Unpaid maintainers: The Security Threat No One Is Talking About (yet)
summary
Claim: most maintainers are unpaid and fragile — 60% unpaid maintainers and 60% have considered quitting or quit — so dependency risk is real. Evidence: the xz utils social‑engineering attack exposed gaps that were only caught by a vigilant engineer. Paid maintainers implement 55% more security and maintenance practices; examples include Jackson‑databind being rearchitected to remove RCE risk and a maintainer takeover of minimist financed via Tidelft partnerships.
AI-written summary · about
chapters (17)
- 0:00Unpaid maintainers threat
- 1:57Reality of volunteer maintainers
- 4:06Open source trillion-dollar role
- 7:18XZ utils hack warning signs
- 9:292024 Maintainer Survey overview
- 10:5760% maintainers unpaid
- 12:40Maintainers quitting over pay
- 14:05Roads and Bridges report
- 16:09Sustainable open source support
- 17:56Who pays maintainers today
- 19:21Government funding slow
- 20:49One-time donations fail
- 21:52Fair compensation reimagined
- 22:56Paid maintainers more secure
- 24:19Paid maintainers impact cases
- 26:50Actionable steps for orgs
- 27:56Call to action
related talks
28mUnpaid Maintainers: The Security Threat No One Is Talking About (yet)
35mPay the Maintainers: xz utils Hack Highlights the Dangers of OSS Maintainer Burnout
34mInsecurity in Security: Maintainer Support in
37mStrengthening the Cybersecurity Ecosystem
32mBuilding a secure future using DEVSECOPS practices and technologies
39mOpen source security: who’s responsible?
16mAre we Forever Doomed to Software Supply Chain Security?
41mThe Silent Open Source Crisis: When Maintainers Walk Away