> This is something that I would love to see happen with open source projects: That won't happen. But not for lack of trying! My consulting company, Paragon I

> This is something that I would love to see happen with open source projects: That won't happen. But not for lack of trying! My consulting company, Paragon Initiative Enterprises, has produced over a dozen high quality open source projects that make it easier to write secure PHP software. For starters, we wrote an entire CMS that has secure automatic updates baked into its core as a first-class feature (including for extension developers): https://paragonie.com/project/airship https://paragonie.com/project/airship Worried about SQL injection? EasyDB makes it easy and intuitive to use prepared statements. https://github.com/paragonie/easydb https://github.com/paragonie/easydb Need Content-Security-Policy headers quickly and easily? You want CSP-Builder: https://paragonie.com/project/csp-builder https://paragonie.com/project/csp-builder Want all the security of libsodium with an even simpler interface and a separate class for dealing with the filesystem? Check out Halite: https://paragonie.com/project/halite https://paragonie.com/project/halite Want to stop CSRF (including replay attacks)? https://github.com/paragonie/anti-csrf https://github.com/paragonie/anti-csrf Want to quickly examine the differences between two PHP Archives (e.g. for reproducible builds)? https://github.com/paragonie/pharaoh https://github.com/paragonie/pharaoh We even wrote the community's accepted interface for generating cryptographically secure random numbers in PHP 5 projects: https://github.com/paragonie/random_compat https://github.com/paragonie/random_compat And coming soon (pending an audit), a pure-PHP implementation of libsodium that will likely be adopted by WordPress so its automatic updates are Ed25519 secured: https://github.com/paragonie/sodium_compat https://github.com/paragonie/sodium_compat And even more: https://paragonie.com/projects https://paragonie.com/projects Guess how many clients we've gotten from all this open source software we wrote over the past two years that demonstrably improves the security posture of software written in PHP? Zero. My solution: Our next project isn't going to be OSS, and it's unlikely that any of our future ones will be unless it's intended to be a giveaway. The open source + consulting business model may sound good in theory, but it simply doesn't work. (Though, I will grant that it's possible that the "consulting about someone else's open source project" is more sustainable, due to near-zero investment in said project itself.)