Google says it has been sponsoring two full-time Linux developers at the Linux Foundation for years to improve security and hopes other companies will follow
he explains his mission to make the software industry more secure Tweets: @linuxfoundation : NEWS: @Google @linuxfoundation announce they are prioritizing funds to underwrite two full-time Linux kernel security maintainers @embeddedgus and @nathanchance https://linuxfoundation.org/ ... #linux #linuxkernel #security #supplychain #oss Nathan Chancellor / @nathanchance : I am very very thankful that I can get paid to do something that I love :) thank you to everyone at Google and the Linux Foundation who was able to make this happen and I look forward to what this journey has in store for me. https://twitter.com/...
Context & Ripple Effects
This announcement is the earliest visible step in what became a sustained Google program of paying for open-source security rather than just contributing code: months later it was funding a push to write parts of the Linux core in Rust, and by October it had put money behind the Linux Foundation's $1M Secure Open Source pilot.
What distinguishes this move is that it funds named individuals — Gustavo Silva and Nathan Chancellor — as full-time kernel security maintainers, with Google explicitly asking peers to match it. The ask landed: Amazon, Intel, Microsoft and others later joined the Linux Foundation and OpenSSF's $150M+ supply-chain security effort, and by 2026 the same foundation was administering grants from Google, Microsoft, Amazon, Anthropic and OpenAI for maintainers dealing with AI-generated security findings.
First-order effects
- Two under-resourced kernel security maintainers move onto stable, Google-underwritten salaries at the Linux Foundation, converting volunteer-scale patch review into full-time capacity on the subsystems Google itself depends on.
- Google publicly frames its own sponsorship as a template, putting direct peer pressure on other large Linux consumers — cloud rivals and device makers — to fund maintainers of their own.
Second-order effects
- The Linux Foundation becomes the neutral vehicle through which competing companies fund shared infrastructure, a role the OpenSSF's multi-vendor pledge and the 2026 AI-findings grants confirm rather than merely suggest.
- Rivals face a signaling problem: staying out of maintainer funding while Google claims the security high ground costs reputation, so participation shifts from optional goodwill to table stakes among hyperscalers.
Third-order effects
- If the pattern holds, critical open-source maintenance gets restructured as foundation-brokered corporate expenditure — individual maintainers' livelihoods tied to pooled big-tech budgets, which stabilizes the supply chain but concentrates influence over which projects get staffed.
- Supply-chain security moves from an engineering afterthought to a budgeted line item, with the escalation from two salaries to nine-figure pledges suggesting each new threat vector (memory safety, then AI-generated findings) triggers another round of corporate funding.
The trend: Hyperscalers are converting ad-hoc open-source contributions into foundation-administered, multi-company funding programs for the security-critical software they all run on.