Open source maintainers underpaid, swamped by security, going gray The majority of open source project maintainers are not being paid for their work, spend three times as much time on security than they did three years ago, and have become less trusting of contributors following the xz backdoor, according to open source package security firm Tidelift. Small wonder then that the maintainer …
It can also explain the resistance towards new thought / change, for example the adoption of Rust: older people (and yes, I'm one) are more likely to be intransigent and resistant to change, 'What worked before' and all that. "I climbed a hill going to school, both ways, and you'll do the same!" hack wheeze
Now get off my lawn.
This post has been deleted by its author
Have you seen what most people in tech are paid?
The high paying roles are actually less common than you think. Unfortunately, we're still very much the "get away with as little as possible" staff still...I can guarantee that most of you here working on teams, are not being paid equally and fairly compared to 1 or 2 other team mates on the same team doing the same work, or in some cases more.
I'm personally freelance, so I set my own rates based on market value and whether or not I want to help out a fledging business for a low price because it is interesting...but in house permies get shafted all the time...I've seen pay gaps that are tens of thousands in size but I can't bring it to their attention for confidentiality reasons. The most egregious was on a team of 8 people at a web agency. All 8 people had the same work load and job description...one of them was earning £80k a year...three of them were on £50k...and four of them were on £30k or less...weirdly the higher paid ones had been there the shortest time.
I've actually managed to poach some seriously good talent and flip it to freelance with very little effort because of such low shitty pay. All you need to do is train them up for free while they're still in their shitty position, take them for a beer when they're ready, have a quick chat, set them up with a fixed contract or two that pays at least their salary, but takes up half the time and removes the commute and you have talent you can tap into on demand or share a contract with.
If you work for a sweat shop that hires freelancers occasionally or has a long standing contract techie that seems to have been around forever but has the execs over a barrel, talk to them...ask them to set you up...there is a good chance they will because they're frequently looking for ways to offload some of their work load to other freelancers they can trust.
Just don't try and screw them, if they're anything like me, they will be very willing to help you get started and will probably mentor you for free...the part of the deal that is sweet to them is holiday cover and the ability to take on contracts they can assign or handover to people they trust when they've completed the task they were hired for rather than handing back to a sloppy in house team.
I have successfully cloned myself at least half a dozen times.
https://www.statista.com/statistics/416102/average-annual-gross-pay-percentiles-united-kingdom/
"In 2023, the average annual full-time earnings for the top ten percent of earners in the United Kingdom was 66,669 British pounds."
I'm not sure why you think that an unspecified job at a web agency should automatically put you way into the top 10% of all earners across the country, even the top 20% at £50k, or that something that 40% of UK wage-earners get is somehow "low shitty pay" - .
If you can manage those wages, great, good for you. But maybe the higher-paid ones are short-term talent that aren't required for the entire thing as a full-time member of staff and they know it, while they also need a bunch of people to deal with the day-to-day and wouldn't want to be paying them £80k+ all the time to do that.
That, in fact, sounds like a pretty good spread - 4 on £40k, 3 on £50 and 1 on £80k. That sounds like every team structure ever, regardless of actual length of service, if you're going by talent, experience or responsibility. In fact it sounds a little high for what it basically a desk job. Regardless of the work load or job description, you will get people worth that much. Maybe the £30k people should have asked why they're not getting that, and maybe the £80k people should have fought for their team to be equal if they were truly equal. I'm going to guess that they were NOT equal. In fact, I'll guess that the employer knows exactly what they are doing and expect the top tier to bow out and get better jobs elsewhere on a regular basis and knows that the lower tiers will be more reliable and stay where they are. Who wants to spend 2.5 times someone else's salary on someone who - quite literally, as demonstrated by your post - will be trained up and disappear regularly and not do not much than someone earning less? Nobody. They know exactly who they are paying more, and why, and they expect them to last far less than others (hence "shortest time"). The others aren't going to get there until they are actually proven valuable enough in that role to earn more money and be more valuable.
You spend money on talent, to hope to retain them, and you let the others coast or disappear if that's what they want and if they aren't showing they're capable to you. Maybe they are capable. Elsewhere. Let someone else find that out. And then hire them back on the higher salaries if that's the case. But I would hazard that those employers know exactly what they are doing.
And I've been in that exact position - earning more doing the same job description for a very clear set of reasons that previous managers even put to the test on occasion to demonstrate why I was getting more. Quite literally "If you're going to be repeatedly bitter about his wages / responsibilities / privileges, let's show you why" and then given fair tests to demonstrate relevant skill... I finished the task (a genuine real-world project that we all started at the same time with the same info and resources, for a real required purpose, in parallel) in 4 hours. They still had never completed it when they left a month later (and actually got out of the industry entirely because they realised they had no aptitude for it).
Just because two people work in identical roles, in the same team doing the same tasks does NOT mean they are equal, equally valued by the employer, or equally deserving of compensation, promotion, responsibility etc. I've been demonstrating that for much of my career.
And the lowest-paid being there longer? Yes, have you heard of the Peter Principle?
For reference I'm between your top two salaries mentioned there. It's a damn good wage. I worked freelance for 10 years and you couldn't pay me enough to do that again. I literally chose not to go that way. I received a serious full-time contracted offer of £650 a day (1 year contract so £200k+ guaranteed) back in 2004 / 2005 for a large tech firm... but it was doing things I utterly disagreed with (mis-selling poorly-built "cloud" Linux-based systems - before cloud was a thing - as Windows server replacements to places that couldn't afford it), and I told them to stuff it. They were absolutely flabbergasted. I was after factors other than money and after having ripped apart their product and services (was given a demo account on their live system, literally got full root access to their servers in about 20 minutes, left a note on the admin's desktop with everything I'd done, all the problems I'd spotted - security, technical, legal, practical etc.) they wanted me on board to mis-sell it to others. Nope. Even my boss thought it hilarious that they'd try because they knew I'd never work for a place like that.
So... no... paying people different amounts isn't screwing them over. And those wages are far from poor. And why tech should ever be considered to automatically be in the upper-echelons of wage-earners, I simply don't understand. Most people in tech are the factory workers of today, not the inventors.
And you'll find that people like open-source kernel maintainers especially - you couldn't pay a "talent" from a contractor, agency or even a big tech company, enough to do that job to everyone's satisfaction. The people at the top of the game in that industry are given incidental jobs BECAUSE they are at that level without any compensation, they don't get there because a job description tells them they are now the kernel maintainer. It's like tenure and professorships for the Nobel prize winners, and is literally that rare (there are far fewer Linux kernel maintainers than Nobel prize winners, and there are what... maybe 2 or 3 OS kernels in active use on that scale?). Their job is entirely incidental to their existence and actual chosen role (like Linus working for Transmeta).
I'm glad that industry people are starting to fear that the projects they make money out of and pay nothing for just might end up not being supported any more.
When that happens, maybe industry will think of a remuneration package for new maintainers. Oh, of course, it will be new young maintainers with a vast lack of experience and all the problems that may ensue but hey, you only have yourselves to blame for that.
What are you talking about?
Open source software is pretty much as old as the internet and has, therefore, demonstrated both its functionality and quality. Problems can and do occur when components are just thrown togethe with inadequate testing and no effort to monitor the projects. But we see this all the time with commercial software.
"Open source software is pretty much as old as the internet"
A hair older. Back when MeDearOldDad started using computers (very early 1950s), you paid for the hardware (or access to the hardware). Virtually every bit of code that was not written in-house was available for free, complete with source (if available ... some was machine code in carefully stacked piles of ones and zeros), and you were free to modify it and redistribute it as you saw fit. Not that there was much redistribution back then, but this was mostly due to a lack of other computers.
Fast-forward a couple decades and in 1961 we had the beginnings of DECUS and the Software Library.
It's not that they didn't bother about copyright, it's that the concept of copyright didn't even exist with regards to computer source code until 1974 ... and binaries only caught up in 1983! (See: Apple vs Franklin). For a while there, you HAD to ship source code with your binaries if you wanted to be able to claim a copyright on your software.
Let's be clear: the majority of software released as open source is done with no expectation of payment and with no strings attached. In fact, many developers are happy to see companies be successful with their software.
However, what is becoming a problem is when companies use it and then start asking for stuff, without payment. This is from a recent e-mail from NASA:
Ugh!
This will become more of an issue as companies get to grip with supply chain security. While you are rightly defending FOSS another groups of people are congratulating you for making an excellent point on the lack of assurance with Open Source and hence why it should not be used in a prod environment.
Oh, I think lots of open source, including the OS, can and is used in production. However, this should be done by being aware of the risks and, if necessary, ensuring that support is available. Often this is mainly down to standard sys admin practice about keeping systems up to date, monitoring bug databases, etc. But it may also involve support contracts for things like databases or ensuring you have access to suitably qualified programmers. The risks are the same with proprietary software and, as we regularly see, remediation is often the same.
When it comes to my software, if anyone wants it certified, etc. I'll be happy to offer them a quote…
11% to 27% to 21% in 3 years? I think counting might be part of the issue there.
The years being 2021, 2023 and 2024, I imagine increase from 11% to 27% during the two years 2021-22 was in part due to COVID - losing employment or taking earlier retirement, working from home, and having spare time during the restrictions of 2019-21.
The decrease from 27% to 21% might reflect return to office, increasing demands of work or better (more demanding) jobs, and the loss of the cohort of 65 yo (b. 1959) in 2024 weren't replaced with incoming 44 yo (b. 1979.)
For 0-25 yo the corresponding stats 25%, 12% and 10%. So the 26-45 (+66-99) yo numbers are 64%, 61% and 69%.
While these percentages are ratios it is curious the 26-45 yo (plus the superannuated :) ratios are pretty static. Generally this group are more disciplined than the youngsters but with the spark and creativity that age often blunts.
Absolute (raw) numbers might be more enlightening.
I suspect programming and computing, AI perhaps excepted, are not particular "sexy" for the cohorts < 25 yo. as I am guessing that the area doesn't pay all that well now and job security is non-existent. Most of IT (contrast computer science) is pretty dull and unchallenging for talented individuals who would find more rewarding and profitable uses for their time.
I suspect individuals who develop code for their own use or as peripheral aspect of their employment (where the employer has surrendered any interest in that code) will continue to dump their code on github etc with a CC0 or BSD or GPL-x licence so that any interested party can do pretty much anything with it (CC0, BSD) including maintaining it.
Large cornerstone projects like openssl probably can only continue in the long term with commercial funding or support. I don't know what proportion of the core Linux kernel developers are employed by firms using the Linux kernel in their businesses but is probably quite significant. If the proportion of volunteers on such projects decreases very much, the independence and freedom (libre) of the projects would be imperiled.
Just got to hope for assett prices to crash, especially home property prices
The knock on effects will be bad, very bad, but all junkies have to go into withdrawl
We just gotta suffer man, so the next generation of potential programmers (just hitting their teens) will to be able to afford the luxury of being able to give for free
.... just like the now greying ones were able to do, because they "grew up" before this crazy stupid assett bubble started
Things simply being too big is arguably part of the problem.
A monster set of packages like e.g. KDE or LibreOffice are enormous code bases as well as all the artwork that goes with them. To get sufficiently familiar you basically have to work on it full time.
So how is one supposed to contribute to it?
Compact linuxes have been a thing for as long as one can remember. There's a place for a super compact ground up OS, probably in rust-land. New opportunities to contribute and if component parts kept at a scale one can comprehend, much better for maintenance.
A monster set of packages like e.g. KDE or LibreOffice are enormous code bases as well as all the artwork that goes with them. To get sufficiently familiar you basically have to work on it full time.
So how is one supposed to contribute to it?
Concentrate on just one area, perhaps something that hasn't received any attention recently, and keep working on it until it's "done".
This post has been deleted by its author
On the other hand ... I have been contributing to the FOSS world since before BSD was BSD (and indeed, before Microsoft met an IBM PC). Quite frankly, I have never thought about getting paid for it for one simple reason: It doesn't matter.
Read that again, it's important: It doesn't matter.
I wrote code, created patches, chased down bugs, wrote documentation, and all the other bits & bobs that go into FOSS because I am extremely selfish. I wanted it to work for ME, my way, in my time. Once it worked the way I wanted it to work, it solved a problem that I had, which more than paid for the time and effort that I put into it.
Then I released it to the wild, without caring if anyone else needed it. It's MINE, it scratched my itch ... now, if you have the same itch feel free to make use of my scratching post. No point in you re-inventing the wheel to do the same job ... and better, it frees you up to work on something to fix another itch.
Thankfully, other people have many other itches. In aggregate, over time, we have created something useful.
This is why I think any company that uses open source software in a commercial product, they should either donate money, or employees to help maintain the project.
It''s also why, if I use an open source project regularly, and they have a donation link, I try and donate. One donation probably won't persuade the maintaininer to stay on, but a couple of dozen might..
As for AI contribution it may alleviate in some areas like documentation. Better to have some thing rather than noting. And also for new onboarding contributors to grasp a concept if the provided info is hard to get by. But as for generation of code it would be less effective and create a lot of fix and review work for maintainers that actually do not need simple boilerplate code as starter. In that sense even a wrong documentation could waste their time. At that stage of software development know how every dev would have its own code arsenal snippets repo that most probably he has done before and reuses. AI generated content would be a rework every time they accept it. In the other hand the lack of youth maintainers will also most probably contribute to more hallucinations by LLMs in the future. No or less rationally human generated code feedback will eventually derail the optimization functions and output result of LLMs.
Maybe it's a sign the previous OSS developers did their job too well!
Nothing inspires me to contribute more than a missing feature or a bug getting in the way of what I want to do - yet the majority of popular OSS packages have the basics covered so well that it rarely happens.
And similarly there's less opportunity for starting a new project and be actually competitive than there was before. Chance is you're not the first one to have the problem.
theres nothing different than companies opening up their code under some license but requiring you to sign a cla giving them unrestricted redistribution rights to your code or outright signing a CTA.
CLA + AGPLv3 = no different than having the software under say the MPLv2-no-copyleft-exception
Penny Reciprocal License (PRL) - Draft Terms
1. Grant of License:
The licensor grants you the right to use, modify, and distribute the software, provided that you comply with the terms outlined in this license.
2. Mandatory Minimum Sales Price:
Initial Sale: You are required to distribute the software for at least one penny (or equivalent currency).
Downstream Sales: Any recipients of the software who choose to redistribute it must also charge at least one penny. This requirement applies to both original and modified versions of the software.
3. Modification and Redistribution:
You are allowed to modify the software. If redistributed, you must:
Clearly state the modifications made.
Distribute the modified software under the same Penny Reciprocal License terms, including the mandatory minimum sales price.
4. License Notice:
All copies or substantial portions of the software, including modified versions, must include this license notice to ensure that all downstream users are aware of their obligations under the PRL.
5. No Free Distribution:
Distribution of the software without charging the mandatory minimum price of one penny is prohibited. This term ensures that every participant in the distribution chain receives at least one penny.
6. Disclaimer of Warranty:
The software is provided “as is,” without any warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability or fitness for a particular purpose.
7. Limitation of Liability:
In no event shall the licensor be liable for any claim, damages, or other liability arising from the use or distribution of the software.
8. Termination:
The license is automatically terminated if the conditions of the mandatory minimum sales price are violated.
Key Features and Implications:
Reciprocal Compensation: Ensures that every distributor, including the original author and downstream users, is compensated, even if only minimally.
Sustainability: Encourages a sustainable distribution model where every participant in the chain is guaranteed to receive at least some financial acknowledgment.
GPL Similarity: The PRL mirrors the reciprocal nature of the GPL but shifts the focus to mandatory compensation instead of free redistribution.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
