|Monetize Open Source Software with XS:CODE|
|Written by Nikos Vaggalis|
|Monday, 22 June 2020|
Introducing XS:CODE, a subscription based service looking to get OSS developers paid for their work.
Even as a hobby, writing OSS is serious work, up to par or even superseding that of closed source software, since hundreds or even thousand of eyes will be looking at your source and judging you. Hence you should be on your top performance.
On top of that, you have treat it as a real world project which has to be launched, managed, maintained and contributed to. Some of the tasks involved in that, as we've explored in "The Open Source Guides To Managing Open Source Software Projects", are to:
Let's not forget the people management aspect too, as well as finding users/clients for your project you also need contributors and ideally a community. Not only does this mean taking care of the project's usability and help others out by reviewing their code or offering them advice, also requires:
While OSS projects are run by people volunteering their time pro-bono, there are instances that some amount of money could be most welcome, such as when:
This is where a new startup, XS:CODE, steps in, helping to monetize OSS projects.The notion is simple - continue writing open source code for the community but charge companies, not for using it, but for providing extra services. So enterprise users would pay to:
XS:Code acts as the middleman taking care of the little details so you just focus on what you do best - writing code. When making a sale, you keep 75% of the revenue.
From that list what I find most important is the frequent updates and priority bug fixing. Since open source is so prevailing and ubiquitous, it has found its way into commercial applications that utilize not just one but a myriad of open source libraries. Many of those don't get updated, are not maintained or simply get abandoned because the maintainer had no time, had family or life constraints or tried to find something more profitable to make a living.
Add to this mix the vulnerabilities that remain unpatched because of the library not getting updated, and you have a volatile cocktail that is more potentially disruptive for companies that use those libraries in their commercial products or infrastructure, for example in a DBMS setting. In fact MariaDB, MySQL and others offer their code for free, but charge for this kind of support.
With regard to the prevalence of bugs that need fixing, Veracode's Stateof Software Security: Open Source Edition, which analyzed 51,000 unique open source libraries across 85,000 applications, concludes:
We are presented with a startling fact — most (71 percent) applications have a flaw in an open source library when they are first scanned.
It’s true that the more libraries a given application includes, the more flaws a developer is going to introduce on average.
The report also brings forward the transitive dependency issue in that the core library itself might not have an obvious vulnerability, but instead carries a transitive one if it has a dependency on an other third party library which is vulnerable itself.
So we have established how important is for OSS libraries or applications to get patched and updated and that's not just the core and most popular libraries. As such I pose two questions to XS:CODE. How do you handle those transitive dependencies when the developer of a core library is paid to do a priority patching, but there's also a lesser know third party dependency that should be patched too?
There's also another way of both strengthening and making money out of OSS which we examined in "Software Security is a Civil Right!" where we discussed the EU initiative kickstarted by the EU Pirate Party because it thought that enough is enough after severe vulnerabilities were discovered in key infrastructure components like OpenSSL.
It is amazing to think that the OpenSSL Software Foundation which is responsible for the maintenance of the OpenSSL library, the cornerstone of safe transactions on the Internet used by millions of websites and organizations, receives just $2000 of donation money per year and has only ONE full-time employee working on the library.
All that was revealed after the discovery of the Heartbleed bug, something that finally shook the waters and motivated the big industry names to support the foundation with proper funding.
As such to serve the wider good, a state-funded bug bounty for mission-critical OSS application audits was kickstarted.
On that line, I think that XS:CODE should also ensure that bug fixes and vulnerability patching, once done for the paying customer, also propagate to the (free) community in due time so that everybody benefits, keeping the OSS spirit and values alive too and not just commodify them.
In conclusion, I hope XS:CODE's initiative is going to bring stability to both OSS developers' and their projects' lives.
or email your comment to: firstname.lastname@example.org
|Last Updated ( Monday, 22 June 2020 )|