Any time there’s a big vulnerability in an open source project, I brace myself for the inevitable barrage of reactionary statements making the same claims about

Any time there’s a big vulnerability in an open source project, I brace myself for the inevitable barrage of reactionary statements making the same claims about open source maintainers, compensation, etc. But while there’s some truth to the factual information, I simply disagree with the notion that open source is broken because of this. And there’s one specific pull quote I'd like to draw attention to: > If log4j2 is responsible for your company's success, you have a moral obligation to donate to the person who creates this library thanklessly. This is an interesting statement. I happen to disagree with it in a fairly vehement fashion; open source works specifically due to the lack of moral obligations. Part of what I am intentionally doing when I release code is waiving any legal obligations, and I in no way want to imply that I am replacing them with unspoken moral expectations. I just release software because I feel like it, and offer best-effort support (not great!) because I want to. For free. For other people to benefit off of, and for me to benefit mutually from in the form of bug fixes. (And if I even cared about it, GitHub stars.) But the other reason it’s interesting is because it actually knocks at another truth: Most users of a logging library like log4j have collectively very little credit to give to log4j for their success. As great of a library as it may be, it’s simply a tertiary concern for most software, which, most of the time, will be using very little of its functionality. Instead, log4j offers the applications the ability to have better logging facilities at a relatively low cost thanks to open source and the lack of obligations it gives users. It’s usually not that important, but the collective quality-of-life improvement across the industry was evidently of great importance, seeing how much use it garnered. Am I saying people shouldn’t go and donate to log4j? Absolutely not. But no, I disagree that you really have a moral obligation to pay maintainers for libraries you import. It’s extremely good that the maintainers of log4j are selfless enough to tirelessly provide support during this obviously volatile moment, but they are not required to, anymore than anyone is required to donate. In any case, reactionary action every time something goes wrong sure as hell won’t fix anything that might be broken about open source. If you want to be paid for something, consider not using the open source model, or using a dual-licensing model. Not all software simply must be open source. But: The largest net benefit to the world for something like log4j could only be seen with open source, and that is literally because of the lack of obligation, not in spite of it.