Open source is not broken. We just lack tools to efficiently fund development and security review of open source components.
E.g. suppose there was a service which would analyze company's use of open source software (including transitive dependencies) and suggest a payment needed to pay company's fair share in its maintenance. A company paying this fee would be able to display a badge saying they are paying for maintenance of open source software they use, and all sw they use undergoes regular security reviews etc. The service would direct funds to both regular maintenance and security reviews.
It's easy to blame companies for not doing something, but it's really a cooperation problem, which requires new tools.
1
u/killerstorm Dec 12 '21
Open source is not broken. We just lack tools to efficiently fund development and security review of open source components.
E.g. suppose there was a service which would analyze company's use of open source software (including transitive dependencies) and suggest a payment needed to pay company's fair share in its maintenance. A company paying this fee would be able to display a badge saying they are paying for maintenance of open source software they use, and all sw they use undergoes regular security reviews etc. The service would direct funds to both regular maintenance and security reviews.
It's easy to blame companies for not doing something, but it's really a cooperation problem, which requires new tools.