Open source maintainers underpaid, swamped by security, and going gray(theregister.com)
theregister.com
Open source maintainers underpaid, swamped by security, and going gray
https://www.theregister.com/2024/09/18/open_source_maintainers_underpaid/
322 comments
Open source is one of the most thankless jobs. People who do it should still think about other ways to make money, or find a way to earn while contributing. It makes no sense to write amazing software, used by large corporations to generate billions, while you end up poor and bitter. No, it’s not fair, and no one should allow themselves to be taken advantage of in that way. Open source is a gift, but before giving to others, you should ensure you have enough for yourself.
Maybe open-source as the load-bearing infrastructure of the world will never be sustainable, and maybe that's okay. I think open-source is best when it's empowering people to modify and remix their software, and have free alternatives to expensive commercial programs. It seems like open-source has become so captured by corporate interests, that people's main motivation for contributing is to add it as a bullet-point on their resume.
On a related note: the worst thing you can possibly do as an open source developer is to create a product for the general public to use.
You hate tickets without repro? Enjoy the barrage of “help. Doent work”, “me too” and “HELLO IT’S BEEN 3 DAYS” messages.
You hate tickets without repro? Enjoy the barrage of “help. Doent work”, “me too” and “HELLO IT’S BEEN 3 DAYS” messages.
I’m a young(-ish) dev who used to care a lot about open source but never managed to break into a community. In recent years my view of the whole thing has soured a lot. There seems to be few compelling incentives to actually develop or participate in open-source software.
Open source first felt to me like a way to give power back to ordinary people, and it still is, but it seems like those who get the most benefit from free labor are large corporations. Open source feels increasingly corporate and companies like Microsoft dominate and reap enormous benefits. I’ll work for Joe Neighbor for free but not Sataya Nadella.
Open source was always political but in 2010 (around when I started getting into Linux) it felt like dumb arguments over things like programming languages or “the UNIX philosophy”. Now it feels like a vicious Red vs Blue culture war where not picking a side is just as bad as picking the other side.
Contributing to open source is a thankless job and even if your project is really good, most people won’t care and the few that do might still treat you like crap. I’ve submitted a handful of pull requests and I’ve already run into the classic “Your patch works and provides a feature some people might like, but I don’t like it, go away.”
I’ve donated plenty to organizations like Mozilla, Wikipedia, and GNOME. I then email them with my opinions on what they’re doing. In nearly every case not only am I ignored completely, I see those projects (Mozilla especially) continue to drift in a direction that I disagree with. So, I stopped donating.
For me, the Linux kernel is probably one of the few big open source projects where 1) the project is technically interesting enough that I would learn a lot by contributing, 2) It seems like politics and infighting is kept under control, 3) it actually seems possible to get a patch in while having a 9-5, 4) I use the product myself every day and enjoy it, and 5) the technical direction feels positive in that it is getting regular features & bug fixes that I like
Open source first felt to me like a way to give power back to ordinary people, and it still is, but it seems like those who get the most benefit from free labor are large corporations. Open source feels increasingly corporate and companies like Microsoft dominate and reap enormous benefits. I’ll work for Joe Neighbor for free but not Sataya Nadella.
Open source was always political but in 2010 (around when I started getting into Linux) it felt like dumb arguments over things like programming languages or “the UNIX philosophy”. Now it feels like a vicious Red vs Blue culture war where not picking a side is just as bad as picking the other side.
Contributing to open source is a thankless job and even if your project is really good, most people won’t care and the few that do might still treat you like crap. I’ve submitted a handful of pull requests and I’ve already run into the classic “Your patch works and provides a feature some people might like, but I don’t like it, go away.”
I’ve donated plenty to organizations like Mozilla, Wikipedia, and GNOME. I then email them with my opinions on what they’re doing. In nearly every case not only am I ignored completely, I see those projects (Mozilla especially) continue to drift in a direction that I disagree with. So, I stopped donating.
For me, the Linux kernel is probably one of the few big open source projects where 1) the project is technically interesting enough that I would learn a lot by contributing, 2) It seems like politics and infighting is kept under control, 3) it actually seems possible to get a patch in while having a 9-5, 4) I use the product myself every day and enjoy it, and 5) the technical direction feels positive in that it is getting regular features & bug fixes that I like
There is a growing culture of microdependencies, where one project can depend on hundreds or thousands of libraries, combined with automated "vulnerability" tracking, which means projects are constantly receiving notifications about issues in libraries deep in the dependency tree, most of the time in a part of the library that is not even used by the top-level application. It's no surprise that "security" is eating up more and more time.
There is so much self imposed hurt in Open Source. Many maintainers feel they owe something to their project community, even if they are rude, entitled, unhelpful bunch. It is self imposed though. In reality unless you have a Support agreement or similar, you do not really own folks anything.
I wish more Open Source community players to stand up for their interest more strongly.
In the end, whenever you like it or not, few are going to pay for what they can get for free, and it especially applies to large enterprises
I wish more Open Source community players to stand up for their interest more strongly.
In the end, whenever you like it or not, few are going to pay for what they can get for free, and it especially applies to large enterprises
The word underpaid seems too friendly. In the case of the open source developers I know, they don't get any money
Feels a lot less joyful to be involved in open source than it used to be when there's just not as much of a culture of respect/"respect" or even the knowledge that you're making the world a better place for individuals.
It's difficult for me to point to any one specific cause of this. I want to say the reduced control over your own computing environment, far greater propensity for litigation and control, and the reduced or eliminated means of using social media website APIs to curate your own online experience.
Everything's feels so helpless and the primary reasons to solve these don't feel like they're technical in nature. They used to always feel technical in nature.
I have to wonder how much of the problem space of individual empowerment is even left for technology to fix?
It's difficult for me to point to any one specific cause of this. I want to say the reduced control over your own computing environment, far greater propensity for litigation and control, and the reduced or eliminated means of using social media website APIs to curate your own online experience.
Everything's feels so helpless and the primary reasons to solve these don't feel like they're technical in nature. They used to always feel technical in nature.
I have to wonder how much of the problem space of individual empowerment is even left for technology to fix?
Creating value doesn't automatically get you any money no matter how much value it is. You might get some by adjacency. Businesses capture and raid value.
I think it’d be interesting to see what happens in a few decades if the population of open source maintainers continue to dwindle. Will companies step up to maintain libraries in a sort of cooperative manner? Will everything become closed source and bespoke?
Now this probably won’t happen but it’s still interesting to think about.
Now this probably won’t happen but it’s still interesting to think about.
I don’t understand why this isn’t framed as an Economics problem? If a large group of people stop doing something that someone else depends on then that’s an Economic problem. No?
I don’t mean in the narrow of sense of exchanging things for money. If society wants some undefined group of any kind of people to do something but they are not (or they are about to quit) then that’s a resource allocation problem of sorts. That’s the bare problem. This problem does not immediately prescribe a solution like paying someone in dollars and cents. That’s only one solution.
Same if a country is having a fertility issue. The problem is sort of an economic one. But the answer doesn’t have to be paying would-be fathers and mothers. It could for example be to provide more free services that parents benefit from. Or it could mean reducing the hours in the “standard work week”. Or it could be to improve the pension of part-time workers (mothers are often part-time workers). Or it could be to more child-friendly urban planning. Or it could be to improve the public transportation and road infrastructure for households where the two partners work in different parts of the city/municipality/county.
Are professional economists working on this problem? If not, why aren’t they? This seems like it should be their domain. Am I being totally naive here?
I don’t mean in the narrow of sense of exchanging things for money. If society wants some undefined group of any kind of people to do something but they are not (or they are about to quit) then that’s a resource allocation problem of sorts. That’s the bare problem. This problem does not immediately prescribe a solution like paying someone in dollars and cents. That’s only one solution.
Same if a country is having a fertility issue. The problem is sort of an economic one. But the answer doesn’t have to be paying would-be fathers and mothers. It could for example be to provide more free services that parents benefit from. Or it could mean reducing the hours in the “standard work week”. Or it could be to improve the pension of part-time workers (mothers are often part-time workers). Or it could be to more child-friendly urban planning. Or it could be to improve the public transportation and road infrastructure for households where the two partners work in different parts of the city/municipality/county.
Are professional economists working on this problem? If not, why aren’t they? This seems like it should be their domain. Am I being totally naive here?
There are few points:
- there is no FLOSS culture in most people, so the classic model "I publish and maintain my code, others get it from free and give back their improvements equally for free" does not work anymore in most cases. Collaboration culture seems to be very diminished, some try be moral police, some simply do not care etc;
- mere widespread lack of competence mixing, in the past with usenet newcomers and gurus was together, interact and share visions, doubts etc, make all people involved learn. Today with Reddit and co people are divided, gurus with gurus, newcomers with newcomers, these are Indian castes with extremely little "social mobility" and that's a large part of why the mean culture is collapsed and almost all new projects not only in FLOSS but in the whole society are failures;
- lack of a good software base, modern software designed by commercial/managerial needs are CRAP, even the finest one, not because the code is crap, but because the environment is. An OS need to be a single application where anyone can automate their small bits at their competence level, this mode was killed because compartmentalizing anything means more products to sell, this is technically unsustainable and most modern people works in such environments and many young have no idea of the old mode and it's power, as a result good tools left behind, those who know them isolated, newcomers suffer from the lack of proper tooling and can't progress;
- finally the "slavery flat line with a dot on top", meaning only few nowadays do things, the giants, others are essentially their slaves. Most companies have no iron, no operation in house, just sitting on the shoulders of giants, using their iron and operation through their interfaces/services. This means the social FLOSS ecosystem does not exists anymore.
More and more people burned by this model try to go FLOSS, off the cloud etc, but they lack tools and competence and resurface from such disaster it's damn not easy since still the largest part of the world is in the barbaric land of the giants where even damn simple things are complicated because that's makes the money for someone.
- there is no FLOSS culture in most people, so the classic model "I publish and maintain my code, others get it from free and give back their improvements equally for free" does not work anymore in most cases. Collaboration culture seems to be very diminished, some try be moral police, some simply do not care etc;
- mere widespread lack of competence mixing, in the past with usenet newcomers and gurus was together, interact and share visions, doubts etc, make all people involved learn. Today with Reddit and co people are divided, gurus with gurus, newcomers with newcomers, these are Indian castes with extremely little "social mobility" and that's a large part of why the mean culture is collapsed and almost all new projects not only in FLOSS but in the whole society are failures;
- lack of a good software base, modern software designed by commercial/managerial needs are CRAP, even the finest one, not because the code is crap, but because the environment is. An OS need to be a single application where anyone can automate their small bits at their competence level, this mode was killed because compartmentalizing anything means more products to sell, this is technically unsustainable and most modern people works in such environments and many young have no idea of the old mode and it's power, as a result good tools left behind, those who know them isolated, newcomers suffer from the lack of proper tooling and can't progress;
- finally the "slavery flat line with a dot on top", meaning only few nowadays do things, the giants, others are essentially their slaves. Most companies have no iron, no operation in house, just sitting on the shoulders of giants, using their iron and operation through their interfaces/services. This means the social FLOSS ecosystem does not exists anymore.
More and more people burned by this model try to go FLOSS, off the cloud etc, but they lack tools and competence and resurface from such disaster it's damn not easy since still the largest part of the world is in the barbaric land of the giants where even damn simple things are complicated because that's makes the money for someone.
For the only significant upstream OSS contributions I've made I was being paid a pretty good tech salary to make them. The first major contribution happened because the organization I worked for was still in an incubation mode and wasn't on the hook to show any P&L results. The second and third major contributions happened because they shipped on a proprietary platform that was built on top of an OSS release, and the company didn't want to maintain those parts in the proprietary layer.
After I left the first company they provided zero maintenance support for the major upstream feature, and I won't maintain it on an individual basis because life moves far too quickly for that. Occasionally I'll happen to run across exasperated posts along the lines of, "Help this is broken for me! Why is my patch being ignored? Is this even maintained any more??"
Chances are you only care because the company you work for wants it done so they can make some money off a product they're building with it. Half an hour dealing with some random patch and/or bug report for an upstream thing I did 10 years ago is half an hour less I have to spend with my daughter before she leaves for college. Nope, fuck you and your bug report.
No, you can't even pay me to fix it. I have a job, and it's already taking more of my limited time on this earth than I want it to take. The email address I used to submit those patches was deactivated when I left that company, and I ain't handing out my current one.
For any minor contributions I made I had to convince the powers that be that there was no real IP or competitive value in maintaining the patch ourselves, and they after much hand-wringing and delay they finally let me push a few small patches up to the maintainers. In hindsight that ended up being more trouble than it was worth because I wouldn't have been the one needing to maintain that patch in the long run. I should have just submitted it to the company-internal repo and let the next guy deal with maintaining that patch.
In spite of all that, my contributions are still there. They still provide tons of value to both individuals and to companies that mooch off of them. Somehow at some point someone somewhere steps up after enough time has passed to review and merge a patch or fix a bug. Or the bug report just withers and dies, and the world keeps turning.
After I left the first company they provided zero maintenance support for the major upstream feature, and I won't maintain it on an individual basis because life moves far too quickly for that. Occasionally I'll happen to run across exasperated posts along the lines of, "Help this is broken for me! Why is my patch being ignored? Is this even maintained any more??"
Chances are you only care because the company you work for wants it done so they can make some money off a product they're building with it. Half an hour dealing with some random patch and/or bug report for an upstream thing I did 10 years ago is half an hour less I have to spend with my daughter before she leaves for college. Nope, fuck you and your bug report.
No, you can't even pay me to fix it. I have a job, and it's already taking more of my limited time on this earth than I want it to take. The email address I used to submit those patches was deactivated when I left that company, and I ain't handing out my current one.
For any minor contributions I made I had to convince the powers that be that there was no real IP or competitive value in maintaining the patch ourselves, and they after much hand-wringing and delay they finally let me push a few small patches up to the maintainers. In hindsight that ended up being more trouble than it was worth because I wouldn't have been the one needing to maintain that patch in the long run. I should have just submitted it to the company-internal repo and let the next guy deal with maintaining that patch.
In spite of all that, my contributions are still there. They still provide tons of value to both individuals and to companies that mooch off of them. Somehow at some point someone somewhere steps up after enough time has passed to review and merge a patch or fix a bug. Or the bug report just withers and dies, and the world keeps turning.
As I have said before, here and elsewhere:
I would love to work on open-source full time, but I exist in a capitalistic hellhole which employs violently coercive methods - the constant threat of homelessness, destitution, and even death - to ensure I remain “sufficiently profitable” to someone else who already has more wealth than I could ever spend in a dozen lifetimes.
If UBI is ever implemented in Canada to an effective degree, you can bet both your left titties that I would be able to afford the time to contribute. But now? I’m just struggling to tread water.
I would love to work on open-source full time, but I exist in a capitalistic hellhole which employs violently coercive methods - the constant threat of homelessness, destitution, and even death - to ensure I remain “sufficiently profitable” to someone else who already has more wealth than I could ever spend in a dozen lifetimes.
If UBI is ever implemented in Canada to an effective degree, you can bet both your left titties that I would be able to afford the time to contribute. But now? I’m just struggling to tread water.
Hm, sounds the same as the concerns about the fields of teaching, nursing, eldercare and childcare. Interesting parallel.
I've long wondered why FOSS developers of successful software don't offer some kind of financial bounty for whistleblowers who reveal that a given legal entity is violating the terms of their license.
Like, I release pretty much everything I create into the extended public domain (CC0/the Unlicense/0BSD), so I very intentionally have no dog in this race, but for those who make different choices for me regarding their public contributions, it just seems logical. Maybe it's just impossible to sue someone for violation of the GPL in a way which makes it easy to come out financially ahead, though.
Like, I release pretty much everything I create into the extended public domain (CC0/the Unlicense/0BSD), so I very intentionally have no dog in this race, but for those who make different choices for me regarding their public contributions, it just seems logical. Maybe it's just impossible to sue someone for violation of the GPL in a way which makes it easy to come out financially ahead, though.
as an inexperienced, thankless issue-raiser in this world, i can give my 0.02 on this.
a lot of open-source today seems like the charitable organizations of the world. the idea is to give selflessly, but a lot of it has become about lowkey entitlement, just because "nobody else is doing it" or will do it without our support.
on the other hand, i do empathize with the double-edge nature of accessibility to open-source platforms. while using git can still be a daunting task, raising issues or "contributions" has become easier than making a ticket in most teams' Jira. again, you can choose to adapt to the platforms or just have a simple one that you control. i might raise well-thought out issues once in a while when it affects my work projects, but i will not even consider using the mailing list for a linux kernel issue. maybe that is a good way to get rid of the noise.
i envy those who could generously give and also enjoy the process of just coding for its sake. those who don't do open-source with these ideas should not be asking for anything in return. we are not owed anything, no matter what good can come out of our work.
a lot of open-source today seems like the charitable organizations of the world. the idea is to give selflessly, but a lot of it has become about lowkey entitlement, just because "nobody else is doing it" or will do it without our support.
on the other hand, i do empathize with the double-edge nature of accessibility to open-source platforms. while using git can still be a daunting task, raising issues or "contributions" has become easier than making a ticket in most teams' Jira. again, you can choose to adapt to the platforms or just have a simple one that you control. i might raise well-thought out issues once in a while when it affects my work projects, but i will not even consider using the mailing list for a linux kernel issue. maybe that is a good way to get rid of the noise.
i envy those who could generously give and also enjoy the process of just coding for its sake. those who don't do open-source with these ideas should not be asking for anything in return. we are not owed anything, no matter what good can come out of our work.
Open source maintainers get a kit of "clout" and respect, and they can use this experience to get high paying jobs at big companies. I know of a few people who clearly do this.
> Small wonder then that the maintainer population is aging – not enough newcomers want the undercompensated, unappreciated job.
Small wonder that some might not want to do that, but it doesn't explain why fewer people than previously would want that responsibility, especially if the population of developers has increased.
My guess is that people are less interested in taking over other people's projects than in starting their own.
Small wonder that some might not want to do that, but it doesn't explain why fewer people than previously would want that responsibility, especially if the population of developers has increased.
My guess is that people are less interested in taking over other people's projects than in starting their own.
> and have become less trusting of contributors following the xz backdoor
That's almost certainly a good thing. Over the last decade plus of my using GitHub on three different occasions I have wandered into a project, submitted a pull request, and the author has simply given me full write access to the repo without my asking. I didn't want it. I didn't ask to be a maintainer of this project.
People can be really weirdly not unconcerned about security.
That's almost certainly a good thing. Over the last decade plus of my using GitHub on three different occasions I have wandered into a project, submitted a pull request, and the author has simply given me full write access to the repo without my asking. I didn't want it. I didn't ask to be a maintainer of this project.
People can be really weirdly not unconcerned about security.
And openly attacked, derided, and pushed out by organized gangs of activists who will use your community like cannon fodder to virtue signal and push their ideology.
I don't know how we resolve this. Some things are excellent because open source allows an individual to make what they want without answering to a boss or whatever and then if it gets popular, it comes with responsibilities but probably little or no pay.
As someone who did a lot of volunteer work, these issues resonate with me -- painfully so.
That's probably my primary motive for reading such articles when I'm not really a programmer.
As someone who did a lot of volunteer work, these issues resonate with me -- painfully so.
That's probably my primary motive for reading such articles when I'm not really a programmer.
Also OSS maintainers bear the brunt for interoperability projects while the startups built on those same libraries get handsomely VC funded without ever contributing back.
Any institutionally funded project should be forced to take a percentage of the raise and pay it to the OSS projects/dependencies (even the deep ones they dont see).
thanks.dev is a good platform that does this well.
Any institutionally funded project should be forced to take a percentage of the raise and pay it to the OSS projects/dependencies (even the deep ones they dont see).
thanks.dev is a good platform that does this well.
There ain't no justice so don't expect any. Either join the filthy dogfight or not. I prefer to not.
There used to be a culture of respect for talent and work in OSS. That is gone in many projects. Python for example is now run by repressive bureaucrats who abuse the infrastructure to intimidate and coerce people. Those who do not obey are slandered, libeled and banned, so they have no recourse to defend themselves against the libel.
Python is a great example how OSS can be stolen by a small dominant clique that is active on Twitter (now Mastodon) and markets themselves as leaders while having done very little actual work in the past 15 years.
All of this is enabled by Python's propaganda arm, the PSF, which is filled to the brim with mediocre members, most of whom haven't done anything at all but who brag with @psf in their Mastodon and GitHub bios.
It is all smoke and mirrors now.
Python is a great example how OSS can be stolen by a small dominant clique that is active on Twitter (now Mastodon) and markets themselves as leaders while having done very little actual work in the past 15 years.
All of this is enabled by Python's propaganda arm, the PSF, which is filled to the brim with mediocre members, most of whom haven't done anything at all but who brag with @psf in their Mastodon and GitHub bios.
It is all smoke and mirrors now.
Are there even unions for open source maintainers/contributors?
> [Linus] also said it's far too early to give up on Rust in the kernel as it's still early days.
Did I miss something? This sounds like they’re thinking about giving up on rust.
Edit: this from the lead working on it:
> "I am retiring from the project," Filho declared. "After almost four years, I find myself lacking the energy and enthusiasm I once had to respond to some of the nontechnical nonsense, so it's best to leave it up to those who still have it in them."
It truly is the most toxic community. I’m just glad I’m not to feel like the only seeing / be affected by it.
Did I miss something? This sounds like they’re thinking about giving up on rust.
Edit: this from the lead working on it:
> "I am retiring from the project," Filho declared. "After almost four years, I find myself lacking the energy and enthusiasm I once had to respond to some of the nontechnical nonsense, so it's best to leave it up to those who still have it in them."
It truly is the most toxic community. I’m just glad I’m not to feel like the only seeing / be affected by it.
If you want to get paid for software, open source isn't the answer. Charge for support or have commercial licenses in place.
I wish there was a better solution to this crisis. There should be a corporate tax on software companies solely to fund open source efforts or something of the like.
Some open source projects have merged into one umbrella organization to better solicit sponsors but I don't think that will lead to anything fruitful, more so lead to a thing like Canonical where there's a profit motivation to the project
Some open source projects have merged into one umbrella organization to better solicit sponsors but I don't think that will lead to anything fruitful, more so lead to a thing like Canonical where there's a profit motivation to the project
Want to just briefly mention, since the article doesn't mention it at all, the blatant conflict of interests:
> open source project maintainers are not being paid for their work, spend three times as much time on security than they did three years ago, and have become less trusting of contributors following the xz backdoor, according to open source package security firm Tidelift.
> Tildelift: Reduce security risk from bad open source packages
> open source project maintainers are not being paid for their work, spend three times as much time on security than they did three years ago, and have become less trusting of contributors following the xz backdoor, according to open source package security firm Tidelift.
> Tildelift: Reduce security risk from bad open source packages