingredient. blog.filippo.io/professional-m…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
