Who Pays for the Code Everything Runs On

Several files this desk has published converge on the same point. The six per cent remediation rate at 26-0410. The maintainer capacity gap at 26-0321. The vulnerability enrichment backlog at 26-0405. The designation gap at 26-0216.

None of those is a technical problem. Each is a consequence of infrastructure that is universally depended upon and voluntarily maintained.

A firm using an open-source library captures the full benefit at zero cost. Contributing back is optional, and the firm that does not contribute is more profitable than the one that does.

That is a textbook collective action failure. It has been recognised for two decades and addressed through foundations, corporate sponsorship and grant programmes — all of which help and none of which have changed the underlying arithmetic.

The arrangement was tolerable while the demands on maintainers grew slowly. Discovery capability of the kind filed at 26-0404 changes the input rate by an order of magnitude against a maintenance capacity that has not moved.

A system absorbing findings faster than it can fix them accumulates known unfixed defects indefinitely. That is the mechanism, and it does not require any adversary to be involved.

Levy commercial users proportionately to dependency — hard to assess, easy to avoid, and hostile to the openness that made the ecosystem work. Fund from the public purse — politically difficult, and awkward for software with no national home. Accept the status quo — which is the current choice, made by default rather than deliberation.

This desk does not have a recommendation. We have a database in which the same unfunded dependency appears as the root cause of files in four different sections, and an observation that nobody is being asked to choose.