Let's save 'open source' from a tragedy of the commons

Digital public goods are at risk of falling apart if we don't find sufficient funds for open source maintenance

- RAHUL MATTHAN

The vulnerability found on the open-source logging library Log4j was one of the most serious ever detected. It was ranked 10th on the Common Vulnerability Severity Score on account of the risk it posed to hundreds of millions of devices. If present, it could be used to take full control of a system, steal information or launch ransomware attacks.

When it was discovered in 2021, it had already been around for eight years. The small team of unpaid volunteers responsible for maintaining that open-source library was completely unaware of its existence. By then, it was already being used by a wide range of applications and companies, including an assortment of Apache frameworks and the blockbuster game, Minecraft.

Open-source software suffers from a 'tragedy of the commons.' While it is designed so everyone can benefit from it, our ability to continue to use these applications depends on a handful of increasingly overwhelmed volunteers whose job it is to keep the code from falling apart. This concern is particularly acute in the case of successful projects that typically have many more users than a small team of maintainers can hope to adequately support.