More Money Fewer FOSS Security Problems

The talk asks whether general funding for open source software, money not tied to any security goal, makes the projects it supports more secure. The presenters, policy researchers at a national security think tank, explain that a randomized experiment would be the ideal test but does not exist for this question. They instead compared the top one thousand packages on PyPI and npm, identifying funded projects through five channels such as GitHub Sponsors, Open Collective, Tidelift, NumFOCUS and Google Summer of Code. They used the OpenSSF Scorecard as a rough stand-in for security posture.

Results varied by ecosystem. In Python, most funding types were associated with higher Scorecard scores, while in npm only some sources showed a significant boost. Certain individual checks, including dependency update tooling and branch protection, moved in unexpected directions for some funders. The speakers were clear about the limits: Scorecard checks have not been validated as measures of real security outcomes, funded projects may already have been more mature, and the data is a single snapshot from 2023 with no before-and-after view.

For practitioners and policymakers, the main takeaway is to decide which concrete security outcome a funder wants before paying, and to measure it. The team suggested follow-up work such as matching funded and unfunded projects more carefully and tracking scores over time around funding events. Audience questions covered causality, whether funding follows high-profile incidents, and whether company staff time spent on open source should count as a form of funding.