►
Description
Presented by: Wolfgang Gehring
In 2014, the Heartbleed Bug sent shockwaves across the internet and led to news headlines like: “The Internet Is Being Protected By Two Guys Named Steve.” Although this headline is somewhat humorous, it revealed a crucial vulnerability of free and open source software (FOSS) altogether: oftentimes, important open source software is maintained by a few engaged—but tired and overworked—individuals. Let’s explore why sponsoring is a great way to drive FOSS forward altogether, how it can be done in practice, and what the experience of open source sponsorship is at Mercedes-Benz. In particular, Dr. Gehring will also discuss how to overcome challenges in implementing such a sponsorship program at the corporate level.
As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub
Thanks!
Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github
About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com
A
A
A
Steve
works
as
a
software
engineer
and
because
he's
really
good
at
his
job,
he
actually
doesn't
exactly
work
only
nine
to
five
and
because
he
also
really
likes
the
field
that
he's
in.
He
has
a
little
a
little
open
source
project
that
he
started
on
the
side
a
few
years
ago,
and
this
project
took
only
a
little
bit
of
time
at
first,
but
then
you
know
hundreds
of
projects
started
using
it,
then
thousands
and
finally,
now
it's
in
the
hundreds
of
millions
of
projects.
So
Steve
is
really
busy
with
this
project.
He
has
a
collaborator.
A
After
a
few
years
he
got
a
collaborator
and
his
name
was
also
Steve,
Steve
Marquez.
So
together
they
became
later
known
as
the
two
thieves.
Now,
in
2012,
a
student
from
the
University
of
Munster
in
Germany
created
a
pull
request
and
Steve
reviewed
it,
and
he
decided
to
include
the
code
into
the
code
base.
It
was
only
until
two.
A
It
was
only
2014
that
they
found
out
that,
with
this
full
request,
a
crucial
bug
was
introduced
into
the
system
that
caused
the
largest
breach
in
online
security
in
the
history
of
humankind,
and
that's
not
an
exaggeration.
It
really
created
a
lot
of
problems
and
it
led
to
funny
headlines
like
this
here.
The
internet
is
being
protected
by
two
guys
named
Steve,
so
it
was,
it
was
head
on
right.
A
It
was
these
two
guys,
and
now
you
probably
have
heard
of
the
project
that
they
were
working
on
is
called
openssl
and
the
bug
became
known
as
the
Hartley
book.
Now
it
was
only
then
that
people
started
investigating
who
are
these
guys
that
are
maintaining
this
project
and
they
found
the
two
thieves
it
turned
out.
The
two
Steves
are
doing
this
as
a
project
purely
in
their
in
their
free
time,
and
it
took
up
more
and
more
of
their
time
and
they
they
became
these.
A
These
really
overworked
underpaid
guys
we're
taking
care
of
our
online
security.
Now
you've
all
seen
this
picture,
I
really
like
it,
though
it
just
depicts
the
situation
and
software
so
good
it.
You
know
you
have
a
lot
of
times.
You
have
the
situation
where
one
project
builds
upon
the
other,
and
then
you
end
up
a
situation
like
this.
Where
you
know
everything
is
based
on
this
one
little
piece
of
software,
and
if
you
take
that
off,
then
it
all
comes
crashing
down.
A
You
know
and
we'll
spend
a
lot
of
time,
reassembling
civilization
from
the
robo.
Another
project
that
you
probably
have
heard
of
is
lock
for
a
shell.
That
is
very
recent
and
there
was
a
similar
situation
except
the
maintainers
were
three
guys
and
they
didn't
have
all
the
same
name.
They
were
called
the
Matt
Gary
and
Ralph,
and
Ralph
Gores
is
the
Project
Lead
for
for
a
log
for
J,
and
he
works
on
on
this
on
top
of
a
full-time
job.
Clearly,
this
situation
isn't
very
sustainable
and
is
not
very
good.
What
can
we
do?
A
Well,
so
some
people
suggest
it
not
to
use
open
source
at
all.
Obviously,
we
don't
need
to
discuss
this,
and
some
people
suggested
hey.
We
should
have
a
central
government
governing
unit
in
every
company
that
you
know
takes
care
of
okaying
the
open
source
software
that
we
use.
Now
that
you
can
do
this,
but
I
think
I
have
a
few
better
ideas.
So
here's
one
contribute
please
go
and
contribute
to
open
source
projects.
Please
aim
for
high
quality
contributions,
because
these
maintainers
already
have
a
lot
on
their
plate.
A
I
realize
you
can't
be
a
maintainer
for
every
open
source
project,
but
you
know
give
it
a
thought.
If
you
really
use
it
a
lot
try
to
help
out
there.
Another
thing
here
is
become
a
member
of
a
software
Foundation
or
an
open
source.
Foundation
like,
for
example,
we
at
Mercedes-Benz,
we
are
members
of
the
eclipse,
Foundation
we're
members
of
the
Linux
foundation
and
several
others,
so
they
these
foundations.
A
It
probably
seems
a
bit
far-fetched
that
for-profit
companies
would
spend
money
on
something
that
they
actually
get
for
free,
but
I
can
tell
you
that
we
at
Mercedes-Benz
are
doing
exactly
that,
so
we
started
about
a
year
ago
and
we're
now
paying
money
to
open
source
projects
that
we
like.
So,
for
example,
here,
if
you
go
to
our
GitHub
site,
you
can
see
this
right
now,
it's
34
organizations
and
developers.
Some
we
did
sponsor
before
they're,
not
included
in
this
number
anymore,
and
we
keep
adding
more
and
more
to
this.
A
So
how
can
you
do
this?
There
are
several
possibilities,
so
the
first
one
here
is
GitHub
sponsors
we're
at
GitHub
universe.
So
that's
how
we
do
it
at
Mercedes-Benz.
So,
right
now,
by
the
way
it's
they're
still
in
a
phase
where
they
don't
charge.
Any
fees
it
will
later
be
chargeable,
but
they
will
not
make
any
profit
off
of
this.
So
this
is
the
fees
that
they
will
ask
is
just
going
to
be
to
cover
the
costs
for
the
program
on
their
side.
A
As
I
said
we're
at
GitHub
Universe,
we
prefer
get
GitHub
sponsors
at
the
moment.
I
just
want
to
for
completeness
reason,
show
you
that
there
are
other
ways,
one
here
so
open,
Collective,
open
source,
Collective,
I,
think
that
is
also
a
good
viable
option.
They
take
10
on
incoming
funds,
then
Linux,
Foundation,
crowdfunding
I,
think
that's
a
good
way
too.
They
don't
ask
for
any
fees
for
the
first
10
million
and
then
five
percent
after
that-
and
here
I.
These
are
smaller
ones.
A
I,
don't
know
them
personally,
but
just
for
completeness
here,
liver
pay,
Bounty,
Source,
State,
social
tide,
lift
and
issue
hunt
or
access
code.
So
how
does
this
work
in
practice?
We
give
money
to
GitHub.
Then
the
money
is
at
GitHub
and
then
we
tell
GitHub
who
that
we
want
to
sponsor.
So
we
can
select
individual
developers
or
we
can
select
projects
to
set
this
up
in
your
company.
Can
be
a
bit
tricky,
it
took
me
quite
a
while
actually
to
figure
this
out
and
I
and
I
wasn't
procrastinating.
A
But
let
me
run
you
through
this
for
real
quick,
so
you
have
to
know
a
company
can't
just
spend
money
like
that.
You
know
you
either
spend
money
when
you
buy
something.
So
it's
a
purchase
or
you
do
traditional
sponsoring,
for
example,
so
at
Mercedes
we
might
sponsor
a
famous
sports
person.
You
know
to
where
our
logo
on
their
sleeve,
you
know
and
then
they're
our
name
ambassadors
and
they
get
money
for
that.
A
What
is
open
source
sponsorship?
It's
really
neither
100
this
nor
100
that
it's
sort
of
in
the
middle,
because
I
mean
you're.
Are
you
buying
something?
Well,
not
really
by
you
sponsoring
someone
for
wearing
your
logo?
Also,
not
really
right,
so
you
could
justify
that
it's
a
purchase!
You
could
justify
that
as
a
sponsoring.
It
doesn't
really
matter
in
the
end.
You
just
have
to
decide
at
your
company
which
way
you
want
to
go
okay,
and
that
will.
A
Let
me
tell
you
this
will
require
a
lot
of
talking
to
the
sponsoring
people
to
the
purchasing
people.
You
know
just
get
everyone
together
and
sort
of
figure
out
how
you
can
how
you
can
do
this.
Okay,
an
important
point
that
I
want
to
make
here
is
you
have
to
pay
heat
to
compliance,
because
you
can't
just
give
money
to
someone
at
big
companies.
You
want
to
know
where
that
money
goes,
and
you
know
to
give
money
to
someone
on
the
internet
that
you
don't
know
really
who
they
are
is.
Is
you
can't
do
that?
A
You
want
to
make
sure
that
your
money
doesn't
end
up
in
in
strange
places
where
you
don't
want
it
to
be
so
that
means
we
at
Mercedes-Benz
and
I.
Think
that's
pretty
much
the
same
at
every
big
company
you
have
to
you
have
to
know
their
name
and
residence,
so
you
can
do
a
sanction
list
check
as
yeah
mini
mini
background
check.
Basically-
and
everybody
does
this,
so
this
is
not
a
not
a
secret
thing
or
anything,
but
you
need
their
name
in
Residence.
So
I
went
to
GitHub
and
said
GitHub.
A
Can
you
please
give
me
the
names
and
Residences
of
these
people
I
want
to
sponsor
them
or
you
want
to
sponsor
them
and
then
could
have
said?
No
sorry,
we
can't
do
that.
Why?
Because
of
data
protection
laws-
and
we
told
them-
you
know
we're
not
giving
away
their
their
information
and
obviously
we
understand
that
so,
okay,
fine,
so
that
means
I
had
to
approach
these
people
personally
and
say:
hey
can
I,
please
have
your
name
and
address
because
we
want
to
give
you
money.
A
So
all
of
a
sudden
I
was
this
guy
sending
emails
to
people
hey.
We
want
to
give
you
money.
Can
you
please
give
me
information,
you
know,
and
so
that
was
that
felt
a
little
weird
I
was
like
oh
wow
good,
but
in
the
end,
actually
that
worked
out.
You
know
I,
guess
sending
an
official
email
from
an
official
Mercedes-Benz
address
and
so
forth
and
I
stated
to
them
exactly
why
I
needed
it
and
and
so
forth.
You
know
I,
so
it
worked
out
in
the
end.
A
So
here's
some
of
the
feedback
that
we
got.
We
got
really
really
good
feedback
from
from
the
community,
and
it's
not
so
much
just
because
we
gave
the
money.
People
tend
to
be
happy
when
you
give
the
money,
but
it
was
I
think
a
lot
of
it
was
more.
It
was
the
recognition
you
know
the
pad
on
the
shoulder
that
the
thank
you
thank
you
that
you
do
this
great
work.
It
was.
It
was
a
nice
experience
and
just
one
example.
We
wanted
to
sponsor
someone.
A
They
didn't
have
a
GitHub
profile
against
get
a
sponsor
profile
set
up
yet
so
we
asked
them
hey.
We
would
like
to
sponsor
you.
Can
you
please
set
up
this
with
GitHub
and
then
this
particular
project?
They
did
this
and
then
we
were
able
to
sponsor
them,
and
then,
a
few
months
later
they
wrote
back
to
us
and
said
hey.
Thank
you
so
much
for
asking
us
to
do
this.
A
Since
you
sponsor
us,
since
we
set
up
the
profile,
20,
more
people
and
organizations
have
sponsored
us,
so
that
was
a
that
was
really
good.
Okay,
guys.
Let
me
just
wrap
this
up
here.
I
wanted
to
give
you
this
is
our
open
source
landing
page.
There
is,
it's
still
fairly
new,
not
super
much
on
there
yet,
but
enough
for
you
to
you
know
browse
through
some
articles,
some
of
the
projects
that
we
have
as
open
source
there
is
our
Mercedes-Benz
Foss
Manifesto.
A
I
would
like
to
point
that
out,
because
this
is
our
the
Mercedes-Benz
Fox
manifestos,
our
commitment
to
open
source,
and
it
states
that
we
don't
only
you
know-
want
to
be
passive,
open
source
consumers,
but
that
we
want
to
be
active
in
open
source.
We
ask
our
Engineers,
please
go
out
there
and
please
become
active
in
open
source.
Not
only
use
also
contribute,
also
publish
your
projects
as
open
source.
A
I
hope
I
have
inspired.
You
think
about
whether
you
and
your
company
can
maybe
sponsor
open
source
projects.
If
more
and
more
of
us
do
it,
we
really
can
change
the
world.
We
can
really
make
a
difference
because
it
supports
and
fosters
open
source.
It
helps
to
ensure
that
the
projects
that
we
like
are
still
around
tomorrow
and
because
it's
the
right
thing
to
do
all
right.
Thanks
very
much
for
listening,
see
you
later.