Open source maintainer Jordan Harband on why paying maintainers improves open source security

Shortly after the xz utils backdoor hack was uncovered, Tidelift gathered together a group of open source maintainers across the Javascript, Java, and Python ecosystems to hear not only how the xz hack impacted their work (spoiler alert: this attack reverberated across ALL ecosystems, not just in the Linux OS!), but also how it made them feel.
In this clip, we hear from JavaScript open source maintainer, Jordan Harband. Here he breaks down why
You can watch the entirety of the panel on-demand here: explore.tidelift.com/c/life-a...
Learn more about xz: tidelift.com/resources/xz-bac...
Transcript:
While it's great to pursue automated fixes, the real problem is trust of humans. And if you want to increase your ability to trust humans, you need to both ensure that they are not incentivized to do bad things, and you also want to have leverage over them. And injecting capital into their projects is a pretty good way to achieve both. So I feel like while money is not the answer, it seems like it's the fastest, like lowest hanging fruit available at the moment. When enough money isn't the big problem, then we can look at what the next step should be. But we're a long way away from that state.