Hacker News Reader

There's a company, Tidelift, that has been working on solving this issue as well.

Their solution is to be a VAR on top of the open source and give updates on new versions, advice on remediation and workarounds for CVEs, and help prioritize issues for open source maintainers. The other side is that they pay the maintainers to do what they do best: maintain the software.

View on HN

At polyglot.network, we have been taking a much more direct approach: Hire us, and we work like a typical agency on open issues that you care about. It's in our best interest to work with upstream maintainers, but if for whatever reason, that's not practical, we work with either remote freelancers or in-house developers to get the job done. In the end, we solve the actual problems you have, in a sustainable way.

What Tidelift is doing is really exciting, but it requires quite significant time investment from the projects themselves to get it up and running - likely not really worth it for a single maintainer building something in their spare time.

I like the idea of having an easy mechanism outside of formal structures such as Tidelift and GitHub Sponsors that companies can use to channel money to projects they depend on that don't yet have something like that setup.

Reply on news.ycombinator.com