I would love to see a non-profit that's basically, "Apache for contributors". Apache is great for companies who want to de-risk open source software. What about an org that goes, "i see that your project is important to the community, what can i do for you today?" Maybe fund, maybe find contributors, maybe acquire build infra, always listen and support
@kellogh A year or so back, I think the OpenSSF was talking about a model close to this, though focused on helping projects specifically with security-related matters, finding corporations willing to donate developer effort and cash. However, they were targeting projects with large impact for this aid. I don’t know where this effort went.
@jimfl a lot of the dialog this week is around, “oh, projects just need funding”. but that’s already been tried, pure funding approaches, and they seem to lead fairly directly to exploitation in another direction. ultimately, each project needs something different, and a lot of times money has nothing to do with it
@kellogh Protracted attention to something requires a) money, b) love. Corporations are not known for projecting love in detectable amounts. Open source projects are born of it.
@kellogh@jimfl Sounds like maybe you are thinking about Alpha to Omega effort to improve security of key pieces of OSS ecosystem? You can read reports on action taken by ecosystem https://alpha-omega.dev/
Add comment