Open Source is Broken, and it’s Our Fault
summary
Many critical products rest on unpaid maintainers, with high‑impact failures like Heartbleed ~$500M cost and the log4j weekend firefight showing systemic risk; some projects go commercial (JSON.NET maintained into Microsoft employment, FluentValidation has 15 sponsors) while others burn out or are abandoned (Nuke used in 100+ pipelines). Practical fixes include financial sponsorship, employer time for triage/docs/PRs, and tooling to measure risk — e.g. the newly released AutoMapper dual-license & 4 releases in 6 months and an OSS Health Claw code skills analyzer that surfaces bus factor and funding gaps.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:12Broken state of open source
- 4:04Open source business models
- 7:36XZ utils backdoor risks
- 9:06Burden of maintaining open source
- 14:01Maintainer options
- 23:36Project collapse and forks
- 26:30How to help sustain open source
- 34:20Open source in AI age
- 36:28Measuring dependency health
- 46:21Call to action
related talks
13mOpen source is broken and it's your fault!
36mSOS Sustainable Open Source
26mTrapped in the Open Source Supply Chain
14mWhat can we do to make Open Source more sustainable?
39mSOS: Sustainable Open Source
01h 01mWe're Building On Hollowed Foundations (...)
37mOpen Source Doesn't Care About You, But You Should Care About It
33mThe Cathedral, the Bazaar, and the Coffee House