SOS: Sustainable Open Source
summary
Nails the specifics: 97% of 2,400 audited codebases contain open source, licensing shifts like SSPL, Redis Source‑available, Elastic 2.0 and BSL cause forks and vendor exits (OpenSearch), and sabotaged npm packages (colors, faker, node-ipc) actually deleted or hung installs. Maintainer reality is stark — 46% unpaid, 59% considered quitting — so invest in SCA, use OSS Review Toolkit and SPDX for SBOMs, track criticality scores, and budget for sustaining key dependencies.
AI-written summary · about
chapters (21)
- 0:00Sustainable open source intro
- 2:00Open source vulnerabilities causes
- 4:30Introduction
- 6:39License changes impact
- 12:22Restrictive licenses solution?
- 14:11License change case studies
- 17:22Managing licenses in enterprises
- 18:26Maintainer financial challenges
- 20:13Maintainer protest incidents
- 22:01Critical open source projects risks
- 25:32Open source critical infrastructure
- 26:38Log4j vulnerability risks
- 27:47Open source dependency risks
- 28:50SBOM and SCA tools
- 30:38OpenSSF insights
- 31:41Criticality scoring for projects
- 32:26Contributing sustainably
- 33:53Supporting open source steps
- 35:20Authentic participation principles
- 37:08Supporting foundations hiring
- 38:10Conclusion and call to action
related talks
36mSOS Sustainable Open Source
32mSOS: Sustainable Open Source
33mThe Cathedral, the Bazaar, and the Coffee House
47mThe TRUE Cost of Open Source
49mTrustworthy Open Source: The Consequences of Success
27mOpen Source Sustainability and Our Corporate Social Responsibility
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...
23mInvesting in Open-Source