Also, I get the feeling that most people take projects like these for granted, shouldn't security companies that rely on these projects at least want to try and keep them alive by donations?
Also, I get the feeling that most people take projects like these for granted, shouldn't security companies that rely on these projects at least want to try and keep them alive by donations?
Asking the populous to donate seems like a short term fix.
First, how would you bill it? Tax-deductible gifts to a charity? To an individual, at the rate of a salary, to develop and maintain a product you want to use? Sounds an awful lot like employment. Somebody would need to pay taxes on it, and then there's the laws in whatever countries you're working to consider.
Second, there's the immediate lack of benefits to funding someone outside your company. If you want a particular feature or fix done, you can't demand this person do it as they don't work for you. And if they quit, you'll have to hire someone to maintain it anyway, right? And if you need some domain-specific expertise or customization down the road, you'll again need to hire an expert for your company. It just makes a whole lot more sense to hire and keep an expert in-house that maintains the code, rather than gift to some rando some large chunk of money to work on something without addressing your company-specific needs.
Third, if you wanted funding, you'd probably have to show you have a board made up of the companies that fund you and some industry peers, have a roadmap, processes for discovering, addressing and solving issues, etc... basically your own little organization to manage everything. Just one guy doing code isn't necessarily enough for sponsors to take you seriously.
The problem here is that there's just one developer. Open source projects usually only work if there's many developers working on it a little at a time; then you don't need to pay full salaries and it won't go into disrepair. But for whatever reason (stagnation, disrepair, difficulty working with the community, obsolescence, etc) nobody is interested in working on it or with them. To me, that's a recipe for disaster: it means there's a 'smell' with this project, and maybe someone should fork it and do what they want with it now.
(I actually work and have worked in companies where this has happened... nobody is going to get funding approved to give money to someone outside their company for something that would be better served in-house)
$ git shortlog gnupg-2.0.9..gnupg-2.1.1|grep :|grep -v ^\ | wc -l 25
$ git log --pretty=oneline | wc -l
4753
$ git log ada086d0cec0be47811b3d686017e84e041a5201
commit ada086d0cec0be47811b3d686017e84e041a5201
Author: Repo Admin <nobody@gnupg.org>
Date: Tue Nov 18 14:06:00 1997 +0000
New repository initialized by cvs2svn.
The stats from my comment above were just from the parents git log start..end timeframe though.Here looks to be the stat report from the entire history: https://gist.github.com/anonymous/352d28b459d0fc286dab
I don't know how the tax situation for donations works out for a GmbH, but they seem to be in a similar position as several other open source projects.
Various parties fund Tor development by giving money to "The Tor Project, Inc.", a 501(c)(3) corporation[2].
The same is true of Freenet, "The Freenet Project Inc", another 501(c)(3) is in charge of funding development, and Google itself has been among the entities that have donated[3].
[1] https://gnupg.org/donate/index.html
[2] https://www.torproject.org/about/findoc/2013-TorProject-Form...
And it can get even worse with a proprietary system, if the company goes bankrupt, then there's no system or code left at all... or they may open source it. Although, the companies that open source their code after going bankrupt are extremely rare.
But then there's the question, what will the clients do with that code? If it is a large system, it would take months to continue development on it - and who would pay for it? The most likely outcome is that the clients will go to the nearest competitor.