Unpaid Maintainers: The Security Threat No One Is Talking About (yet)
summary
Surveyed maintainers report 60% unpaid and 58% have considered quitting, with many projects aging and contributors dropping under 25. The xz utils backdoor and other supply‑chain incidents expose risks when maintainers lack time or pay. Paid maintainers implement roughly 55% more security and maintenance practices and prefer predictable monthly income, enabling proactive fixes; case studies include Jackson and urllib3 re‑architecture and a customer Python app where 29% of packages become contract‑maintained.
AI-written summary · about
chapters (12)
- 0:00Introduction to unpaid maintainers
- 1:47Open source dependency risks
- 3:12Real-world supply chain attacks
- 6:25Survey findings on maintainers
- 7:49Aging maintainer community
- 9:36How organizations can help
- 13:11Security practices gap
- 15:43Case study Jackson DataBind
- 16:46Case study yarl
- 17:52Business case for contracts
- 20:43Actionable next steps
- 22:55Q&A session
related talks
29mUnpaid maintainers: The Security Threat No One Is Talking About (yet)
35mPay the Maintainers: xz utils Hack Highlights the Dangers of OSS Maintainer Burnout
34mInsecurity in Security: Maintainer Support in
14mWhat can we do to make Open Source more sustainable?
36mWho Will Maintain the Future? Tackling the Graying of Open Source Software
32mRebuilding the Cathedral
45mOpen-Source Maintainers are Jerks!
09mMaintaining the Maintainers