If people like this are still falling through the cracks, clearly there aren&#x27;t enough.

Apache Software Foundation does not pay any software developers -- so its a very different model than what you are proposing.

I agree more would be better, but aren&#x27;t there several now, such as the Free Software Foundation, the Software Freedom Conservancy, and the Apache Software Foundation?

NTP is important as well. If I remember correctly, that decision was made around the time that NTPD was found to have multiple exploits allowing amplification attacks. Given that there are so many publicly available NTP servers, that makes it a pretty important project.The fact is that all of these projects need better funding. Frankly it surprises me that large multinational corporations that care about security don&#x27;t just fund these people. The downside risk for them is terrible.

Visibility, those who scream loudest win, people were screaming about NTP (long before heartbleed as it happens).

I&#x27;m really dismayed that the Core Infrastructure Initiative, which was created in the aftermath of Heartbleed to fund OpenSSL and other critical software, has chosen to prioritize NTP, and not GnuPG[1]. Most of the companies that rely on OpenSSL are probably using a distro that uses GPG to securely distribute the OpenSSL package.[1] <a href="http://www.linuxfoundation.org/programs/core-infrastructure-initiative/faq" rel="nofollow">http:&#x2F;&#x2F;www.linuxfoundation.org&#x2F;programs&#x2F;core-infrastructure-...</a>

Back when, there were one time acts of funding such as the red hat and va linux ipos that gave shares to authors of the software they were distributing.

... maybe the problem is people working for free and giving software away for free? The open source culture is a vehicle for entrepreneurs and investors to profit from others&#x27; work without compensation. It&#x27;s that simple.Hoping for donations to reasonably compensate developers is beyond naive.

I was thinking the same thing. It would be nice if there was some donations hub for open source projects with some sort of mixed Patreon&#x2F;Humble-Bundle mechanic were you could donate N bucks to X open source software projects, one time or in a monthly basis.The difficulties I see with this approach is 1) getting a trustworthy intermediate and 2) how to select the projects to allow the donations for. But 2) shouldn&#x27;t be that hard because the users could, in the end, pick who they want to donate to.

There does seem to be a need for an &quot;Internet fund&quot;. Pick 100 of the core free technologies that everyone relies on and pay people to maintain them.

I&#x27;m curious to know if there&#x27;s any proof for this?

I have that &quot;pay me to fix bugs&quot; attitude, too. After all, my chosen profession is software developer and one of the things my employer pays me to do is fix bugs.

Yeah I&#x27;d be keen to learn more of the nefarious stuff, if it exists, in which case the donation gets pulled back.

&gt; seems to have a &quot;pay me to fix bugs&quot; attitudeThere&#x27;s nothing wrong with that attitude. There&#x27;s no reason why he should be doing work without pay.If people send him bug fixes and he refuses to merge them, that&#x27;s something else. But he doesn&#x27;t have to work for nothing. I assume that whatever money he may be receiving from the German government may be used for other kinds of developments, not bugs that don&#x27;t affect him.

Because this article is misleading. Apparantly, Koch has been subsidized by the german government thus felt no need to be used the FSFE. Secondly, gpg isn&#x27;t really used for enterprise email, SMIME is or commercial php.There&#x27;s a history of Koch that is pretty ugly. He tried to start a consulting company with said government money and seems to have a &quot;pay me to fix bugs&quot; attitude. This breathless &quot;omg must donate now&quot; sentiment dominant here is highly questionable.gpg should be under and funded by FSFE not via begdonations and german government funding.

Why wouldn&#x27;t you be concerned if it fell under a US-based organisation? A country that has admittedly no qualms in doing anything, from torture to murder, to get their own way? Long live the petrodollar.

Can someone explain why GPG in the person of Werner Koch isn&#x27;t substantially funded under FSFE?My first thought was the Software Freedom Conservancy. The only reasons I see for them not to take GPG under their wing are lack of will (but why?), sense of funding priorities (but why?), or the possibility that some GPG constituents would be concerned about associating GPG strongly with a US-based organization.

GPG is an integral part of the Open and Free internet.Imagine all the workflows that depend on verified encryption signatures like Debian, Ubuntu, etc and that&#x27;s just software distribution, not counting privacy issues like journalists, political dissidents, whistle blowers, etc using it for secure communications.It was pretty easy to donate, took me less than 2 minutes. I encourage everybody that is able to make a donation, however small, every euro counts.

Me too. This software is too important to not have someone dedicated to it full time.I left a note that he (like the EFF and the ACLU) should have a recurring donation option, or at least an option to receive a once yearly email asking for a donation. There are many people that would happily go with a recurring donation if that option were available.

This might be one of a few places where I will upvote &quot;me too&quot;-comments.And, as others have pointed out it is easy and you can choose between cc and PayPal.

Ditto.  Was just talking with one of my employees this week about setting up encrypted email.  Right now we use OTR chat for any sensitive stuff, but that&#x27;s not always the most convenient channel.  Like most others I had no idea this project was so under-funded.

Watching the bar on the GnuPG homepage is pretty encouraging. Since the article was written, we&#x27;ve donated nearly €30k more. It looks like the problem was that people hadn&#x27;t heard about it, not that we&#x27;re all too selfish to donate.I just chipped in $25.Edit: Over €10k more in the hour since this comment. It&#x27;s now 2&#x2F;3 of the way to the funding target.

(me too)Interesting to see more people have donated so far in 2015 than the whole of 2014.

I donated last year, and just donated again.Really happy to see that this post on HN has traction, and delighted to watch the counter go up. GPG and other security projects need a way better tech PR push.

Probably OpenBSD&#x27;s signify.You are of course aware signatures don&#x27;t solve the licensing problem however, which is a Trusted Client problem (i.e. unsolvable).

Yes it has, there are a variety of licensing solutions for Mac OS X that do this (the openssl verify signed cert for licensing).For example: <a href="https://github.com/glebd/cocoafob" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;glebd&#x2F;cocoafob</a> or
<a href="https://github.com/bdrister/AquaticPrime" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;bdrister&#x2F;AquaticPrime</a>

What is the simplest program out there right now, open-source, that will let me sign binaries with a key?I&#x27;m experimenting to do a dead-simple licensing system using SSL certs and signing--rough idea is, cert is from me, and when it expires, software says &quot;lol no get new cert&quot;.I&#x27;m sure this has been done before, but the amount of custom license management code I&#x27;ve seen in the wild makes me wonder...

You are using Ubuntu, I see from your profile.
How much have you paid them?This is how the stories goes: we haven&#x27;t figured out
how to make good work worthwhile.Perhaps we can learn something from our vast experience in profitably peddling shit?

For the most part, they&#x27;re open source and have no significant revenue.Or they&#x27;re small for-profit companies and they can&#x27;t spare the revenue.Or they&#x27;re large companies and no one with a budget and decision power is even aware they use the product.Or they&#x27;re Red Hat... With limited budget for this and unlimited needs to cover.

Why aren&#x27;t those organisations paying him money?

I freely confess to being flabbergasted by these displays
of less-than-rigorous thought processes.How would a free software project &#x27;pay it forward&#x27;?They are in a very similar position, aren&#x27;t they?Edit: For some reason, I can&#x27;t reply to child comments (probably a cool-off time-out at work?).Just a short note here, then: $1.25e6 for the FSF translates
to 10 developers like Koch being paid (the donation page quotes &quot;120000 EUR&quot;).That&#x27;s ten. For the whole FSF. As an example of a well-funded project.
I&#x27;m not going to comment on that. HN would rightly give me months of cool-off time.

A cultural and structural change is needed when things like GPG get nothing, while viral, superficial and gimmicky work gets snapped up for millions or billions, when end users choose free products that threaten privacy and flood our world with advertising rather than pay the price of a cup of coffee for quality trustworthy products.Even sadder is the fact that these &quot;free&quot; things actually cost us much, much more. <a href="https://news.ycombinator.com/item?id=8585237" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=8585237</a>

&quot;Pay it forward&quot; means to grant a favor or gift on a random person, in remembrance of one who did a favor for you before. The idea is to initiate a chain of favors and gifts to brighten the world in general.It&#x27;s a play on words though, by analogy with &quot;Pay it back&quot; which is returning a favor to one who did a favor for you first (like paying back a debt). In the case of large distros being heavily reliant on GPG and other upstream projects, I think the applicable term here is &quot;pay it back&quot;.Upstream developers helped out Debian, et al, and now Debian needs to pay those developers back. Arguably, by gifting their distros to the world at large, they&#x27;re already &quot;paying it forward&quot;.

Seems odd that the MANY projects dependent on GPG don&#x27;t donate enough to GPG to employ one guy.Do Free Software project with funding &#x27;pay it forward&#x27; to the volunteers on other projects they heavily depend on? (I don&#x27;t really know) If not, they deserve to suffer the consequences.

Matthew Green, who sits on the CII&#x27;s advisory board, tweeted:&quot;CII does what&#x27;s beneficial to its members. Privacy tools aren&#x27;t&quot; [<a href="https://twitter.com/matthew_d_green/status/563388993203867649" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;matthew_d_green&#x2F;status&#x2F;56338899320386764...</a>]...which indicates to me that GnuPG wasn&#x27;t sold properly. It&#x27;s not just a &quot;privacy tool&quot; -- it&#x27;s one of the ways that software (including OpenSSL) is securely distributed. I would guess that quite a few of the CII&#x27;s members benefit from GnuPG and don&#x27;t even realize it.

The Linux Foundation&#x27;s Core Infrastructure Initiative agreed to fund Werner $60,000 several weeks ago for his critical GnuPG work.<a href="https://twitter.com/gnupg/status/563456662024228865" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;gnupg&#x2F;status&#x2F;563456662024228865</a>

Shouldn&#x27;t it be part of that Core Infrastructure Initiative project then?

&quot;If you like to donate Bitcoins you may use the Wau Holland Stiftung account too.&quot;Link: <a href="https://www.wauland.de/en/donation.html#61" rel="nofollow">https:&#x2F;&#x2F;www.wauland.de&#x2F;en&#x2F;donation.html#61</a>

I dont see a way to contact anyone there. Can they please add bitcoin?

That&#x27;s really cool. When people unite...My name isn&#x27;t even on the list of recent donors anymore, that&#x27;s going fast! Maybe he&#x27;ll wake up tomorrow and hit refresh a couple times to be sure there&#x27;s nothing wrong with the counter, hehe.

The counter on the kindly linked donation page went from
EUR 49.470 to EUR 65.126 in the last 60 minutes (precisely).

Of course on the other hand, it is overstated here too.Email Encryption Software Relies on One GuyErr... did PGP recently go bankrupt?Edit: Crap, it&#x27;s worse, they seem to have been acquired by Symantec. Is it still any good?

Thanks for the donation link, I just used it. It seems odd to me that an article bemoaning the fact that GnuPG&#x27;s author is going broke gives no information at all on how to help rectify that condition.

something like this is just too important to not donate money to.

Was unware about funding issues.  Just donated 20 EUR.

&gt; It&#x27;s also used in countless applications to encrypt data at restexactly. Given the number of corporate laptops encrypted by the corporate IT with that software , and thus definitely some &quot;license&quot; style good money were paid by the corporations to some entities ... i never believed in the magical concept of trickle down and sounds like it doesn&#x27;t work here too.

Calling GnuPG &quot;email encryption software&quot; really understates its importance. It&#x27;s also used in countless applications to encrypt data at rest, and GPG signatures are used to secure the distribution of software. For instance, GPG is an essential part of the package managers of Debian, Ubuntu, and RedHat.Here is a link to the donation page: <a href="https://gnupg.org/donate/index.html" rel="nofollow">https:&#x2F;&#x2F;gnupg.org&#x2F;donate&#x2F;index.html</a>

&gt; open source and free for non-commercial, require a donation if it is used in a commercial productEvery serious definition of &#x27;open source&#x27; or &#x27;free software&#x27; says that you can&#x27;t discriminate by field of endeavour - if you have one set of rules for commercial use and one for non-commercial use, it&#x27;s not really open source. And the nature of donations is that you can&#x27;t require them.That&#x27;s not to say that you can&#x27;t build a business model around open source software. You can charge for pre-built binaries, you can charge for exceptions to the GPL license to build proprietary software with it (this is what Qt used to do), or you can charge for services associated with the code (e.g. running a hosted service). You can even technically charge for the code itself, though since anyone who buys it can resell it or give it away, that sounds precarious.

Don&#x27;t forget that permissive licenses are one of the main reasons people widely adopt these tools in the first place.I hear you though. Free of charge and open source need to be two separate things (not all the time, of course). Cutting costs in FOSS development usually means spending less time on websites, documentation&#x2F;support and UIs, which hurts the projects in the long term. It&#x27;s a vicious cycle.

Affero GPL would be a much better choice.GPL lets anyone running a webapp pretty much ignore everything in the GPL license.

It&#x27;s nice in theory, but then the defintiion of &quot;commerical&quot; can mess it up, and can be subject to how judges (anywhere in the world interpret it). A german court ruled that &quot;non-commerical&quot; (in a CC licence) meant only for personal use, and non-personal entities had to pay. <a href="https://www.techdirt.com/articles/20140326/11405526695/german-court-says-creative-commons-non-commercial-licenses-must-be-purely-personal-use.shtml" rel="nofollow">https:&#x2F;&#x2F;www.techdirt.com&#x2F;articles&#x2F;20140326&#x2F;11405526695&#x2F;germa...</a>

&gt;I also think we need to change to way we think about critical software like GPGMaybe the lesson here is not to license important software under such permissive licenses. Make it open source and free for non-commercial, require a donation if it is used in a commercial product. I don&#x27;t really see how you can give something away for free and then expect companies to volunteer to pay for it.

I&#x27;ve been complaining about this on HN before; lot&#x27;s of startups built chat apps on top of GPG during the whole Snowden thing and Werner can&#x27;t raise $120,000.I&#x27;m really glad Pro Publica picked it up, but I also think we need to change to way we think about critical software like GPG. The GPG Tools team (GPG for Apple Mail) recently stated they need to charge for the tool in the future because they simply can&#x27;t handle to amount of work anymore (it&#x27;s still GPL) — the response from us was nothing but outrage.&#x2F;&#x2F; I just realized all of this is mentioned in the article. My bad.

His point stands though. GPG never caught on as a commercial product or something that people would pay for. Both are Open Source, that&#x27;s not the issue.

PGP is source-available with a proprietary license.[0] It was only ever free to use for non-commercial purposes.[0]<a href="http://www.symantec.com/connect/downloads/symantec-pgp-desktop-peer-review-source-code" rel="nofollow">http:&#x2F;&#x2F;www.symantec.com&#x2F;connect&#x2F;downloads&#x2F;symantec-pgp-deskt...</a>

PGP is not open source.Parts of its source code are viewable and reviewable, associated with key cryptographic functions. Much of what PGP builds is structure around that, and most of that isn&#x27;t open in any sense of the word.Phil Zimmerman (who&#x27;s long since left the building) does understand the value of source review, and the team who supported PGP continued that legacy. But it was quite limited in scope.That said, PGP also did work with other implementations, including GPG, to resolve compatibility issues -- I&#x27;m aware of a few of those personally myself.

PGP went commercial to deal with lawsuits, but it is still open source.I would like if someone with more understanding of the situation could outline the risks of allowing PGP to be the only implementation.

How can a UX designer help in the GUI aspect?Who to contact?

This is sad but not super surprising. Historically, if you had money and wanted a reasonable UI and cleaner integrations, you bought PGP (now from Symantec). GPG was always for people unwilling to pay.For the record I donated. I&#x27;m just pointing out that writing something that&#x27;s bundled and distributed as part of something else means nobody thinks about your project, or in many cases even realizes they&#x27;re using it.

Wrapping the command line should be a little bit safer from a security perspective, since a memory exfiltration bug won&#x27;t transfer across processes.  Just don&#x27;t use the shell between the wrapper and the command.

is gpgme not a proper library?<a href="https://www.gnupg.org/%28it%29/related_software/gpgme/index.html" rel="nofollow">https:&#x2F;&#x2F;www.gnupg.org&#x2F;%28it%29&#x2F;related_software&#x2F;gpgme&#x2F;index....</a>I haven&#x27;t used it, so I really don&#x27;t know.

&gt; Most GPG &quot;libraries&quot; in languages like Python and Ruby are just wrappers around the GPG command-line, because there is no proper library.IIUC this is intentional design of GPG 1.x vs GPG 2.x: the former is statically linked binaires for &quot;security reasons&quot; while the latter is a shared lib (libgcrypt) + binaries with exactly the same features.

I knew that the developer pool for GPG was pretty small, and that this is a big reason why development isn&#x27;t always fast.On the other hand, I had no idea that he was working full-time on it, and having money trouble.Also: If you search for &quot;GPG Koch&quot; you can come across this comment:<a href="https://news.ycombinator.com/item?id=6942254" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=6942254</a>EDIT: An example of development that is slow-coming: library support. Most GPG &quot;libraries&quot; in languages like Python and Ruby are just wrappers around the GPG command-line, because there is no proper library.

You should have tried searching for GnuPG: <a href="https://hn.algolia.com/?query=GnuPG&amp;sort=byPopularity&amp;prefix=false&amp;page=0&amp;dateRange=all&amp;type=story" rel="nofollow">https:&#x2F;&#x2F;hn.algolia.com&#x2F;?query=GnuPG&amp;sort=byPopularity&amp;prefix...</a>I remember it made the front page (but that might have been during business hours here in europe).

That could be an interesting project for someone. I suspect the hardest bit would be how you determine which projects are most important or most deserving of donations. As soon as money is involved, people will try to game it and spam it.

Gratipay (gittip) comes to mind, but that&#x27;s a donation mechanism, rather than the information collection you&#x27;re describing. Sounds like a good idea for a project. IMO, the hardest part of that will be accurately prioritizing which projects are critical, very important, moderately important, etc.

Freedom of the Press Foundation does this although they target projects and organizations that focus on issues related to the press and journalism.Example: <a href="https://freedom.press/bundle/encryption-tools-journalists" rel="nofollow">https:&#x2F;&#x2F;freedom.press&#x2F;bundle&#x2F;encryption-tools-journalists</a>

Here it is: <a href="https://www.fsf.org/campaigns/priority-projects" rel="nofollow">https:&#x2F;&#x2F;www.fsf.org&#x2F;campaigns&#x2F;priority-projects</a>. It seems not all of them have clear &#x27;donate&#x27; buttons, but donating to fsf with a comment might work.

I&#x27;m wondering if there is a meta-donation page that lists a bunch of the most important open source projects, how you can donate to them and their yearly funding goals (and how many developers are being supported).

&gt; When the library can be added by tossing a few lines into `pom.xml` and having Maven fetch it, and the API can mostly be figured out w&#x2F; javadoc and your IDE&#x27;s autocomplete: how many developers will even visit the project homepage and see a &quot;We need funding!&quot; banner?That&#x27;s a good point.Not sure how this can be technically addressed though

&gt;I think people would donate if they knew about it.Oh certainly, I use GPG on a daily basis, yet it never even occurred to me that such an ubiquitous project would have trouble gathering funds!I tossed in a donation as soon as I saw the link in the article.---I remember jOOq (a Java SQL DSL) had similar troubles raising donations. They ended up moving to a commercial licensing model for 3.2+ that provides connectors for &quot;enterprise&quot; databases as well as professional support.Had I seen a banner asking for donations, I would&#x27;ve gladly donated what they&#x27;re now charging for licenses. -- It is an excellent library.However I feel like the tooling does them a disservice. When the library can be added by tossing a few lines into `pom.xml` and having Maven fetch it, and the API can mostly be figured out w&#x2F; javadoc and your IDE&#x27;s autocomplete: how many developers will even visit the project homepage and see a &quot;We need funding!&quot; banner?

There&#x27;s no general answer to your question. It&#x27;s like game theory, depends on the players and context (technical, legal, financial, market maturity).Juce and PyQt were created by single developers, so it&#x27;s not impossible. Staking out and defending a niche would be a prerequisite, open-source or proprietary.

This issue has been bugging me lately, given that I would like to start a product-oriented business, but I&#x27;m only one guy, who has to freelance to pay the bills.The problem, I think, lies in the lack of balance between different types of &quot;users&quot;, their ability to absorb risk, and their ability to advertise.For an individual developer, new product development is a chicken-or-egg issue: you need money to live, but you can&#x27;t make money off of an infant project. On the other hand, a corporation can siphon funds off of profitable projects into R&amp;D, and the larger the company, the longer they can do it. There is a certain level of financial security that removes emotional burdens that can be real impediments to development progress. There is a singular focus that can be achieved by the developers in such a situation: one 100% focused developer is more than twice as productive as one 50% focused developer, all else being equal.It&#x27;s also extremely difficult for an individual developer to get the word out on their project. But if Google even breaths a hint that they are doing something, a subreddit will be made for it overnight and TechCrunch will assign a team of reporters to cover breaking news.So from the start, the individual is behind the 8-ball in terms of being able to maintain a certain pace of development and gain mindshare for it. If you&#x27;re entering an existing market, a lot of times the only way to gain traction for your project, to get any attention and get anything out of it, is to have to open source it just to meet other developer&#x27;s expectations.But I suspect the vast majority of people who want &quot;open source&quot; really only want it as a security blanket and aren&#x27;t actually going to look at it. I completely admit that I&#x27;m included in that group.For a corporation, what&#x27;s the worst that can happen? In other words, who is going to fork their source? Another individual? They won&#x27;t be able to keep up. Another corporation? They have to compete in both code and marketing, which isn&#x27;t so attractive. It might be--all things considered--an equivalent effort to just start a competing product. Maybe even a little less effort, because you don&#x27;t have to dance around collaboration and contribution issues.But for an individual, it&#x27;s a significantly higher impact of a problem. If I make a tool, release it open source, and--say--Google decides that it&#x27;s great and they want to use it, even if I license under the GPLv3, they can very easily strong-arm me out of the driver seat. They could be in complete compliance with the license and contribute all of their changes back, but their marketing machine could easily put themselves at the forefront of developers&#x27; minds as the source of that project.Is &quot;closed now, open later&quot; the solution? I don&#x27;t know, that&#x27;s always sounded to me like &quot;closed now, closed later&quot;. See Android. What good is Android being open source if, by the time the source for the latest version is released, they&#x27;ve abandoned it for a new version?Correct me if I&#x27;m wrong. I&#x27;d like to be wrong, so I know in which direction to take my own business development. But it just seems like there are several types of power, and individual, independent developers have few that large corps do not, whereas large corps have several that indies do not.

I think the biggest problem is visibility for these projects.
They need to be louder.
In the case of openssl, I had no idea that they were severly underfunded (until heartbleed).Same for GPG until now. I didn&#x27;t hear they asked for donations.And I doubt I&#x27;m the only one. So I quickly checked if maybe this was big on HN at a point and I just missed it.<a href="https://hn.algolia.com/?query=GPG%20donation&amp;sort=byPopularity&amp;prefix&amp;page=0&amp;dateRange=all&amp;type=story" rel="nofollow">https:&#x2F;&#x2F;hn.algolia.com&#x2F;?query=GPG%20donation&amp;sort=byPopulari...</a>
<a href="https://hn.algolia.com/?query=GPG%20fund&amp;sort=byPopularity&amp;prefix&amp;page=0&amp;dateRange=all&amp;type=story" rel="nofollow">https:&#x2F;&#x2F;hn.algolia.com&#x2F;?query=GPG%20fund&amp;sort=byPopularity&amp;p...</a>
<a href="https://hn.algolia.com/?query=GPG%20money&amp;sort=byPopularity&amp;prefix=false&amp;page=0&amp;dateRange=all&amp;type=story" rel="nofollow">https:&#x2F;&#x2F;hn.algolia.com&#x2F;?query=GPG%20money&amp;sort=byPopularity&amp;...</a>Nope. It&#x27;s not just me.If not even the most technical people (that actually know what GPG and openssl are without looking it up) don&#x27;t hear about this, how are regular people going to find out where to throw their donations at?I think people would donate if they knew about it. I&#x27;m going to send this guy $100 and consider it a license fee, because he deserves it.

I hear you brother. Strange world indeed. I don&#x27;t use GPG but I am donating some, just to tilt the balance a bit.

I personally know lots of people here in Germany living off 20k&#x2F;year and less. More would be better, but it&#x27;s doable.

It&#x27;s a sad day when Farmville can become a billion dollar business and Werner can&#x27;t feed his kids. I&#x27;m curious if he&#x27;s truly living on ~$20k&#x2F;year. That seems ridiculously low for life in Germany. Or if he&#x27;s got other sources of income to bolster that.Either way, what really needs to happen is companies that build programs off his work need to make a concerted effort to donate to the project. Heck, set aside a small percentage of revenue and consider it a cost of business.

Good point, but you have to admit that the site does not look inviting at all and that a novice has no idea where to start.

&gt; I&#x27;ve ended up digging through lists of tough bugs each with fairly impressive sounding discussions by people who are way more familiar with the whole ecosystem than I am and it&#x27;s sort of intimidating.Sometimes it&#x27;s small things, like documentation. For example:<a href="http://bugs.python.org/issue17701" rel="nofollow">http:&#x2F;&#x2F;bugs.python.org&#x2F;issue17701</a>

I&#x27;d suggest looking for smaller repos to contribute to. Much less daunting, much more opportunity. My small OS contributions have been where a small repo, owned by one guy, does mostly what I&#x27;m looking for but I want some feature or notice some bug. Then it is easy to work on it&#x2F;fix and do a pull request. They&#x27;re usually happy for the activity.

Many people do, e.g. bugs tagged E-easy in rust bug DB<a href="https://github.com/rust-lang/rust/labels/E-easy" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;rust-lang&#x2F;rust&#x2F;labels&#x2F;E-easy</a>

I&#x27;ve sometimes wondered whether it&#x27;d be worth mid-to-large open source projects doing more triage for bugs. Because I&#x27;m in a similar position: I&#x27;m happy to make small fixes to stuff I use, but I&#x27;m not familiar enough with many codebases to fix big bugs. If I could pull up a list of bugs sorted by &quot;expected ease of fix&quot;, I think I&#x27;d contribute a lot more.

I would suggest you to look also at high-priority free software projects: <a href="https://www.fsf.org/campaigns/priority-projects" rel="nofollow">https:&#x2F;&#x2F;www.fsf.org&#x2F;campaigns&#x2F;priority-projects</a>.

I had no idea this project (and others) had so few contributors. I&#x27;d love to be involved in some Open Source project but I always feel like &quot;yeh there&#x27;s probably millions of people far more talented than me wanting to contribute&quot; and I&#x27;ve no idea how to start. Some people suggest taking a look at the open bug lists for software you use frequently, but on the few occasions I&#x27;ve tried that (python, gcc, and a couple of others) I&#x27;ve ended up digging through lists of tough bugs each with fairly impressive sounding discussions by people who are way more familiar with the whole ecosystem than I am and it&#x27;s sort of intimidating.I did manage to do some isolated contributions to Open Corporates (<a href="http://turbot.opencorporates.com" rel="nofollow">http:&#x2F;&#x2F;turbot.opencorporates.com</a>) where the community are super-welcoming and very patient, but I&#x27;ve felt a little isolated and like I&#x27;m not exactly giving much back. Apologies for the mildly-OT rambling.

By the time he searches for a new job, interviews, successfully gets a new job, stops contributing, and people finally NOTICE that he&#x27;s abandoned the project: it&#x27;s already too late.You can offer him all the $5 donations in the world, but he has a full-time job now and has no reason to return to this life of &quot;financial ingratitude&quot;.I&#x27;m pretty sure we all would miss him working on it, either directly or indirectly, I think, as developers, we do a horrible job of assessing our blind spots when it comes to infrastructure.

It&#x27;s not normally in me, but I&#x27;d like to be a little forgiving toward users of GPG and similar infrastructure, particularly money-making BigCos. Open source, particularly reliance on open source by said MM BigCos, is relatively new.It may not be financial ingratitude. It may be that we just haven&#x27;t reached a sensible equilibrium between the two symbiotic ecosystems. At some point in the future, &quot;due diligence&quot; might commonly include identifying these sorts of tools, and their developers, and deciding either to not use the tool or to fund the tool&#x27;s health.

This. I mean, if anyone would miss him working on it, they would already be donating yearly anyway. Right?You shouldn&#x27;t always work just for money, but this is financial ingratitude.

Sure, why not? His (and his family&#x27;s) life should be more important to him than you getting to use GPG.

&gt;&gt;In your scenario, what will happen to GPG? The world just loses this essential asset?I say f*ck the world.

I&#x27;m not saying that GPG is exactly where it needs to be, but is it lost? The code is out there and it is in use by many around the world. Just to play devil&#x27;s advocate, what&#x27;s wrong with stopping development on it?

&gt; In your scenario, what will happen to GPG? The world just loses this essential asset?It won&#x27;t suddenly erase itself from all the world&#x27;s computers. It&#x27;ll still be there. It&#x27;ll still work the same way it worked the day before.Perhaps someone else will pick it up?

I think it is cruel, heartless and selfish to expect a poor man to work for the benefit of the world without benefit to himself. If it&#x27;s done by free will it is awesome, but is astoundingly arrogant to expect someone to do it by default.

That is absolutely not what would happen. Some organization that relies on it would fork it and maintain the fork. It would be highly likely they would even ask him to consult.

&gt; In your scenario, what will happen to GPG? The world just loses this essential asset?He&#x27;s not immortal - at some point someone else has to step up to the plate.

&gt; He should take a job, take care of himself (no one else will), and give gpg whatever time he has left, if he has the energy.In your scenario, what will happen to GPG? The world just loses this essential asset?

At 53 years old and $25,000&#x2F;year, he almost certainly has not prepared for any reasonably comfortable or safe&#x2F;secure retirement (not knowing anything else about his personal life). There will come a point where he simply cannot work. He must take care of himself first. Or, to put it another way, if he doesn&#x27;t take care of himself, then he&#x27;ll reach a point where he can no longer take care of GPG, much less any dependents.

Whether he&#x27;s been cheated or not depends on your values.  Many people cheerfully give up revenue maximization in order to perform some service they perceive to be of great value.  You can&#x27;t really have a meaningful political movement without such people.

He&#x27;s been voluntarily cheated. He should take a job, take care of himself (no one else will), and give gpg whatever time he has left, if he has the energy.

<a href="https://news.ycombinator.com/item?id=9004435" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=9004435</a>

This is why &quot;free as in beer&quot; is a problem for &quot;free as in freedom.&quot; Just to maintain things costs money because people take money to live, not to mention how much it costs to field things that are competitive on UI&#x2F;UX and other metrics with big closed ecosystems.

I gave my 0.02. Ok, a bit more than that, but everything helps. I don&#x27;t know what I&#x27;d do without GnuPG. It has so many uses beyond email...

In the last hour or so (I think since this hit the front page) there have been approximately €2000 of donations added to the drive at <a href="https://gnupg.org/" rel="nofollow">https:&#x2F;&#x2F;gnupg.org&#x2F;</a>, nudging it over €40000.Please do your part, and keep that bar moving.

See: <a href="https://gnupg.org/donate/index.html" rel="nofollow">https:&#x2F;&#x2F;gnupg.org&#x2F;donate&#x2F;index.html</a>The Wau Holland Stiftung takes the BTC and pays it out to the GnuPG project. Its a foundation that has its roots in the CCC and supports all kind of open source and&#x2F;or hactivists projects.

Is this address verifiable on the GPG site?

I have spread the word in bitmessage chans. People there are certainly concerned about privacy and love free software.

Can someone signal boost this on bitcointalk or other bitcoin communities? They are huge users of PGP. I don&#x27;t have accounts on any of those sites or I&#x27;d do it myself.

Thanks for tracking this down, just donated $100 and probably wouldn&#x27;t have bothered without a BTC address. :)

<a href="https://blockchain.info/it/charts/received-per-day?address=12LKeo24XCzgz6ASSxcUa8BvUfzkEyCpGq" rel="nofollow">https:&#x2F;&#x2F;blockchain.info&#x2F;it&#x2F;charts&#x2F;received-per-day?address=1...</a>
Amazing!

Wow, check out today&#x27;s donations. There are multiple 1+ BTC and one for 10 BTC. Over US$8000 donated today!

Thanks! Just donated what I had left on my phone and added 25Eur via paypal

Thanks. Way easier to donate 0.5 bitcoin than it is USD.

For bitcoin donations, you can go to [1], which gives the address as 12LKeo24XCzgz6ASSxcUa8BvUfzkEyCpGq [2]. The address is not generated per user, and is dedicated to GnuPG.[1] <a href="https://www.wauland.de/en/donation.nojs.html" rel="nofollow">https:&#x2F;&#x2F;www.wauland.de&#x2F;en&#x2F;donation.nojs.html</a>[2] <a href="https://blockchain.info/address/12LKeo24XCzgz6ASSxcUa8BvUfzkEyCpGq" rel="nofollow">https:&#x2F;&#x2F;blockchain.info&#x2F;address&#x2F;12LKeo24XCzgz6ASSxcUa8BvUfzk...</a>

Whether the work is &quot;principally cryptographic&quot; or not means fantastically little for it&#x27;s business value, what matters is that the fraction of the value Werner is capturing is almost unmeasurably small. What Werner needs isn&#x27;t donations, it&#x27;s a vehicle for capturing some of the value he&#x27;s creating.The idea I suggested (a consultancy retainer) is a way of converting his name into cash. At 10 hours a month, his function would mostly be limited to the company being able to say that he works for them, maybe have him join some high-level meetings, more than actually doing programming for clients.You&#x27;re in the general security business, you seem to be pretty good at business in general: don&#x27;t you know someone who could turn hiring Werner and two devs to work on GPG into cash?

The task of maintaining GPG isn&#x27;t principally cryptographic. GPG is one of those classic un-fun projects that the open source community is notorious for neglecting. So the problem isn&#x27;t finding and funding cryptographic experts to work on it; the problem is finding Werner Koches who are willing to take on the slog of making sure GPG continues to work.Look at how many crappy, trivially broken crypto messaging systems are posted to HN every year. Some of them even get funded! Nobody wants to work on GPG, which makes what Koch is doing even more important.

Don&#x27;t know about Moxie&#x27;s situation, but Werner Koch also has a young child and a wife [who&#x27;s not working, according to the article] to support.

&gt;It seems to me there&#x27;s a parallel to someone like Moxie Marlinspike who&#x27;s vaguely in the same field, but seems to be doing very well for himself.Moxie Marlinspike was doing well for himself when he was squatting in pgh and train-hopping, too. Some people are just better at coercing life into doing what they want to do. I think it helps that Moxie is probably a few standard deviations more intelligent than most humans, but that&#x27;s just a bonus.

Given the general scarcity of talent in the business, it should really be trivial for a high end IT security consultancy to pay Werner a €3000&#x2F;month (ie. enough to live on, if not extravagantly) retainer to be available ~10 hours a month to consult on encryption matters (or something like that).I wonder if it all really comes down to &quot;Really I am better at programming than this business stuff.&quot; or if there is some unstated dogmatism that gets in the way.It seems to me there&#x27;s a parallel to someone like Moxie Marlinspike who&#x27;s vaguely in the same field, but seems to be doing very well for himself.

And this is the weird conflict with open source software. OSS is primarily written because somebody needed it and didn&#x27;t have it. If they have it, and it works, they have no need to write it or support it. Eventually somebody stops supporting it, and then we all realize we&#x27;re in trouble, somebody forks it and support is taken up by somebody who needs it.I think this works. It&#x27;s sad that it depends on exploiting the virtually unpaid work of a few committed die-hards. But basically, it&#x27;s the only way we can have good gratis software without something stupid like bundling ads, lack of source code or &#x27;services-based&#x27; models. It&#x27;s clear from all the other unfunded OSS projects that corporate sponsorship isn&#x27;t going to happen unless they&#x27;re getting something in return.

&gt; Sadly, it doesn&#x27;t seem to be happening this way. I don&#x27;t understand why not.In at least one case it&#x27;s because a single open source contributor with an ideological conflict with App Stores was able to get an app removed:<a href="http://www.tuaw.com/2011/01/08/vlc-app-removed-from-app-store/" rel="nofollow">http:&#x2F;&#x2F;www.tuaw.com&#x2F;2011&#x2F;01&#x2F;08&#x2F;vlc-app-removed-from-app-stor...</a>

It doesn&#x27;t seem to be happening this way because FSF fundamentalists like RMS want the whole hog to be &#x27;Free Software&#x27; not just &#x27;Open Source&#x27;. Any compromise is unacceptable even if it means cutting off their nose to spite their face.See what happened to VLC as an example.

There is a considerable portion of the open source community which views capitalizing on software as inherently immoral. As soon as Werner Koch started charging money for it, most people would switch to a free fork or distribute it on the black market to spite him.

That was when distribution was via physical media. People don&#x27;t value bits on the wire the same way nor view &quot;distribution&quot; as a valuable function.

&gt; We give you the code, you can do whatever you want with it, but if you want to build on top of oursThe problem here is determining where the divide between &quot;using the software&quot; and &quot;building on top of ours&quot; is. The line becomes blurry when the software is (e.g.) a library where the basic use of the library is to base other software off of it (as opposed to a desktop app -- e.g. GnuCash -- where &quot;usage&quot; has a more straight-forward meaning).

&gt; but if you want to build on top of ours, you have to give backNo! Nowhere does the GPL says you have to give back to developers, you just have to give everything to the users (and more specifically to your users), because they are the one with the product and the modifications. If they happen to be upstream developers, then sure, they will get the changes too, but that is not the primary goal of the license. It&#x27;s all about the user being Libre.

Thanks for the links. So I wonder if you could charge for cloning a repo in Github. You know put your code there, but git clone (or fork) doesn&#x27;t work unless you feed it a onetime key, so you goto Github, &quot;buy&quot; your key, then pass it into your git command line<pre><code> git clone --token=0x1515151 &lt;repospec&gt;
</code></pre>
and git allows the clone to happen and tags it with the clone token. No token and you don&#x27;t get to get a copy of the source.If that would work it would be an interesting way of selling your software.

&gt; I have really hoped that the current app store model would turn out to be a great way to sell free software. A convenient way to pay, and you can download and install whatever you want. Optionally, you can have a link to the source code.&gt; Sadly, it doesn&#x27;t seem to be happening this way. I don&#x27;t understand why not. Perhaps I too am being too idealistic.As an indie app developer, I already struggle with people ripping off my apps and publishing them in various app marketplaces under similar or identical names, or taking my web app, wrapping it and charging money for it.I have to imagine that if I used a free software licence, this would happen a lot more, and I wouldn&#x27;t be able to issue takedown requests. Someone searching for the name of my app might find five or ten similar or identical looking results and have no idea which is mine. These other results might serve ads, track user behavior, gather personal information or perform other anti-user operations, leveraging the popular reputation my apps have built to do so.

&gt; I wonder sometimes if this is the legacy that RMS was thinking about.No.Free software was never about no money being involved. In fact, RMS himself used to get a lot of money by selling free software. Back in the day when Emacs was too big for the internet, RMS used to sell Emacs tapes at 100 USD each (with documentation and source code, of course).In fact, he still thinks that you should be charging money for distributing free software:<pre><code> Distributing free software is an opportunity to raise funds for
 development. Don&#x27;t waste it!
</code></pre>
<a href="https://www.gnu.org/philosophy/selling.html" rel="nofollow">https:&#x2F;&#x2F;www.gnu.org&#x2F;philosophy&#x2F;selling.html</a>He also thinks selling exceptions to the GPL is another good way to support yourself. FFTW and Qt are two prominent projects I can think of that did this.<a href="https://www.fsf.org/blogs/rms/selling-exceptions" rel="nofollow">https:&#x2F;&#x2F;www.fsf.org&#x2F;blogs&#x2F;rms&#x2F;selling-exceptions</a>The GPL itself is anti-freeloading. We give you the code, you can do whatever you want with it, but if you want to build on top of ours, you have to give back. It&#x27;s all about levelling the playing field for everyone.I have really hoped that the current app store model would turn out to be a great way to sell free software. A convenient way to pay, and you can download and install whatever you want. Optionally, you can have a link to the source code.Sadly, it doesn&#x27;t seem to be happening this way. I don&#x27;t understand why not. Perhaps I too am being too idealistic.

It&#x27;s a big problem with the culture of (a lot of) the software development community. Having a culture of demanding access to the source of your software is a good thing, but having a culture of demanding all software for no cost is a bad thing.

FWIW, RMS does live mostly as a nomadic ascetic (sort of like a Buddhist monk surviving on alms), which suggests that he believes that is an acceptable lifestyle for a hacker.

As jordigh points out, RMS has always been quite happy to charge money for software. For example, the FSF sells a $5,000 &quot;Deluxe Distribution&quot; compiled for a platform of your choice: <a href="http://gnu.ist.utl.pt/order/order.html" rel="nofollow">http:&#x2F;&#x2F;gnu.ist.utl.pt&#x2F;order&#x2F;order.html</a> I&#x27;ve spoken to various people at the FSF, and they&#x27;re generally quite enthusiastic about charging money for GPLed software.But to make a larger point, if you try to model RMS&#x27;s behavior using cynicism, you&#x27;ll tend to make inaccurate predictions. To use a metaphor, his brain is running slightly non-standard software: His social skills are not quite compatible with standard protocols, but he will go to far greater than ordinary lengths to uphold his personal moral principles. I&#x27;ve dealt with RMS and&#x2F;or the FSF a couple of times, and once I decided to assume that RMS wants exactly what he claims he wants, dealing with the FSF was actually rather pleasant.Thus, if Stallman thought that programmers should live ascetic lives, he would have written long essays justifying why this was correct. But instead, he wrote long essays about why sharing and hacking on software was a Good Thing, and added (almost as an aside) that you are welcome to charge as much as the market will bear, and that doing so may often be a good decision.

Free software means &quot;free as in speech&quot; not &quot;free as in beer&quot;.

I don&#x27;t think a generation has been tricked into giving &quot;free&quot; (as in beer) software; I think the generation brought it on themselves, and continues to do so. We&#x27;ve always been free (as in speech) to charge money for our free (as in speech) software.People are very eager to work for free on free (as in speech) software just for the pats-on-the-back from &quot;the community&quot;, it seems to me, at least as often as people do it because they&#x27;re truly passionate about their craft.With the rise of &quot;have a github profile&#x2F;opensource contributions&quot; in job posting descriptions, it&#x27;s only going to get worse. &quot;Open source&quot; is very rapidly becoming the &quot;unpaid internship&quot; model of hiring and distributing work in the software industry, and it breeds a sort of contempt for the notion of receiving compensation for one&#x27;s efforts. I&#x27;m not sure that&#x27;s a good thing with all the very-much-for-profit activity around software development.

Somewhat ironically, the GPL is much more amenable to getting money from software than the Apache, BSD, and other more permissive licenses. Most profitable companies built around Open Source software use the GPL (Apache being the notable exception).There&#x27;s simply very little reason for someone to pay for BSD licensed software, but there is reason to pay for GPLed software (even if only to get a different license for it).

I wonder sometimes if this is the legacy that RMS was thinking about. Sometimes, in my more cynical moments, it seems like we have somehow managed to trick a whole generation of programmers into giving &quot;free stuff&quot; to the world, enabling the creation of the very successful mega corporations which have then kept the value for themselves.Would it be impossible to create some sort of stipend program at FSF? After all the creation and maintenance of software is allowed to cost money under the GPL.

After the big openssl bug, wasn&#x27;t there some intent among some of the existing foundations to try to identify open source keystone projects and get them additional attention &amp; support?  It seems like the privacy advocacy groups might route some spending to GPG just as a pragmatic matter.

I completely agree that the services and companies that rely on those technologies should also contribute.But as a software developer, I use openssh daily in my job. I use tmux, I use nginx, I use openssl and a lot more opensource projects and they allow me to make a living. So, it makes sense for me to contribute.

You are right that we, as a community, are really bad at supporting key open source infrastructure. But I also think that relying on donations from individuals like us is a fundamentally wrong model. I don&#x27;t benefit directly from GPG, but I benefit from many services that make use of GPG and make lots of money off of me.

I&#x27;ve just donated. It&#x27;s an important project and Werner Koch needs to be rewarded.I feel that we, as a community, are really bad at supporting some of the opensource projects that powers our infrastructure. I&#x27;m not sure what can be done to improve this. Maybe we need a foundation that raises money for those projects and does the marketing needed to remind us to donate.I for one wouldn&#x27;t mind giving say 30 euros&#x2F;month to be redistributed between projects like GPG, openssh, varnish, nginx, openssl...

It would be really great if you could run an apt-get&#x2F;yum filter on your server and retrieve a list of donate links for the open source services you rely on.Ideally, a GPL+donate-what-you-can would really help maintain these projects.

Just like many here, I had no idea, and this is so important. I hope HN community will blow up this donation page!

That, and there&#x27;s unlikely to be a compelling story for VCs here. There are many many projects that are great and valuable to humanity and yet are not VC fundable.

Probably because he&#x27;s good at writing code, not writing business plans and raising money.

why doesn&#x27;t he watch some youtube videos on lean startups, write a business plan and raise some VC money?

I gave a little €5, but I&#x27;ll gladly give more when I have more income, I&#x27;m still a student :PI used PayPal and it went like a breeze too.

So I just donated €20 and I invite others to do it as well.(And they use Stripe for payments, which of course is relevant here on HN. And as a first time user, it was a breeze to donate.)

Making people pay for software is not evil. It is not giving those same people the source code that is evil.This is because by not giving them the source code you are keeping your users under your thumb and not allowing them the freedom to improve their lot.

Making people pay for software might still be evil, but supporting software with teaching how to use it, documenting it, publishing books about it, making conferences, supporting it is what I think is a reasonable way for oss spirited souls to make money.SQLite comes as an example - while completely free, public-domain, what might (I don&#x27;t know for sure) be making money for the three people behind it is the extensive test suite, various other extensions (compression, security) and possibly support&#x2F;integration&#x2F;customizations for specific needs (less memory&#x2F;cpu usage, or who knows what..)I&#x27;m also amazed at Mike Pall&#x27;s luajit&#x27;s effort, and he keeps his sponsors page here: <a href="http://luajit.org/sponsors.html" rel="nofollow">http:&#x2F;&#x2F;luajit.org&#x2F;sponsors.html</a>I&#x27;ve never used directly GPG, but since I&#x27;m debian&#x2F;ubuntu user I&#x27;ve donated money after reading one of the posts here.

But wait, I thought fame and accomplishment and helping lots of people were supposed to be enough for software authors, that somehow making people pay for software was evil, that it&#x27;s OK if everyone just copies your source code and uses it, that an Open And Free Internet would be self-sustaining?&#x2F;sarc

I wonder if a patreon-like (or even patreon itself) would be more effective raising donations than just one-time donations. I know enough people that swear by gpg, so it doesn&#x27;t strikes me as hard finding a base.

I think he should start a US nonprofit, or even better start cooperating with an international one, as that would allow people to deduct donations from their income. It&#x27;s a lot easier to donate if you know that otherwise 30%-50% of that would go to the ever hungry state...edit: It turns out every EU citizen can deduct a donation to GnuPG from their incomes!<a href="https://www.wauland.de/en/donation.html#61" rel="nofollow">https:&#x2F;&#x2F;www.wauland.de&#x2F;en&#x2F;donation.html#61</a>

IBM Model 30.  One of the few keyboards that doubles as a melee weapon. :)

I like his office setup. Dual monitors, raised base for monitors, plexo? lamp, white board, real keyboard.

Yes you can: <a href="https://www.linuxfoundation.org/participate/linux-donate" rel="nofollow">https:&#x2F;&#x2F;www.linuxfoundation.org&#x2F;participate&#x2F;linux-donate</a>

Strange you cannot seem to just donate to the Linux Foundation, you have to become a member?

he already receives a $60k&#x2F;year grant from them <a href="https://twitter.com/dmw_83/status/563448845733203970" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;dmw_83&#x2F;status&#x2F;563448845733203970</a>

GnuPG sounds like a prime candidate for Linux Foundation&#x27;s core infrastructure initiative. <a href="http://www.linuxfoundation.org/programs/core-infrastructure-initiative" rel="nofollow">http:&#x2F;&#x2F;www.linuxfoundation.org&#x2F;programs&#x2F;core-infrastructure-...</a>If they&#x27;re willing to fund a new NTP implementation then they should be able to drop a few coins in the GnuPG bucket too

Because they can get the source and not have to pay a penny for it? For businesses, that&#x27;s a good selling point.

The question is the wrong one. The better question is: why does so much software choose to depend on an underfunded library?

Good point. It&#x27;s not that clear and easy in all cases though. Besides, Stallman once disparaged SaaS business models as unfree and essentially a problem to be dealt with. While that in way makes sense from his point of view, it&#x27;s problematic for developers who try to make a living with providing a useful service.I very much agree for all system software and especially cryptographic and security-related software.What about a developer or a company though that&#x27;s put several years worth of work into developing a particularly useful novel solution to a specific business problem? If they use a proprietary license they&#x27;ll at first force others into depending on them once they start using the software but is that really wrong in every case? If on the other hand they immediately release their code under an open source license they might effectively commoditize their novel solution. Sure, they might be able to recoup some of their up-front investment but in most cases this won&#x27;t be a sustainable business model.Releasing the source code only to paying customers might seem like an obvious solution but depending on the nature of the software and the industry the customers might decide to just pay once and afterwards sideline the developer. Continued innovation can serve as an incentive to pay for updates but again this doesn&#x27;t apply to all fields and industries. Licenses such as AGPL might be a remedy, too but from experience I can see that software licensed under these or similar terms is mostly avoided in business contexts. I&#x27;m not sure if there&#x27;s any company that&#x27;s built a viable long-term business on a dual-licensing model.Not every closed source (or only partially open source) software product is created with malicious &quot;Let&#x27;s blackmail the customer into using our software forever.&quot; intent. Sometimes, it just makes good sense. However, in those cases I think companies should at least make provisions for releasing the code if they go out of business.

Stallman doesn&#x27;t and has never glossed over that programmers need to make a living. He has no qualms about charging for software and has happily done it himself. He says it&#x27;s wrong to use licenses to force people into depending on you.

You&#x27;re right. The problem is though that it&#x27;s not always that easy to distinguish between beer and freedom in this context. Depending on the software and the industry those two might be intrinsically connected.Besides, you might need a large number of lawyers anyway, for example if a company decides to simply disregard your carefully crafted open source license.

&gt;There&#x27;s also a problem with the purism put forth by some of the &#x27;free as in freedom&#x27; enthusiasts, most notably Richard Stallman, who seem to gloss over the fact that coders have to make a living, too or who even frown upon making money with software altogether. Software eats the world but even RMS can&#x27;t eat software.Here you are saying &quot;free as in freedom&quot;, while obviously referring to &quot;free as in beer.&quot; Your earnings shouldn&#x27;t be a function of then number of lawyers you employ (to make air-tight licenses.) That doesn&#x27;t imply you are not allowed to make money if you have too few lawyers. It implies the opposite, actually.

The problem boils down to &quot;Really I am better at programming than this business stuff.&quot;.Someone with his talent and expertise should have no problem with getting highly paid consulting gigs. Then he could continue working on GPG in his free time and even use the consulting income for hiring additional programmers to work on GPG. There are quite a few product-based businesses that could be built upon GPG as well (secure email, corporate communication tools, some kind of public-key-based social network come to mind ...). These could be used to support the continued development of GPG itself.It&#x27;s of course not as easy as it sounds. Not everybody wants to deal with &#x27;all that business stuff&#x27; and that&#x27;s fine but then by all means find someone who can help you with that part. If you want to change the world sometimes idealism alone just isn&#x27;t enough. You also have to proactively deal with the everyday stuff like where the cashflow for paying the bills will come from next month.There&#x27;s also a problem with the purism put forth by some of the &#x27;free as in freedom&#x27; enthusiasts, most notably Richard Stallman, who seem to gloss over the fact that coders have to make a living, too or who even frown upon making money with software altogether. Software eats the world but even RMS can&#x27;t eat software.How many successful larger companies come to mind whose business model is based upon open source? Red Hat, Ubuntu and that&#x27;s about it. If we truly want to avoid dilemmas like this one we also need to think about how to successfully implement sustainable open source business models.

Gratipay. Unfortunately their execution has been a bit poor, and it&#x27;s under-delivering. There&#x27;s too high a barrier to start donating and there&#x27;s no clear option for one-time donations.

Would Patreon or Gittip (which has changed its name to something I can&#x27;t recall at the moment) not work for this?In fact, Gittip&#x27;s original mission was tips for open source projects.

I wish there was a sort of &quot;Patreon for open source&quot; nonprofit service where I can support projects like GnuPG, OpenBSD, etc all in one place.

For that matter, I don&#x27;t know what I would do without BouncyCastle: <a href="https://www.bouncycastle.org/donate/index.cgi" rel="nofollow">https:&#x2F;&#x2F;www.bouncycastle.org&#x2F;donate&#x2F;index.cgi</a>This article made me think about donating.

Hopefully this article leads to a call-to-arms in the dev community to come up with best marketing&#x2F;fundraising practices. I know that the idea of meritocracy is very powerful (and not altogether wrong)...but it&#x27;s a tragedy when great software doesn&#x27;t get the minimal exposure because of relatively easy friction problems that can be fixed.I think of all the random, stupid things I&#x27;ve backed on Kickstarter, simply because I saw it on a friend&#x27;s Twitter feed...things like GnuPG may not get as much consumer reaction as most Kickstarter widgets, but there are enough developers with disposable income who would happily donate to open-source-in-need if such causes were just slightly more visible.

Just donated, GPG is quite a critical part of open source ecosystem.Please donate

This is a terribly injustice, and points to a larger systematic problem, that we software practitioners benefit greatly from the efforts of others to whom we barely offer anything back.And while the media can help (as in this case) what we should be looking for are systems to help with the situation. My ideal would be a system that monitors my package manager activity, and then using an algorithm I control, allocates &quot;pieces of the pie&quot; to each package I install and use. Then I determine how big the pie should be, and how it should be funded. E.g. if I&#x27;m working for a company, I&#x27;d request as part of my contract that I get a $200&#x2F;mo software budget. Or I could just fund it myself.If even a small fraction of us did something like this, the open-source world would blossom, and injustices like this one would be eliminated.

Why is there no Kickstarter equivalent for ongoing open source projects instead of just new things?

Lack of funds doesn&#x27;t even sound like the biggest problem here. If the project relies on one guy, what happens when he&#x27;s gone? Seems like something this important should have a higher bus factor.<a href="http://en.wikipedia.org/wiki/Bus_factor" rel="nofollow">http:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Bus_factor</a>

I&#x27;m part of the SymPy project and we opted out of a similar program tip4commit. It&#x27;s a bit easy to game. If you do it per commit, someone could just break up their work in smaller commits. The same thing with pull requests.I can see bounties for issues fixed, but a per commit system is fundamentally flawed.

Here&#x27;s something I think should get more love and is pretty relevant: a service that will automatically pay a percentage of Bitcoin donations for every submission to a GitHub repository: <a href="https://github.com/WhisperSystems/BitHub" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;WhisperSystems&#x2F;BitHub</a>So if you donate to Open Whisper Systems, you can see that your donations are going directly to those that are contributing to the project, and you get paid more if you&#x27;re contributing more. I&#x27;ve sent in a few PR&#x27;s to their iOS repo, and it&#x27;d be awesome to see it implemented in other privacy OSS projects. It&#x27;s obviously not a perfect system, but I think it&#x27;s a pretty cool way of funding OSS.

<a href="http://en.wikipedia.org/wiki/Netpgp" rel="nofollow">http:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Netpgp</a>

Just donated, and you should too!<a href="https://gnupg.org/cgi-bin/procdonate.cgi" rel="nofollow">https:&#x2F;&#x2F;gnupg.org&#x2F;cgi-bin&#x2F;procdonate.cgi</a>

Are you talking about job offers or are you saying that companies cut checks to open source devs at the behest of requests for some money? Who does this?If you&#x27;re talking about job offers, you can get jobs without spending off time doing open source. I look over at my co-workers who probably make similar salary as me and they don&#x27;t do much open source.

The question is, have you asked for compensation? And, there are plenty of devs at those evil VC-backed companies that give a lot in terms of open source contributions. Those millions of dollars aren&#x27;t being used to buy private jets; they&#x27;re paying salaries to devs just like you.

If you are going to expect being compensated, why are you making free software to start with? Why not make a paid one instead?

This shouldn&#x27;t be odd to anyone who&#x27;s spent a large amount of time releasing open source. You just end up being used and uncompensated. At best you get a job offer from it.It&#x27;s really sad to me how many companies benefit from open source (including my own software) without the author ever being compensated.It&#x27;s hard for me to get motivated to do anything open source anymore because of the feeling that I&#x27;m just a gullible idiot in the end.The feeling when I fix issues opened by people at VC-backed companies with millions of dollars is really really nasty. I always feel like such an idiot.

Donated 20 euros. It&#x27;s amazing, in some hours has one from 40.000 to 58.000!

Could he not just change the license to require commercial usage by companies with more than $x annual revenue to pay $y in license fees?Could still remain open source and free for majority of applications if x was high enough. Also, creates a system where those reaping the most also pay the most.

this is precisely the question I asked here - <a href="https://news.ycombinator.com/item?id=8863782" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=8863782</a>This is frustrating - a lot of these projects dont get funded just because of one reason: discoverability. People dont know that these projects need funding. OpenSSH was another. No telling how many others.

I think such comments are fine in this thread. This is an unusual case, and such things don&#x27;t come up all that often.If it started to get predictable it would be a different story.

I upvoted each person who said they donated or had something else that contributes to the thread.I reason that saying that you donated and perhaps how much, is in fact a good thread contribution. At least this time, I&#x27;ll take this on a case by case basis. Generally, however - I guess I&#x27;m against it since it clutters threads.

Meta-question, ideally aimed at Daniel if you&#x27;re reading this, but not interesting enough to email you plus wondering what community members think:Normally I&#x27;d be against comments like &quot;donated&quot; that add nothing else, and would downvote them for that. But in this case, does seeing lots of other people say they&#x27;ve donated make other readers more likely to donate themselves? If so, does that outweigh the negative of the page filling up with otherwise-pointless comments?I&#x27;ve not downvoted any, but would be interested in any opinions as to whether or not you have&#x2F;would downvote them and why.

We are collecting nominations for our DuckDuckGo yearly FOSS donations at <a href="https://duck.co/forum/thread/11753/foss-donation-nominations-2015-edition" rel="nofollow">https:&#x2F;&#x2F;duck.co&#x2F;forum&#x2F;thread&#x2F;11753&#x2F;foss-donation-nominations...</a>. The theme this year is mainstream privacy. This seems to fit well and we&#x27;d welcome others. Donations will go out soon.

&gt; Like many people who build security software, Koch believes that offering the underlying software code for free is the best way to demonstrate that there are no hidden backdoors in it giving access to spy agencies or others.I&#x27;m guessing this is a problem with the journalist misunderstanding the subject, who probably said publishing it as free software (which is not the same as giving it away for free) is the best way to demonstrate that it is secure.

ProPublica is the pinnacle of journalism right now.

Don&#x27;t forgot to donate to ProPublica for covering an unsexy story as well.

Just donated and you should too... ;) Great project!

The goal is now exceeded! The progress bar is even overflowing the box.

Just donated 50€, hopefully the goal of 120.000€ will be exceeded!

Is there some hacker group online that specializes on Crypto that can donate time and or money?

So, it wasn&#x27;t a donation, but Snowden that kept this developer going? I&#x27;m freaking out a little thinking this implies you can&#x27;t buy dedication or even good software.    Donating is a good thing of course, but it doesn&#x27;t solve this really disturbing meta-problem.

Cost of living varies widely. Having no dependents and living in an inexpensive place is great. Obviously, it&#x27;s better for us to fund people who use the funds as efficiently as possible, but we can&#x27;t demand that everyone&#x27;s life circumstances be identical.

&quot;He says he&#x27;s made about $25,000 per year since 2001 — a fraction of what he could earn in private industry&quot;The developer of git-annex assistant was happy when he received $20,000 on Kickstarter and he said with this money he could dedicate his time on this project for a full year. [1]Maybe he could also start a Kickstarter&#x2F;Indiegogo etc campaign so that he could hire another full-time developer? If enough people find this additional workforce on this project worthwhile, it will be funded.[1] <a href="https://www.kickstarter.com/projects/joeyh/git-annex-assistant-like-dropbox-but-with-your-own" rel="nofollow">https:&#x2F;&#x2F;www.kickstarter.com&#x2F;projects&#x2F;joeyh&#x2F;git-annex-assista...</a>

Would it help if some highly visible figure like Snowden or Poitras weighed in in some interview? I mean, they probably have a lot on their shoulders already but I cannot see anyone else who would be more motivated and more efficient at this task.I am probably missing something though. They must be somehow aware of the situation already and not consider it a top priority for some reason.

it&#x27;s just self-signed.All that means is that you are transferring trust to the owner of the site, rather than a CA, to properly deal with his own secure key, and that browsers hate it; but who cares about that part.I trust the GnuPG set of tools, and I have so for quite sometime. On the opposite side of things I have witnessed a ton of CA hacks in recent years...

It&#x27;s a bit disappointing that G10code[1] https identity verification fails. May be it makes sense given that he&#x27;s short on $$$$.[1] <a href="https://g10code.com/" rel="nofollow">https:&#x2F;&#x2F;g10code.com&#x2F;</a>

By itself, Google could pay that guy&#x27;s salary and even hire another dev to help him. Red Hat could do the same. In fact there are any number of companies that can step in and do the right thing.

Email Encryption Software Relies on One Guy, Who Is Going Broke