This is a good article, and 99% of this article I agree with. I'm going to quibble at something very small, not because I think the author is guilty or anything or because they're doing something wrong, but because this is a general pattern I've been seeing over and over again in multiple takes from multiple people: it feels weird to me to have a criticism of corporate behavior where corporations don't know how to ensure the continued success of the commons they build on, and to title this that "Open Source" is broken.
If a bunch of hunters go out and shoot all the ducks to extinction, you don't title an article that ducks have failed as a species, you say that duck hunting is a problem. And I've seen a few different articles now talk about how Open Source devs need to get better about setting up contracts and finding sponsors, or saying that this reveals a fundamental problem with Open Source, and I just don't get why we're laying this at their feet.
The big companies who's stuff broke because of Log4j have both a giant legal department with infinitely more resources than any single developer available to them to figure out how to kick money to these projects. And this is something that article touches on, which it describes completely accurately: there are developers who build this stuff that do not want it to be a professional thing, and they should still be compensated. There are developers who don't want compensation in the form of money, they want additional development resources or dedicated people helping them triage bugs, and that's a legitimate need that companies could start learning to provide. Volunteer developers should not need to learn how to set up an LLC or a nonprofit to get some compensation for their work if their work is important; the idea that compensation is dependent on a very specific model of professionalism and that it's incompatible with people doing something as a hobby is just wrong. The author does a good job of pointing this out that Open Source funding often looks different from commercial funding. A quote even admits:
> Okay, part of this may also be an ADHD thing and not really being able to stick to projects longer term.
But the thing is, that's OK. Like, you should be able to be in that position and to jump around between projects and if a company really cares about it it's still their job to give you money or to invest resources and maintainers into the project to make your life easier. This should not be conditional on you turning your work into a full-time job with years of commitment. But even as I praise the article for that phrasing, and even though I suspect this is something a lot of people agree with, I'm still frustrated that we don't get a bunch of articles that say "corporate financing is broken and unsustainable" or "our culture about funding and who/what deserves money is broken." We get articles that say that "Open Source" is broken.
I know that I'm kind of just quibbling over something small, and I know this is if anything the wrong article to even post this rant under. I don't want to make needless conflict over something where the author is mostly just right and in many cases saying the same things I'm saying. But I do kind of think this phrasing is important. My objection is I think the phrasing here implies to people (unintentionally) a kind of unconscious bias that this is Open Source's problem to solve. But the commercial companies broke and went into panic mode because they weren't willing to invest into the infrastructure that they rely on. That is their problem to solve, they are the ones on fire. They have the resources and they are capable of learning how to give money directly to developers. Maybe it's a cultural problem that they need to work on that's just ingrained in business heads; I somehow doubt we're going to get a bunch of corporate think-posts on LinkedIn about that framing though. Companies should be expected to occasionally evolve themselves instead of having everybody constantly hold their hands and console them that we understand that large direct donations and regular investments are just ever so scary and difficult to do and that this is a systemic problem with the community, not a direct problem with their individual behavior as an individual company.
Funding for Open Source is a serious problem, but I'm kind of tired of seeing article titles and phrasing implicitly suggesting (again, I think completely unintentionally in this case) that it's the Open Source community's problem to solve. You all use our stuff! This is your problem, your stuff broke because projects were underfunded. Why is it our job to make our funding methods more comfortable to you? The company's stuff breaking because their lawyers are irrationally scared of straight no-strings-attached donations is their problem. Let commons be commons, get over the short-sighted thinking that says companies can't possibly invest into making their products not fall over and catch on fire randomly unless they get something exclusive out of that investment. Or if they're incapable of doing that, stop giving them sympathy and treating their irresponsibility like it's everybody else's job to solve. They'll learn to fund Open Source, or their stuff will break in embarrassing public ways that make them look bad, and maybe after a while they'll start learning some heckin lessons from that.
This is something that (outside of the title) the article does a good job of reinforcing: build the software you want to build, and don't let leaches pretend that gives you an extra obligation to them. Particularly don't let leaches argue that your inability to keep leaches away is your fault. Honestly, the Log4j maintainers would have been completely justified in saying, "hey, yeah, we see this critical vulnerability, but it's the weekend, we'll get to it on Monday."