OpenSSL Software Foundation president: we need support from companies and governments for a team of 6+ full-time workers
Of Money, Responsibility, and Pride — Fate has made me the “money guy” for OpenSSL so I'm going to talk about that for a bit. — As has been well reported …
Context & Ripple Effects
Steve Marquess, who describes himself as OpenSSL's 'money guy,' has published 'Of Money, Responsibility, and Pride,' arguing that the OpenSSL Software Foundation needs backing from companies and governments to field a team of six or more full-time developers rather than running the internet's most widely embedded encryption library on unpaid labor.
The plea landed unusually hard: it was picked up the same day by the Globe and Mail and amplified by prominent security commentators including Matthew Green, Dan Gillmor, and the Grugq — a signal that the question of who pays for critical open-source infrastructure had escaped the niche and become a mainstream argument.
First-order effects
- The hundreds of companies shipping OpenSSL inside their products are now publicly named as the parties responsible for its upkeep, converting an invisible dependency into an explicit funding decision each of them has to make.
- The OpenSSL Software Foundation gains a concrete ask — six-plus funded positions — that gives potential donors a specific target instead of a vague appeal.
Second-order effects
- Corporate and government IT buyers face pressure to either contribute financially to the library they depend on or justify why they continue to free-ride, and some may redirect support toward better-funded alternatives rather than pay for OpenSSL itself.
- Other under-resourced open-source projects critical to internet infrastructure get a template for making the same argument, raising the competitive stakes for donor dollars across the ecosystem.
Third-order effects
- If the pattern holds, maintenance of foundational cryptographic software shifts from volunteer stewardship toward formally funded teams backed by the corporations and states that consume it — a structural change in how shared internet infrastructure is governed and paid for.
The trend: Critical internet infrastructure is running on volunteer-maintained open source, forcing the companies and governments that depend on it to decide whether to fund maintainers directly or keep absorbing the risk.