SparkleShare’s funding success shows that grants can revive struggling open source projects—but only if maintainers can find the organizations ready to support them.
Build it and they will fund.
That paraphrase of the “Field of Dreams” tagline came to me Monday when reading the news that the open source SparkleShare project has found some much needed funding. That, in turn, led me to think of a news story of old that’s now part of open source history.
There’s been more than a decade’s worth of hand wringing about essential open source projects not getting funded because they’re too small and unsexy to get attention — and because they do their job too well for their importance to get noticed until they fall prey to a security vulnerability. If this sounds familiar, I’m thinking about the wake-up call we had in 2014 with Heartbleed, a severe memory disclosure vulnerability in OpenSSL — an open source library securing a huge portion of the internet.
You might remember, that particular vulnerability turned out to be a huge risk to nearly everything that touched the internet. It also turned out that it might’ve been avoided. As important as this small project was, it had been being maintained for years by a team consisting of one or two core developers doing critical infrastructure work with very little financial support. In other words, a few bucks to support more developers and Heartbleed might have never happened.
Since then, the alarm that raised has led to fixes. The Linux Foundation and other open source movers and shakers put in place several funding channels to assure — or to at least try to assure — that Heartbleed doesn’t happen again. It wasn’t a difficult fix, considering that it is large corporations and big tech giants with plenty of money to burn that depend on projects such as OpenSSL.
SparkleShare’s Funding Issue
Hylke Bons recently found himself in a situation similar to what OpenSSL had faced 12 years ago. Bons is the freelance designer and coder behind Planet Peanut Studio, which develops and maintains the Git-based file-sync application SparkleShare that’s designed to help people who aren’t particularly technically inclined work together and share files in projects that use the Git version control system. It’s been around since 2010, and has enough action on GitHub to indicate more than a few users.
Trouble was, he’s been having trouble keeping the project maintained — and moving forward — while holding down a day job.
The good news is that he’s found funding — specifically to finish porting the software to Rust, bring the software in line with modern security and privacy practices, and design a fresh user interface informed by years worth of community feedback. He hopes this will eventually result in getting a Linux release back on Flathub (he evidently had to remove a Flatpak version from Flathub because of difficulties keeping the program maintained due to “burnout”).
“That’s no longer an issue,” he wrote on the Planet Peanut Studio website on Monday. “Now I have an opportunity to rebuild and address long-standing issues and feature requests. I have renewed energy to bring back the project better than ever!”
Meet NLnet Foundation — Funding the Internet Since 1997
What I find most interesting about this, is that Bons has found funding not from one of the many funding sources that have arisen since Heartbleed, but from the NLnet Foundation, an organization that proudly proclaims on its website’s homepage: “Supporting the open internet since 1997.” That means that at the time OpenSSL was so desperately needing funding that it had become a danger to itself and the rest of tech, funding from NLnet was very likely there for the asking.
I’m not pointing any fingers here. I’ve been following open source tech and all things open since the turn of the century. During that time I’d never heard of the NLnet foundation until now, so I’m definitely not saying that I fault the OpenSSL team for not finding them — nor do I fault the folks at NLnet for not knowing that OpenSSL could use a small funding grant.
Also, I’m not offering any sort of solution. I’m merely observing the irony that at the time the world was bemoaning the lack of funding that led to the Heartbleed scare, funding was likely available, if not from NLnet Foundation then from somewhere else. The problem was that even though they were both looking, they never found each other.
Christine Hall has been a journalist since 1971. In 2001, she began writing a weekly consumer computer column and started covering Linux and FOSS in 2002 after making the switch to GNU/Linux. Follow her on Twitter: @BrideOfLinux
Be First to Comment