The Unpaid Backbone of Open Source: Solo Maintainers Face Increasing Security Demands

I made a little "reverse regex" library for fun ages ago. You give it a regex and it generates text from it. I thought of it as a toy, but people found use for it in unit testing. Eventually, someone forked it and added better test support because I am the world's worst maintainer.

Anyway, I only say this because I learned that it is shockingly easy for some throw away idea you put up on GitHub to suddenly become the unpaid backbone of somebody else's CI pipeline. Then, you're getting angry PR's and tickets about how a security issue or an unpatched dependency in your toy library NEEDS to be fixed and now you've got a new unpaid job!

Or you do what I did and abandon the project so one of the poor fools actually using it in production needs to maintain it. Us programmers though, we like when our code is being used, we like to help people, we want the work we put out there with our name on it to be a good representative of us, to show us as helpful, hard-working, and dependable. It can be so easy to fall into this feeling that because you wrote it, you "owe" your users some ongoing commitment.

And those users are often themselves beholden to their bosses, just trying to find the least-effort solution to get back to what they wanted to be working on. The shit all rolls down hill and ultimately I think our industry needs massive structural changes to thrive. I honestly sometimes muse about a return to the guild system. All feature requests and bug reports (and I mean like, globally, ALL tickets) come to the Guild and we shall assign them out under the principle of mutual aid (from each member according to ability, to each member according to their needs). In this way, the Guild will carefully train the next generation of holy adeptus mechanicus and make broad decisions on how technology can best serve the people.