Chris Grams

Chief Marketing Officer, Tidelift. Author of The Ad-Free Brand.

[Chris Grams @cdgrams]

Well, that was fun. Good day, everyone! 🤗

[UpstreamOSS @UpstreamOSS]

The dream at @tidelift has always been to make open source work better—for everyone.

So the goal of @UpstreamOSS is to get to know each other, both those who create open source, and those who use it.

https://t.co/DvjRQ3jTl5

#upstream2023

[UpstreamOSS @UpstreamOSS]

A few minutes ago, @juliaferraioli stated this very eloquently:

Software is not just bits. It’s a complex, socio-technical system, and you can’t simply abstract the people out of it.

https://t.co/V8HLdTM1yC

#upstream2023

[UpstreamOSS @UpstreamOSS]

“Lauren shared some highlights of the multi-year effort we’ve made at Tidelift to pay maintainers to validate they are following common software security practices. Paid maintainers achieved a better than 2x OSSF Scorecard score!” 🎉

https://t.co/IsQrtLsP4f

#upstream2023

[UpstreamOSS @UpstreamOSS]

“There’s a reason why corporations employ people and pay them. Because that’s the best way to get work done. Getting paid should be considered normal, not out of the ordinary.”

@dff quoting maintainer @GaryGregory

https://t.co/TlQuKd3WQr

#upstream2023

[UpstreamOSS @UpstreamOSS]

“If we want healthier, more secure open source software, we can’t think of it as a zero-sum equation anymore. We need to think about how everyone can win, both the creators and users of open source.”

https://t.co/znannlavOX

#upstream2023

[UpstreamOSS @UpstreamOSS]

“Let’s stop winging it, and instead create a more intentional supply chain, with intentional, thriving open source maintainers” @dff paraphrasing @luis_in_brief

https://t.co/gI9pdbphIf

#upstream2023

[UpstreamOSS @UpstreamOSS]

“Open source won, now comes the hard part” hear 🎙️ from @mmilinkov of @EclipseFdn in his @UpstreamOSS talk, live now: https://t.co/RKyJDpYKAh

#upstream2023

[UpstreamOSS @UpstreamOSS]

When it comes to relieving the loneliness of being a solo maintainer, @sethmlarson asks “how can we as an industry get at least one more person on every project?”

https://t.co/JkgmogMHnD

#upstream2023

[UpstreamOSS @UpstreamOSS]

“If we start defining what open source is, in ways that are not compatible from one jurisdiction to another, it's going to be an absolute nightmare.” - @tobie

Live on @UpstreamOSS now: https://t.co/ONxggnzqVy

#upstream2023

[UpstreamOSS @UpstreamOSS]

We asked open source maintainers which of the common industry standards frameworks they were *aware* of (NIST, OpenSSF Scorecards, SLSA). 52% of maintainers were aware of none of them, according to @cdgrams.

https://t.co/lT7nbZr80r

#upstream2023

[UpstreamOSS @UpstreamOSS]

“I’m not surprised at all that most maintainers aren’t up to date with everything that is happening in the open source security supply chain explosion of complexity that we are all living through right now,” says @sethmlarson.

https://t.co/4s3GPxtWmO

#upstream2023

[UpstreamOSS @UpstreamOSS]

.@sethmlarson describes himself as a semi-professional maintainer, which puts him squarely in the minority. Only 36% of maintainers self-describe as professional or semi-professional. 60% describe themselves as unpaid hobbyists!

https://t.co/CsslzDDlXK

#upstream2023

[UpstreamOSS @UpstreamOSS]

Paid maintainers are 20-30% more likely to do important security and maintenance work than unpaid maintainers, says Tidelift VP of product @partridgehouse, quoting Tidelift’s new state of the open source maintainer report.

https://t.co/r6TGWeFl4G

#upstream2023

[UpstreamOSS @UpstreamOSS]

“You can think of @Tidelift as a central compliance office for upstream open source. Our job is to let folks know where there may be a gap and ensure maintainers are paid and have the clarity to do their work.” @partridgehouse

https://t.co/6gXDvFFTjW

#upstream2023

[UpstreamOSS @UpstreamOSS]

In her talk @partridgehouse shares data that as of May 2023, the OpenSSF Scorecards scores of packages in our maintainer cohort were 7.2/10 as compared to 3.3/10 for all assessed packages. Over 2x higher with paid maintainers!

https://t.co/eCefUaXNG2

#upstream2023

[UpstreamOSS @UpstreamOSS]

If you want to support #OSS maintainers:
- Celebrate non-code contributors
- Advocate for better OSS programs at your workplace
- And pay them!

@borderless_dev live on @UpstreamOSS now: https://t.co/h1EVJ4BD07

#upstream2023

[UpstreamOSS @UpstreamOSS]

A final assessment from @partridgehouse from our OSSF Scorecards project: maintainers getting paid for their work are willing to improve both the measurements of things and the outcomes those things deliver.

https://t.co/RgxLQSVKNP

#upstream2023

[UpstreamOSS @UpstreamOSS]

Quote from maintainer @ljharb “I wouldn’t be able to put the care and attention into this critical work without being paid for it, so I’m glad to see the importance of paying maintainers has taken center stage.”

https://t.co/3TX8TZB7sK

#upstream2023

[UpstreamOSS @UpstreamOSS]

“Today is June 7…the five year anniversary of when the US government stepped into SBOM.” - @AllanFriedman

Happy #SBOMiversary! 🎉

https://t.co/iDA4kta0n5

#upstream2023