Open Source Sustainability and Our Corporate Social Responsibility
summary
Examines the supply chain of express.js (14M weekly downloads) and finds 49 direct dependencies that balloon over time, 88 maintainers with npm only 7% using two‑factor auth (so 93% without 2FA), and most commits coming from a single maintainer nearing burnout. Shows funding is tiny—eslint’s Open Collective budget buys ~1.5 developer-years, Open Collective raised ~$500k in 2020 while Tidelift raised $40M—and argues for treating open source as a commons and a corporate social responsibility.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:06Dependencies
- 2:52Development dependencies
- 4:19Semantic versioning
- 5:27Who holds the keys
- 7:07Whos keeping it safe
- 11:19Statistics
- 14:03Solutions
- 19:45Corporate Social Responsibility
related talks
25mOpen Source Sustainability and our Corporate Social Responsibility
39mSOS: Sustainable Open Source
14mWhat can we do to make Open Source more sustainable?
36mSOS Sustainable Open Source
26mTrapped in the Open Source Supply Chain
33mThe Value of Open Source
25mSustaining Open Source Software: Exploring Community, Financial, and Engineering...
21mIn Pursuit of Open Source