Most open source maintainers still consider themselves hobbyists, despite compensation pledges

Despite a major push to strengthen the security of the software supply chain, a report released Tuesday from Tidelift shows more than 60% of open source maintainers describe themselves as unpaid hobbyists.

The report highlights a continued gap between the use of open source software by government and private industry and the lack of compensation for the workforce behind those projects.

Only 13% of the 300 maintainers surveyed consider themselves professional maintainers who derive most of their income from open source project work. About 23% call themselves semi-professional, deriving some of their earnings from maintaining projects.

Open source is widely used by federal agencies and enterprise users, however without the ability to properly compensate maintainers it remains extremely difficult to screen applications for vulnerabilities.

The report comes just two months following the release of the national cybersecurity strategy, a comprehensive road map to build a more resilient technology infrastructure across the U.S. in order to protect millions of consumers and critical industries from malicious hackers and other threats to data security.

Between 70% to 90% of modern commercial software includes open source components, which means the only way to secure most modern applications would require open source software to meet higher security standards.

However, unpaid maintainers do not have the time nor the resources to bolster that security under existing compensation models.

Tidelift CEO Donald Fischer said there is a pretty straightforward way to move forward. The industry needs to provide them with both the “income and process support and the assistance to go apply these secure development standards to their projects,” Fischer said.

The Log4j vulnerability highlighted an equity crisis where wealthy stakeholders from Silicon Valley generate billions of dollars in profits off the back of open source developers, but have previously failed to make the necessary investments to properly compensate these workers for their time and efforts.