[wooptoo]

A comment on libxml, not on your work: Funny how so many companies use this library in production and not one steps in to maintain this project and patch the issues. What a sad state of affairs we are in.

[nwellnhof]

About a day after I resigned as maintainer, SUSE stepped in and is now maintaining the project. As announced here [1], I'm currently trying a different funding model and started a GPL-licensed fork with many security and performance improvements [2].

It should also be noted that the remaining security issues in the core parser have to do with algorithmic complexity, not memory safety. Many other parts of libxml2 aren't security-critical at all.

[1] https://gitlab.gnome.org/GNOME/libxml2/-/issues/976

[2] https://codeberg.org/nwellnhof/libxml2-ee

[wooptoo]

Hi Nick, first of all thank you for your work and dedication through the years.

Second, I found this entirely by accident just now: https://www.sovereign.tech/programs/fellowship

> For the duration of the fellowship, one “maintainer-in-residence” will be employed up to full-time (32-40 hours per week) as part of the Sovereign Tech Agency team. > This option offers the maintainer the personal and professional advantages of being part of team, as well as the stability of being employed to continue working on critical FOSS infrastructure. > This position is only available for maintainers located in Germany,

[jawiggins]

Yeah I agree, maintaining OS projects has been a weird thing for a long time.

I know a few companies have programs where engineers can designate specific projects as important and give them funds. But it doesn't happen enough to support all the projects that currently need work, maybe AI coding tools will lower the cost of maintenance enough to improve this.

I do think there are two possible approaches that policy makers could consider.

1) There could probably be tax credits or deductions for SWEs who 'volunteer' their time to work on these projects.

2) Many governments have tried to create cyber reserve corps, I bet they could designate people as maintainers of key projects that they rely on to maintain both the projects as well as people skilled with the tools that they deem important.

[da_chicken]

There should be public works grants to maintain them, or else a foundation specifically to maintain them funded with donations, grants, etc.

The alternative is another XZ backdoor.

[socalgal2]

funny how this myth won't die. Checking the commit history plenty of companies are contributing

redhat, apple, samsung, huawei, google, etc...

[ddlsmurf]

we need a tax on companies using or selling anything OSS, the funds of which go into OSS, the wealth it generated is insane, and it's nearly all just donations of experts

[mlinksva]

Which is approximately all companies because all companies use software and depending on what the researchers look at, 90% to 98% of codebases depend on OSS.

Conclusion: support OSS from general taxation, like the Sovereign Tech Fund in Germany does. It's a public good!

[skybrian]

That's a bit unclear on the concept. It's not open source if you have to pay for it. How about charging money for your code instead?

[da_chicken]

Feels like tragedy of the commons.

[wrboyce]

Feels more like you don’t understand the concept of the tragedy of the commons.

EDIT: Sorry, I’ve had a shitty day and that wasn’t a helpful comment at all. I should’ve said that as I understand it TOTC primarily relates to finite resources, so I don’t think it applies here. Sorry again for being a dick.