Open Source Dependencies - Don't Depend on Me for Anything

I'm always kind of curious about this question, especially given the news that came out this week where there's a cybersecurity bills being put to Congress. I wonder how you feel about giving financial support downstream indiscriminately without recognizing that some projects either don't have the governance to deal with money or may not want it. Do you have any thoughts on that sort of view of dependencies as being a non homogenous list of all sorts of diverse projects?

Transcript

chevron_right

Play full episode

chevron_right

Transcript

Episode notes

Guest

Nicholas Zakas

Panelists

Richard Littauer | Justin Dorfman

Show Notes

Hello and welcome to Sustain! The podcast where we talk about sustaining open source for the long haul. Our guest today is a returning guest that we’ve had on before. We are excited to have joining us, Nicholas Zakas, who’s one of the maintainers on ESLint, which is a tool that helps you find and fix problems in your JavaScript code. Today, we’ll learn all about ESLint, the maintainers, contributors, and how they get paid. Also, we’ll find out the success behind ESLint, and a post about sponsoring dependencies that Nicholas wrote on his blog. Go ahead and download this episode now to learn more!

[00:02:23] Nicholas tells us all about ESLint, their maintainers that work on the project, and how many people have contributed to the project on GitHub.

[00:07:29] Nicholas tells us how maintainers get paid as part of his governance strategy.

[00:10:04] Justin asked about the fact that ESLint not only pays contributors, but also pays downstream dependencies.

[00:12:04] Richard wonders where all the money comes from that gave ESLint this huge surplus, and Nicholas explains how they raised so much and what it is about ESLint that makes that possible.

[00:16:10] We hear some reflections from Richard as he congratulates Nicholas and makes some important points about the success of ESLint.

[00:20:19] Nicholas fills us in on the OpenJS Foundation Project.

[00:23:57] Richard talks about a blog post Nicholas wrote on his blog about sponsoring dependencies, and Nicholas explains the difference between large charismatic projects and smaller projects and how he sees the role of large projects in funding the smaller ones.

[00:31:41] We hear what ESLint did with sponsoring dependencies, and Nicholas tells us about some projects that they wanted to support financially, but turned them down.

[00:38:06] Find out where you can follow Nicholas and ESLint online.

Quotes

[00:07:43] “Everybody on the team, the committers, reviewers, technical steering committee, gets paid an hourly rate for their contributions.”

[00:07:53] “Contributions can be anything that contributes to the project, reviewing issues and pull requests, attending meetings, helping people on discord, helping people on GitHub discussions, and if people ever go to conferences or meetings representing the team, they can also charge for that.”

[00:10:15] “We made a decision the beginning of last year that it was time to start supporting our dependencies.”

[00:12:28] “I do think we are lucky in a lot of ways that we’ve had champions inside of companies who were working within their company to get ESLint’s support.”

[00:13:13] “In the beginning, we were hesitant to start spending the money because we didn’t know how reliable that source of income would be, and we were worried we wouldn’t be able to pay a living wage.”

[00:21:25] “Being in a foundation is one type of a reputational check mark that an open source project can get.”

[00:26:15] “I think OpenSSL is a great example of [the funding problem]. It’s a foundational piece of internet infrastructure.”

[00:28:31] “We went on backyourstack.com and started looking for the projects that we were depending on that had Open Collective pages and said, as a project, what is good for open source in general, is also good for ESLint.”

[00:29:20] “Open source, in general, is this collective of projects that are built on top of projects that are built on top of projects that are built on top of projects, and we have no problem giving that recognition when we’re talking about what the project is built upon.”

Spotlight

[00:39:47] Justin’s spotlight is the new book, What if? 2 by Randall Munroe.
[00:40:31] Richard’s spotlight is David Troupes, Buttercup Festival comic strips.
[00:41:03] Nicholas’s spotlight is the book, WebAssembly: The Definitive Guide by Brian Sletten