Changelog

Everyone knows that React is one of the most popular JavaScript libraries for building user interfaces — and many users of React choose it because they think it’s supported by Facebook. But is it really? That depends on what you mean by React, and what you mean by support. Keenan Szulik writes on the Tidelift blog: Since its release in 2013, React has grown into a proper open source phenomenon … with more than 100,000 GitHub stars, over 300,000 dependent repositories, and more than 800 contributors. Facebook’s contributions to React and the JavaScript ecosystem around it are truly epic — the stuff of legend. But when we dive into the dependencies of the default create-react-app, only 24 of the 1,103 packages come from repositories in Facebook’s GitHub organizations. That’s less than 3% of the dependencies required to build the “Hello, World” app with create-react-app! So who supports React?

If you’re a maintainer who’s feeling the burden of your open source software, you have a few options to consider according to Richard Littauer — you can… Onboard more maintainers - spread the burden to more of the community Clearly set expectations - explain your software is provided on an “as is” basis Hire a maintenance company - wait, what?! Is that we’ve come to? Are we now hiring code maintenance companies to maintain our open source? I’m actually quite interested in the economies around this, so let this post serve as an open invite to Richard to join me on Founders Talk for a discussion on the state of open source maintenance and his lessons learned building Maintainer Mountaineer.

Pia Mancini, CEO of Open Collective: BackYourStack is the first step to help companies discover the dependencies in their stack that are seeking to become sustainable and a way to start subscriptions to them. Each collective can set up different tiers for their subscriptions such us brand visibility, support or in-house training. Just input your GitHub org and BackYourStack will generate a list of supportable projects by analyzing your dependencies. This is a great idea and a good first step toward making it easier for organizations to put their money where their source is. (YMMV as the results are a bit limited (and maybe buggy?) at the moment. Our report is saying we only rely upon 1 open source project, which definitely doesn’t cover it.)

Adam and Jerod invite back Katrina Owen after years away focusing on Exercism—a 100% free platform for code practice and mentorship with over 2500 exercises and 48 different language tracks. They talk to Katrina about how the platform has changed, the direction it’s taken, the backstory on the recently launched version 2, and how she plans to turn Exercism into a sustainable business. Also, what happens if that doesn’t work?!

This post from Eric Holmes details how package managers can be used in supply chain attacks — specifically, in this case, a supply chain attack on Homebrew — which is used by hundreds of thousands of people, including “employees at some of the biggest companies in Silicon Valley.” On Jun 31st, I went in with the intention of seeing if I could gain access to Homebrew’s GitHub repositories. About 30 minutes later, I made my first commit to Homebrew/homebrew-core. If I were a malicious actor, I could have made a small, likely unnoticed change to the openssl formulae, placing a backdoor on any machine that installed it. If I can gain access to commit in 30 minutes, what could a nation state with dedicated resources achieve against a team of 17 volunteers?

This interview with Evan You (founder of Vue.js) is all about the path that led him to being able to work full time on open source. It’s a good read 👍 (Want to dive deeper? We’ve interviewed Evan on The Changelog #184 as well as Request For Commits #12)

Thirteen years ago, Ashley Baxter inherited the family insurance business when her Dad passed away. Even though she’s a talented photographer, and built a successful photography business, the insurance industry kept calling her name. Ashley talks about what excites her about insurance, the challenges of running a business, and how burnout forced her to focus.

In this special episode of JS Party, we’re sharing a full-length episode of our new show, Away from Keyboard. This show explores the human side of creative work. In this episode, Tim talks with Justin Jackson about his parents, dealing with depression, and a new business he’s co-founded.

How do we know whether an open source project is doing well? Number of contributors? Number of users? Number of appearances on The Changelog*? Nadia’s been researching these things: A lot of people are interested in measuring the health and velocity of open source projects. After digging through the current research landscape, I’d like to summarize the most common approaches I’ve seen, and my conclusions here. One conclusion she’s come to is that our current methods aren’t cutting the mustard. Find out why and what some of her suggestions for improvement are in this excellent piece. *yes of course that’s a joke

I first heard of Justin Jackson about six years ago. Back then, he was consulting full-time for a company with the dream of going independent. Fast forward to 2018, and after building a successful business, he’s now embarking on a new adventure. Justin talks about his parents, dealing with depression, and a new business he’s co-founded.

We were just discussing this on a recent episode, and now it’s a reality!? I’m basically giving myself a permanent vacation from being BDFL, and you all will be on your own. After all that’s eventually going to happen regardless – there’s still that bus lurking around the corner, and I’m not getting younger… (I’ll spare you the list of medical issues.) He will not appoint a successor. What happens next?! Not even Guido knows: So what are you all going to do? Create a democracy? Anarchy? A dictatorship? A federation? Grab some 🍿 because this is gonna get interesting!

It’s been four years since Jason Snell left his job at Macworld and started his own site Six Colors. In that time, Jason is back to what he loves: creating. He talks about the diversity of his work day, finding the right mix of revenue streams, and taking a break when you need one.

Danny Crichton, writing for TC: Open source maintainers are exhausted and rarely paid. A new generation wants to change the economics. It’s great to see more-mainstream-than-us news outlets shedding light on the situation. 👌

Pia Mancini joined the show for the first episode back from a nearly 5 year hiatus. We talked about her work at DemocracyEarth, being a first time mother, her new role as CEO of Open Collective, their focus, supporting ad-hoc community formation all around the world, their revenue and growth plans, and their path to sustainability.

Want developers of great software to be able to make a living doing it? Want free trials in the App Store? Join The Developers Union! Dear Apple, We believe that people who create great software should be able to make a living doing it. So we created The Developers Union to advocate for sustainability in the App Store. Today, we are asking Apple to publicly commit — by the tenth anniversary of the App Store this July — to allowing free trials for all apps in the App Stores before July 2019. After that, we’ll start advocating for a more reasonable revenue cut and other community-driven, developer-friendly changes.

Adam is on location at ZEIT Day talking with Jessica Rose about burnout, Henry Zhu about his passions and pursuit of open source, and Simon Willison about data and his passion for interesting datasets in the world.

We’re rebroadcasting the finale episode of the beloved Request For Commits on The Changelog. But don’t worry, we’ll be back with new episodes next week. In this finale episode of Request For Commits, we regroup to discuss the podcast from its start to its finish, lessons learned, community impact, and where the conversations around open source sustainability are taking place, now and in the future. It’s the end of Request For Commits, but the conversations we’ve had will continue on The Changelog. We also have some guest-host appearances for Nadia and Mikeal planned in the near future on this podcast. So, stay tuned.

Julia Evans has finished up her 3 months of funded work on rbspy (thanks to the Segment Open Fellowship) and wrote up her experience. If you can’t tell from the title, she liked it. This was an interesting statement coming from Julia (whose reputation amongst developers is impeccable, if you ask me): Another benefit of doing this was that now I have actual code that I’ve written out in the open on GitHub! I don’t really believe in “github is your resume” (lots of great programmers don’t do any open source work! that’s fine!) but it does feel good to have. One huge benefit to employees who work for open source-oriented companies is that they get to build an open source portfolio on the job. That levels the playing field for folks who don’t have the luxury of disposable free time outside business hours.

In retrospect, becoming a Brave Publisher was a no-brainer. We’re big fans/supporters of: Independent publishers New sustainability models Brandon Eich (listen to this RFC if you haven’t yet) Real-world cryptocurrency use cases So, if you appreciate the news and podcasts we’ve been producing for the past decade, please consider browsing our site with Brave and throwing a few BAT into the proverbial tip jar. 💚

In this finale episode of Request For Commits – we regroup to discuss how we got here, lessons learned, community impact, and where the conversations around open source sustainability are taking place now and in the future. This might be the end of this podcast, but the conversation will continue on The Changelog. You should subscribe if you’re not already.

Andrey Petrov has handed over several projects with varying degrees of success, but he found something that works with urllib3, which has gone through two maintainer transitions. In this post, he shares his do’s (and don’ts) of finding a new maintainer. There’s even a handy checklist at the end. ✅

Donald Fischer: Over the last several months, we engaged with over 1000 professional users and maintainers of open source software through surveys and live conversations. We wanted to learn what’s working for them and what’s not. Turns out, people had a lot on their minds. The result of these conversations was the creation of Tidelift subscriptions, which are described as: paying for “promises about the future” of your software components. Click through to read the nitty, gritty details. There are some interesting opportunities here: Tidelift provides a means for maintainers to band together in a scalable model that works—for everyone. Those who build and maintain open source software get compensated for their effort—and those who use their creations get more dependable software, delivered via a Tidelift subscription.

Jürg Lenhi, writes in this tweet thread: Let’s talk about open-source. I’ve been developing and maintaining Paper.js for years. It has 8,700 stars on GitHub. Multiple big companies have done projects and products with it. Yet donations and sponsored features are very few, and I need to accept other work to sustain a living. There are several more tweets that follow this up with more details from Jürg, but what I found missing, is an awareness of what a healthy relationship for him and this project looks like. If we’ve learned anything from Request For Commits, it is that money doesn’t solve the open source maintainer problem, so donations or Patreon alone aren’t a fix. (Thanks to Cody for sharing this in our community Slack.)

thanks will crawl your dependencies and list their authors and donation links. If you’re an open source author who accepts donations, add yourself to this file and send him a PR.

Talks, blog posts, and interviews about the experience of being an open source maintainer This list is just getting started. Open a PR with your favorite maintainer experiences!