[{"data":1,"prerenderedAt":498},["ShallowReactive",2],{"\u002Fideas\u002Fa-research-lab-for-open-source":3,"NoscriptNav_XrRK2e2e8meJ0jKVGkb5ULGQDVi3UiFQ9nupAr7Yns":493},{"id":4,"title":5,"authors":6,"body":8,"canonicalUrl":479,"canonicalWebsiteName":479,"category":480,"ctaAction":481,"ctaLink":406,"ctaText":482,"date":483,"description":484,"disclaimers":479,"embargoReleaseTime":479,"extension":485,"featured":486,"featuredOnHomepage":486,"fullWidthLayout":486,"hidden":487,"image":479,"imageAlt":479,"llmDisclaimer":487,"location":479,"meta":488,"metaImage":479,"navigation":487,"path":489,"seo":490,"stem":491,"venue":479,"venueUrl":479,"__hash__":492},"ideas\u002Fideas\u002Fa-research-lab-for-open-source.md","A Research Lab for Open Source",[7],"vlad",{"type":9,"value":10,"toc":475},"minimark",[11,17,20,42,69,93,106,125,131,134,137,145,243,267,302,305,331,334,337,366,369,380,389,396,399,425,428,431,434,437,443],[12,13,16],"p",{"className":14},[15],"post-prelude","\nToday, we're launching a world-class research lab dedicated to Open Source sustainability with a team of some of the\nmost experienced people in the world.\n",[12,18,19],{},"Why? The infrastructure we all use depends on Open Source: transportation, healthcare, the internet and more.\nWhen the Open Source packages we use break, our infrastructure is at risk.",[12,21,22,23,30,31,30,36,41],{},"This isn't just hypothetical. It's happening already, with catastrophic global supply chain attacks such as the ",[24,25,29],"a",{"href":26,"rel":27},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FXZ_Utils_backdoor",[28],"nofollow","XZ Utils\nbackdoor",", ",[24,32,35],{"href":33,"rel":34},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FLog4Shell#Usage",[28],"Log4Shell",[24,37,40],{"href":38,"rel":39},"https:\u002F\u002Fsecuritylabs.datadoghq.com\u002Farticles\u002Fshai-hulud-2.0-npm-worm\u002F",[28],"Shai-Hulud"," and others.",[12,43,44,45,50,51,56,57,62,63,68],{},"There are efforts underway to make Open Source development more sustainable.\nThe ",[24,46,49],{"href":47,"rel":48},"https:\u002F\u002Fopensourcepledge.com\u002F",[28],"Open Source Pledge"," has raised $7,262,189 for maintainers,\nthe ",[24,52,55],{"href":53,"rel":54},"https:\u002F\u002Fendowment.dev\u002F",[28],"Open Source Endowment"," is nearing a principal of $1m,\nand excellent research is being done by\nthe ",[24,58,61],{"href":59,"rel":60},"https:\u002F\u002Fwww.sovereign.tech\u002F",[28],"Sovereign Tech Agency",",\n",[24,64,67],{"href":65,"rel":66},"https:\u002F\u002Falpha-omega.dev\u002F",[28],"Alpha-Omega","\nand others.",[12,70,71,72,77,78,82,83,87,88,92],{},"But we need an organisation dedicated to answering the more general questions that Open Source sustainability depends\non. What are the most critical ",[24,73,76],{"href":74,"rel":75},"https:\u002F\u002Fvlad.website\u002Fkeystone-maintainers-keep-the-internet-going\u002F",[28],"keystone"," packages? Which keystone packages appear to be maintained, but are\nactually long-dead ",[24,79,81],{"href":80},"\u002Fideas\u002Fweekend-at-bernies","Bernies","? Which dependencies are ",[24,84,86],{"href":85},"\u002Freports\u002Fbinary-dependencies-identifying-the-hidden-packages-we-all-depend-on","invisible"," to us? How can we prevent the\never-growing issue of ",[24,89,91],{"href":90},"\u002Freports\u002Fburnout-in-open-source-a-structural-problem-we-can-fix-together","maintainer burnout","?",[12,94,95,96,100,101,105],{},"One would think that one of the many ",[24,97,99],{"href":98},"\u002Freports\u002Ffoundations","well-funded Open Source foundations"," could tackle this research, with\na median yearly revenue of $1.6m and a mean of $11.6m. But for the most part, foundations, as a policy, do not pay\ndevelopers at all, so they cannot fund this work. This is partly a quirk of the US tax code — until the Feb 2026 launch\nof the Open Source Endowment, the IRS had not recognised Open Source software as serving the public benefit, so they had\nnot given ",[102,103,104],"em",{},"501(c)(3)"," status to any organisation that funds Open Source development.",[12,107,108,109,114,115,120,121,124],{},"What about for-profit companies? Some, like ",[24,110,113],{"href":111,"rel":112},"https:\u002F\u002Fwww.chainguard.dev\u002F",[28],"Chainguard"," and ",[24,116,119],{"href":117,"rel":118},"https:\u002F\u002Fsocket.dev\u002F",[28],"Socket"," are building software supply\nchain analysis tools. But this work is proprietary, which doesn't sit right with our vision. The tools that allow us to\nmonitor our critical infrastructure ",[102,122,123],{},"are themselves critical infrastructure",", so they should be publicly accessible, and\nfunded independently of for-profit interests.",[126,127],"hr",{"className":128},[129,130],"hr--short","hr--blue",[12,132,133],{},"That's why we founded the Software Stewardship Lab: a new non-profit research lab dedicated to ensuring the stability of\nthe Open Source ecosystem we all depend on.",[12,135,136],{},"We map and strengthen the Open Source ecosystem by building software, creating APIs, and writing research reports. And\nour research takes into account the human side of Open Source, by investigating and caring for maintainer health.",[12,138,139,140,144],{},"Our ",[24,141,143],{"href":142},"\u002F#team","team"," includes some of the most experienced people in the field:",[146,147,148,165,179,190,204,223,235],"ul",{},[149,150,151,156,157,160,161,164],"li",{},[24,152,155],{"href":153,"rel":154},"https:\u002F\u002Fvlad.website\u002F",[28],"Vlad-Stefan Harbuz",", director of the ",[24,158,49],{"href":47,"rel":159},[28]," and adviser to the ",[24,162,55],{"href":53,"rel":163},[28],".",[149,166,167,172,173,178],{},[24,168,171],{"href":169,"rel":170},"https:\u002F\u002Fnesbitt.io\u002F",[28],"Andrew Nesbitt",", creator of ",[24,174,177],{"href":175,"rel":176},"https:\u002F\u002Fecosyste.ms\u002F",[28],"ecosyste.ms"," and probably the world's foremost expert on package\nmanagement.",[149,180,181,186,187,164],{},[24,182,185],{"href":183,"rel":184},"https:\u002F\u002Fmirandaheath.website\u002F",[28],"Miranda Heath",", author of the to-date most comprehensive ",[24,188,189],{"href":90},"report on burnout in Open Source",[149,191,192,197,198,203],{},[24,193,196],{"href":194,"rel":195},"https:\u002F\u002Ffastwonder.com\u002F",[28],"Dawn Foster",", CHAOSS board member, with a ",[24,199,202],{"href":200,"rel":201},"https:\u002F\u002Ffastwonderblog.com\u002Facademic\u002F",[28],"PhD"," using metrics to study the Linux kernel.",[149,205,206,211,212,217,218,164],{},[24,207,210],{"href":208,"rel":209},"https:\u002F\u002Froe.dev\u002F",[28],"Daniel Roe",", leader of globally-used web framework ",[24,213,216],{"href":214,"rel":215},"https:\u002F\u002Fnuxt.com\u002F",[28],"Nuxt"," and a steward of ",[24,219,222],{"href":220,"rel":221},"https:\u002F\u002Fnpmx.dev\u002F",[28],"npmx",[149,224,225,230,231,234],{},[24,226,229],{"href":227,"rel":228},"https:\u002F\u002Fpatak.cat\u002F",[28],"Matias Capeletto (patak)",", also a steward of ",[24,232,222],{"href":220,"rel":233},[28],", and a legendary Open Source community leader.",[149,236,237,242],{},[24,238,241],{"href":239,"rel":240},"https:\u002F\u002Fmikemcquaid.com\u002F",[28],"Mike McQuaid",", leader of Homebrew and a former GitHub Principal Engineer.",[12,244,245,246,251,252,256,257,262,263,266],{},"We are ",[24,247,250],{"href":248,"rel":249},"https:\u002F\u002Ffind-and-update.company-information.service.gov.uk\u002Fcompany\u002FSC893294",[28],"registered"," as a Scottish non-profit — though our scope is global — and our ",[24,253,255],{"href":254},"\u002F#values","values","\nand ",[24,258,261],{"href":259,"rel":260},"https:\u002F\u002Ffind-and-update.company-information.service.gov.uk\u002Fcompany\u002FSC893294\u002Ffiling-history\u002FMzUyNjQ3NTMwNWFkaXF6a2N4\u002Fdocument?format=pdf&download=0",[28],"articles"," legally bind us to serving the public good and making all our work publicly accessible.\nOur ",[24,264,265],{"href":142},"independent non-executive directors"," hold us accountable.",[268,269,272,273,272,276],"blockquote",{"className":270},[271],"blockquote--center","\n  ",[12,274,275],{},"\n    “If we don't secure the software supply chain, the vast majority of software will suffer.  The Software Stewardship\n    Lab has a collection of world-class experts in addressing problems like this and represents perhaps the most\n    ambitious effort today to solve the key problems in a fundamental manner.”\n  ",[277,278,279,280,279,286,272],"footer",{},"\n    ",[281,282],"img",{"src":283,"alt":284,"width":285,"height":285},"\u002Fimages\u002Fpeople\u002Fjustin@300px.webp","A portrait of Justin Cappos",22,[287,288,289,290,289,293,279],"div",{},"\n      ",[287,291,292],{},"\n        Justin Cappos\n      ",[102,294,295,296,301],{},"\n        Professor at\n        ",[24,297,300],{"href":298,"target":299},"https:\u002F\u002Fengineering.nyu.edu\u002Ffaculty\u002Fjustin-cappos","_blank","NYU Tandon",",\n        software supply chain security expert\n      ",[12,303,304],{},"Our current research focuses are:",[146,306,307,322],{},[149,308,309,313,314,317,318,164],{},[310,311,312],"strong",{},"Software supply chain security"," — We're working on an observatory that allows users to identify and monitor the\nworld's critical Open Source packages in real time, including previously ",[24,315,316],{"href":85},"hidden"," parts of the dependency\ngraph. More details ",[24,319,321],{"href":320},"\u002F#observatory","here",[149,323,324,327,328,330],{},[310,325,326],{},"Maintainer burnout"," — Our ",[24,329,189],{"href":90}," has been well-received. We're working on\nyearly follow-ups, plus a companion report on how AI is affecting maintainer burnout.",[12,332,333],{},"Moving forward, the Lab's experts will direct funding to and supervise Open Source sustainability researchers doing\ncritical work. We are already working with universities to teach the next generations of software supply chain experts.",[12,335,336],{},"And we are also working with our solicitors on achieving charity status. Charity regulators have not historically\nrecognised Open Source software as a charitable purpose. We hope that by seeking charity status, we will help pave the\nway for charity regulators worldwide to recognise the criticality of Open Source infrastructure.",[268,338,272,340,272,343],{"className":339},[271],[12,341,342],{},"\n    “This effort is critical to the future sustainability of Open Source. The unique challenges the Open Source\n    ecosystem is facing need the sort of Open Source thinking the Software Stewardship Lab is building. Open Source\n    has never been more important. It's imperative we give it a strong future.”\n  ",[277,344,279,345,279,349,272],{},[281,346],{"src":347,"alt":348,"width":285,"height":285},"\u002Fimages\u002Fpeople\u002Fjosh-bressers@120px.webp","A portrait of Josh Bressers",[287,350,289,351,289,354,279],{},[287,352,353],{},"\n        Josh Bressers\n      ",[102,355,356,357,361,362,289],{},"\n        VP of Security at\n        ",[24,358,360],{"href":359,"target":299},"https:\u002F\u002Fanchore.com\u002F","Anchore",",\n        host of the\n        ",[24,363,365],{"href":364,"target":299},"https:\u002F\u002Fopensourcesecurity.io\u002F","Open Source Security Podcast",[12,367,368],{},"But we need your help.",[12,370,371,372,375,376,379],{},"We can't do this research without funding. In fact, without funding, we would be in the ironic situation where we\ncouldn't sustainably develop ",[102,373,374],{},"the very technology"," required for the Open Source ecosystem to be more sustainable. That's\na ",[102,377,378],{},"Catch-22"," with serious ramifications.",[12,381,382,383,388],{},"We have seen that companies are ",[24,384,387],{"href":385,"rel":386},"https:\u002F\u002Fopensourcepledge.com\u002Fmembers\u002F",[28],"willing to fund"," keystone Open Source projects, which is important.",[12,390,391,392,395],{},"But we're asking organisations to ",[102,393,394],{},"also"," fund Open Source sustainability research, simply because it acts as a force\nmultiplier — it creates tools that strengthen the entire ecosystem, not just individual projects. Each dollar funds\nstructural improvements to the foundations of our technological infrastructure.",[12,397,398],{},"We have various sponsorship arrangements available:",[146,400,401,409,419],{},[149,402,403,404,408],{},"For companies, ",[24,405,407],{"href":406},"\u002Fsponsor","multiple sponsorship tiers"," with various benefits.",[149,410,411,412,418],{},"For grant-making organisations, a grant proposal on ",[24,413,415],{"href":414},"\u002Fproposal.bindep.pdf",[102,416,417],{},"Securing Python's Binary\nDependencies",", and others in the works.",[149,420,421,422,164],{},"For individual donors, more information on our ",[24,423,424],{"href":406},"Sponsor page",[12,426,427],{},"All our income and expenses will be detailed on Open Collective with full transparency.",[12,429,430],{},"Know that, if you are able to help fund our work, you are making a positive difference to the Open Source ecosystem that\nthe entire world relies on.",[126,432],{"className":433},[129,130],[12,435,436],{},"Open Source lies at the foundation of our modern technology. That technology can, and does, fall apart when keystone\nprojects are underfunded and insecure, and when maintainers are overworked. Existing solutions aren't doing enough to\npreserve our critical infrastructure.",[12,438,439,440,164],{},"We can solve this problem together with your support. If you're able to, ",[24,441,442],{"href":406},"sponsor us",[287,444,272,447,272,452,272,456,272,459],{"className":445},[446],"post-signature",[281,448],{"src":449,"width":450,"alt":451},"\u002Fimages\u002Fvlad-squiggle-sig.svg",130,"Vlad's signature",[453,454,455],"i",{},"\n    Vlad-Stefan Harbuz, Executive Director\n  ",[12,457,458],{},"Together with our board:",[453,460,461,462,465,466,468,469,471,472,474],{},"\n    Andrew Nesbitt",[463,464],"br",{},"\n    Miranda Heath",[463,467],{},"\n    Daniel Roe",[463,470],{},"\n    Dawn Foster",[463,473],{},"\n    Matias Capeletto\n  ",{"title":476,"searchDepth":477,"depth":477,"links":478},"",2,[],null,"philosophy","Sponsor us","Want to strengthen Open Source together?","2026-08-07","Today, we're launching a world-class research lab dedicated to Open Source sustainability with a team of some of the most experienced people in the world.","md",false,true,{},"\u002Fideas\u002Fa-research-lab-for-open-source",{"title":5,"description":484},"ideas\u002Fa-research-lab-for-open-source","HjAPHZsV2_RovzrxhoMeb3XVAjj_cELz4C5AWQv-eak",["Island",494],{"key":495,"result":496},"NoscriptNav_XrRK2e2e8meJ0jKVGkb5ULGQDVi3UiFQ9nupAr7Yns",{"head":497},{},1786095497154]