GnuPG depended financially on a single developer
Summary
Julia Angwin reports that Werner Koch maintained critical email encryption software for years with very limited resources. Werner Koch started GnuPG in 1997. After the article was published, financial support rose considerably.
Ideas
- GnuPG is a central free implementation of the OpenPGP standard.
- Many companies use software without funding its maintenance.
- A single maintainer carries considerable technical and personal risks.
- Public attention triggered new donations and institutional support.
Insights
- Widespread dependence does not automatically create sustainable funding.
- Open source risks are organisational as well as technical.
- Critical infrastructure needs redundancy in knowledge and responsibility.
Recommendations
- Take inventory of critical free dependencies and their maintainer structure.
- Fund projects in proportion to their operational importance.
References
Links to the original source and the Web Archive open in a new tab.