Report on the2020 FOSS
Contributor Survey
The Linux Foundation &The Laboratory for Innovation Science at Harvard

Frank Nagle
Harvard Business School
David A. Wheeler
The Linux Foundation
Hila Lifshitz-Assaf
New York University
Haylee Ham
Jennifer L. Hoffman
Laboratory for Innovation Science at Harvard

Acknowledgments
This report and the research behind it would not have been possible without the leadership of the Core
Infrastructure Initiative’s Advisory Committee, composed of Josh Corman, Steve Lipner, Audris Mockus,
Henning Piezunka, and Sam Ransbotham. Frank Nagle would also like to thank his fellow co-directors of
the Core Infrastructure Initiative, Jim Zemlin at the Linux Foundation and Karim Lakhani at the Laboratory
for Innovation Science at Harvard, for their counsel and direction throughout this project. Gratitude andthanks to Michael Dolan and Kate Stewart at the Linux Foundation for their ongoing commitment to thisundertaking. Thank you to James Dana for laying the initial groundwork for this survey.
Finally — and perhaps, most importantly — thank you to all the individuals who contribute to FOSS projects.
Without their tireless efforts, our core digital infrastructure and the feats enabled by it would not be sustainable.
REVISED: This report has been updated since its original release on 8 December 2020. This second version,
released on 10 December 2020, corrects errors found in the original text and graphics.

Contents
Executive Summary
Introduction
Methodology
Overview of Findings

4
7
9
10

Demographics

10

Figure 1: Gender and Age of Respondents

10

Figure 2a: Geographic Location of Respondents by Country

11

Figure 2b: Geographic Location of Respondents by Global Region

11

Figure 3: Employer by Sector

12

FOSS at Work

13

Figure 4: Employment Status

13

Figure 5: Contributors Receiving Payment By Contributor Status per Project

14

Figure 6: Countries by Ratio of Paid Contributors to Total Respondents

14

Figure 7: Employer’s IP Policy Related to FOSS Contributions During Free Time

16

Current FOSS Contributions
Figure 8: Top Project Languages Reported by Respondent Pool
Motivations

17
17
19

Figure 9a: Contributor Motivations

20

Figure 9b: Contributor Motivations by Highest Reported Contributor Status & FOSS Experience

20

Figure 10: Future FOSS Contribution
Time Allocation

21
22

Figure 11: Hours per Week Spent on FOSS By Contributor Status

22

Figure 12: Percent of Hours Spent on FOSS Projects Occurring During Paid Work vs. Free Time

23

Figure 13: Time Spent on FOSS Now vs. 5 Years Ago for those with 5-10 Years Experience24

Figure 14: Time Spent on FOSS Now vs. 5 Years Ago for those with 10+ Years Experience24

Figure 15: Time Spent on FOSS Now vs. 10 Years Ago for those with 10+ Years Experience25

Figure 16: FOSS Time Allocation: Actual vs. Ideal

26

Figure 17: FOSS Time Allocation: Maintainers/Core Contributors vs. Occasional/One-Time Contributors

26

Figure 18: FOSS Time Allocation: Paid vs. Unpaid Contributors

27

High-Level Takeaways & Suggested Actions
1. Contributors’ Motivations
Figure 19: Participation of Core Participants & Maintainers Paid by their Employers in 		

28
28
29

Projects Beyond the Initial 5 Identified
2. Need to Increase Security
Figure 20: Value of Contributions from External Sources		31
31

3. Contributions Linked to Employment

34

4. Corporate FOSS Policies

35

Conclusion
A Thank You to FOSS Contributors
Endnotes
Appendix

36
37
40
42

Executive Summary
This report summarizes the results of a survey of free/open source software (FOSS) developers in 2020.
The goal was to identify key issues in improving the security and sustainability of FOSS since the world now
depends on it as critical infrastructure that underlies the modern economy. The survey was a collaboration
between the Linux Foundation’s Core Infrastructure Initiative (CII) and the Laboratory for Innovation
Science at Harvard (LISH). This work has been recently incorporated into the Open Source Security
Foundation (OpenSSF) working group on securing critical projects.
To capture a cross-section of the FOSS community, the research team distributed the survey tocontributors to the most widely used open source projects (as determined by the previous “CII Census II
Preliminary Report — Vulnerabilities in the Core.”) and also invited the wider FOSS contributor community
through an open invitation. The response distribution was usually similar between these two groups,
though there were exceptions (e.g., different programming languages’ prominence did vary). A total of
1,196 respondents filled out the demographic section and at least one question about current FOSS
contributions, of whom 603 went through the entire survey.
Of the respondents, 27% were in the United States, 12% were in Germany, and almost 7% were in
France. The rest were diversified from countries around the world (see Figure 2a). The vast majority of
respondents, nearly 75%, are employed full-time. The bulk of respondents are employed in tech-relatedindustries (61%), although there is representation from other industries, including Finance, Transportation,
Construction, Real Estate, Educational Services, and Healthcare. The survey found that over half of all
respondents are paid to contribute to FOSS, though this varied greatly by country.
Below are the key insights of the report with corresponding suggestions for action.

1. The top three motivations for contributors are nonmonetary.
Non-monetary motivations — specifically adding a needed feature or fix, enjoying learning, and fulfilling aneed for creative/enjoyable work — were most frequently ranked in respondents’ top three motivations forcontributing. Conversely, being paid to develop FOSS was the most likely motivation to rank in an individual’sbottom three motivations, even for those who reported receiving payment for their contributions.
People need money to have food and a place to live. However, the overwhelming majority (74.87%) of
respondents are already employed full-time, and more than half (51.65%) are specifically paid to develop
FOSS. This observation must be tempered by remembering that this survey focuses on people, notprojects. Some projects may not have anyone paid to contribute to them — even if they are critical andeven if some of the contributors are being paid to work on other projects. Even though many contributors
are paid for their work on some projects, it is possible that some critical projects could benefit fromfinancial support for their contributors.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 4

When asked the question, “What type of contribution from external sources would be most beneficial?”,the second most common answer was financial contributions. At first, this seems inconsistent with the low
priority of payment to contributors. This seeming contradiction can be resolved by an understanding thatthe financial contributions could often be used in ways other than payment to contributors, such as paying
for cloud build servers, travel funding, events, security audits, or other resources for the project community.

Suggested Actions:
1. Recognize the value of the knowledge and skills that employees gain from contributing to FOSS.
2. Support the learning process for new contributors, e.g., by providing project demos and educational
materials and free courses on best practices across all open source projects.
3. Balance creative and mundane tasks for all contributors to promote continued engagement throughrewarding, fulfilling experiences.
4. Consider support options other than payment to contributors (e.g., security audit, computing
resources, and travel) when providing financial support for FOSS projects.

2. There is a clear need to dedicate more effort to thesecurity of FOSS, but the burden should not fall solely
on contributors.
All types of contributors reported they spend very little of their time responding to security issues (anaverage of 2.27% of their total contribution time) and reported that they do not desire to increase thissignificantly. When asked what would be the most beneficial contribution to their FOSS projects, survey
participants pointed to bug/security fixes, free security audits, and simplified ways to add security-related
tools to their CI pipelines (see Figure 20). Efforts focused on dramatically increasing the time current
contributors spend on security are unlikely to be welcome; alternative methods for incentivizing securityrelated efforts should be considered.

Suggested Actions:
1. Fund security audits of critical FOSS projects and require that the audits produce specific,
mergeable changes.
2. Rewrite portions or entire components of FOSS projects prone to vulnerabilities to produce a
substantially more secure result (e.g., contribute a rewrite in a memory-safe language).
3. Prioritize secure software development best practices.
4. Companies should make secure software development training a requirement for hiring or
continued professional development for their paid FOSS developers.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 5

5. Utilize badging programs, mentoring programs, and the influence of respected FOSS contributors toencourage projects and their contributors to develop and maintain secure software development practices.
6. Encourage projects to incorporate security tools and automated tests as part of their continuous
integration (CI) pipeline; ideally as part of their default code management platform.

3. As more contributors are paid by their employer tocontribute, stakeholders need to balance corporate andproject interests.
Over the past few years, there has been debate about the growing influence of money in the FOSS ecosystem.
This survey shows that nearly half (48.7%) of respondents are paid by their employer to contribute to
FOSS. Although the private sector’s increasing role in paid contributions could increase FOSS stability andsustainability, concerns remain about what happens to projects if that support suddenly ceases.

Suggested Actions:
1. Allay concerns over corporate involvement in FOSS projects through greater transparency and clear
commitments to support FOSS in general and specific FOSS projects for several years.
2. Incentivize paid contributors to dedicate time to mentoring new volunteer contributors.
3. Transfer FOSS projects to a foundation with neutral governance to ensure diversity of organizations
and control.

4. Enhance the positive trend of corporate support for
employees’ contribution to FOSS.
Companies’ increasing openness towards their employees’ involvement in FOSS is encouraging, but there is
still work to do. Over 45.45% of respondents stated that they are free to contribute to FOSS without asking
permission, compared to 35.84% ten years ago. However, a significant percentage of respondents reported
that their firms have unclear policies (17.48%) or that they are unaware (5.59%) of the policies.

Suggested Actions:
1. Clarify policies on when and how employees can contribute to FOSS projects, ensure the policies arevisible to employees, and encourage employees to engage in projects.
2. Promote contributions to FOSS projects’ security improvements, either through individual employees
engaging directly, or collaborative efforts such as the Open Source Security Foundation (OpenSSF).

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 6

Introduction
Free and Open Source Software (FOSS) has become a critical part of the modern economy. It has been
estimated that FOSS constitutes 80-90% of any given piece of modern software,1 and software is anincreasingly vital resource in nearly all industries. This heavy reliance on FOSS is common in both the
public and private sectors,2 and among tech and non-tech organizations alike. 3 Therefore, ensuring thehealth and security of FOSS is critical to the future of nearly all industries in the modern economy.
To better understand the state of security and sustainability in the FOSS ecosystem, and howorganizations and companies can support it, the Linux Foundation’s Core Infrastructure Initiative (CII) andthe Laboratory for Innovation Science at Harvard (LISH) collaborated to conduct a widespread survey of
FOSS contributors as part of larger efforts to take a pre-emptive approach to strengthening cybersecurity
by improving open-source software security. These efforts — recently incorporated into the Open Source
Security Foundation (OpenSSF) working group on securing critical projects — aim to support, protect, andfortify open software, especially software that is critical to the global information infrastructure.
This survey’s primary goal is to identify how best to improve the security, including the sustainability, of
FOSS — especially the FOSS that is widely relied upon by the modern economy. Specifically, the survey
seeks to help answer the question, “How can we better incentivize adequate maintenance and security ofthe most used FOSS projects?”
Importantly, in conducting this survey, the research team sought to take a holistic view of security. It captured
more technical aspects of security and also considered the more human side. The survey included questions
about contributor motivations and level of involvement, corporate involvement in FOSS, and the role ofeconomic considerations in contribution behavior. Further, the methodology for recruiting survey participantsemphasized contributors to FOSS projects that have been identified as widely used via previous researchthat culminated in the release of “CII Census II Preliminary Report — Vulnerabilities in the Core.”
The survey focused on the following topics:
1. Demographics: What are the demographics of FOSS contributors? In particular, what are their gender,
employment, and geographic location?.
2. Motivations: What are their reasons for starting, continuing, or stopping contributions to FOSS? How
can projects keep contributors engaged, and do contributors feel that their employers or others value
their work?
3. Pay: How many FOSS contributors are paid for their work on FOSS? If paid, by whom (e.g., by
employers and/or corporate sponsorship)? If they are not, does the lack of payment lead to significantly
poorer security or sustainability?
4. Time Spent: How much time do contributors spend contributing to FOSS, and how would they like tospend it? Is there an interest in increasing time spent on security issues?

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 7

5. Aid: What kinds of actions from external actors would help improve security (e.g., code contributions
and/or money)?
6. Current activity: What kinds of security-related activities are already taking place in the FOSS projects
represented by the respondents?
7.

Education/training: How much education/training have FOSS contributors had in secure softwaredevelopment and operations? From which sources did they receive it?

The survey categorizes contributors into the following groups:• “Maintainers” are package maintainers or software maintainers who are the final decision makers
over all or portions of source code that goes into a build or release. Maintainers would likely also
identify as a subset of core participants.
• “Core participants” may have been involved in the project since inception, joined later, and regularly
participated in major discussions about project direction, and have significant ongoing roles in thework, possibly including accepting patches to the code base. Core participants may be referred to as“Committers” in a project community.
• “Occasional participants” would not normally participate in ongoing or weekly project discussions,but occasionally provide contributions over longer periods of time.
• “One-time participant” is someone who provides a specific set of suggestions or contributions andthen exits involvement once their work is done; these are sometimes called “drive-by commits.”
The research team invited all kinds of contributors to participate in the survey, whether they contributed
software code, documentation, or provided other kinds of contributions. Future iterations of the survey
hope to get more specific information on the kinds of contributions provided and improve the display logicof questions that did not apply to their kind of contributions.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 8

Methodology
This survey aimed to identify how to improve security, including the sustainability, of FOSS critical to theglobal information infrastructure. A review of other existing surveys of open source contributors revealeda lack of data on employment-related contributions, current security practices, as well as time and task
allocation. The research team developed this survey to shine a light on these lesser-understood aspects of
the open source community.
To capture a cross-section of FOSS contributors’ extensive community, the research team distributed
the survey via two separate methods. Building on the findings of “CII Census II Preliminary
Report — Vulnerabilities in the Core,” a list of the most widely used open source projects was compiled
to create a targeted sample group to which emails were sent inviting those projects’ contributors toparticipate in the survey. This initial distribution offered respondents the opportunity to send a link to thesurvey to other FOSS contributors. The Linux Foundation and LISH also undertook a marketing campaign
to advertise the survey to the open source community at large. This included media outreach and press
releases, a video appeal to contributors on The Fourth Industrial Revolution, pushes on social media
platforms like LinkedIn and Twitter, as well as guest appearances on various open source-related podcasts,
including CHAOSScast. Additionally, the Linux Foundation added appeals to participate in the survey in twoof their monthly newsletters and a direct email to over 250 project mailing lists.
This two-pronged approach resulted in 1,866 responses to the survey, though many responses were
only partially complete — likely due, in part, to the length of the survey and the depth of the questions
it asked. All questions (except a respondent’s geographical location) were optional by design, and not all
participants chose to answer each question they were presented. Not all participants saw every questionin the survey as display and skip logic ensured that respondents did not see questions unrelated to theirstated roles, contributions, and experience levels. For example, a participant who responded that they
were unemployed did not see subsequent questions related to work-related FOSS contributions.
Therefore, to obtain the most value out of the results, the analysis focused on the answers individuals
provided, even if they did not complete the entire survey. The analysis included all responses fromthe 1,196 participants who completed the demographic questions and at least one question about
contributions. Thus, the number of answers varies from question to question, but each respondent poolis detailed under each question in the separate Appendix, which also includes the aggregate participant
responses for all questions that were asked.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 9

Overview of Findings
The FOSS Contributor Survey went in-depth on various dimensions about who contributors are, why
they contribute, and how they approach security in their FOSS projects. This section highlights some of
the most interesting results, while the complete survey results can be found in the Appendix, which go
far beyond the results discussed in this section. This section’s results fall into the following categories:
demographics, FOSS at work, current FOSS contributions, and time allocation.

Demographics
The survey began with basic demographic questions about the participants responding. Figures 1 and2 show the gender, age, and geographic location of the survey respondents. Figure 1 breaks down
respondents by their age and their self-reported highest level of contribution to any project (e.g., if a
respondent reported they are a Maintainer for one project and an Occasional participant for four projects,
they would be classified as a Maintainer).
The majority of respondents were male and between 25 and 44 years old. The fact that 91% of respondents
reported being male emphasizes the continuing concerns about a lack of female representation in FOSS
communities.4 It further raises possible concerns that these results are biased towards male contributors’
FOSS activities and are not fully representative of female contributions to FOSS.5 The geographic distributionof respondents in Figure 2 indicates that, although nearly a quarter of respondents were located in the
United States, most were located elsewhere. There is particularly strong representation from France andGermany, two countries that have long been significant contributors to FOSS. The majority of respondents
were from North America or Europe, indicating the results throughout the survey may better represent
FOSS contributors’ experiences in those areas than contributors in, for example, Asia.
Figure 1: Gender and Age of Respondents

Please note that the gender breakdown for this figure represents a subset of the overall respondents who also answered questions about theirage and contributor status. It differs slightly from the gender breakdown of the entire sample of responses seen in the text above and in the Appendix.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 10

Figure 2a: Geographic Location of Respondents by Country

Countries in the “Other” category include: Algeria, Argentina, Bahrain, Bangladesh, Belarus, Belgium, Bulgaria, Cameroon, Chile, Colombia,
Croatia, Denmark, Ecuador, Egypt, El Salvador, Estonia, Finland, Georgia, Greece, Honduras, Hong Kong, Hungary, Indonesia, Iran, Ireland, Israel,
Italy, Kenya, Latvia, Lithuania, Madagascar, Malaysia, Malta, Mexico, Morocco, New Zealand, Niger, Nigeria, North Korea, Norway, Pakistan,Peru, Portugal, Romania, Saudi Arabia, Singapore, Slovakia, Slovenia, South Africa, South Korea, Sri Lanka, Swaziland, Syria, Thailand,
Turkey, Ukraine, United Arab Emirates, Uruguay, Venezuela, Vietnam, Zambia, and Zimbabwe.
Figure 2b: Geographic Location of Respondents by Global Region

EMEA encompasses
Europe (including
Russia), the Middle
East, and Africa.
APAC consists of Asia,
Australasia, and thePacific Islands.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 11

In addition to gender, age, and location, the survey also asked participants about their employer’s industry.
Figure 3 shows the responses. Perhaps unsurprisingly, most respondents are in tech-related industries(Software, Hardware, IT Services, and Telecommunications). However, there is substantial representationfrom other sectors, including Finance, Transportation, Construction, Real Estate, Educational Services,and Healthcare.
Figure 3: Employer by Sector

Sectors in the “Other” section of the pie chart include: Accommodation and Food Services; Administrative and Support Services; Agriculture,
Forestry, Fishing and Hunting; Arts, Entertainment, and Recreation; Construction; Energy and Utilities; Mining; Other; Public Administration;
and Real Estate Rental and Leasing.

Finally, the survey asked participants about any training they had in software development, and 86.3%
reported receiving formal training in software development. However, only 39.8% reported formal training
in secure software development.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 12

FOSS at WorkA consistent source of debate about the future of FOSS revolves around the role of money and corporate
involvement in the ecosystem. If FOSS contributors cannot support themselves (housing, food, etc.), thenthey are unlikely to work on FOSS. However, there is also debate around whether or not FOSS contributors
are, or should be, compensated directly for their efforts. The survey asked respondents a variety of questions
about their employment status, payment for contributions, and their employer’s policy towards FOSS.
Figure 4 shows the employment status of the survey respondents. The overwhelming majority are employedfull-time. The next two most popular answers were self-employed/freelancer or full-time student. This
makes sense as most of the skills necessary to contribute to FOSS are highly valued in today’s job market(programming, technical documentation, etc.). Despite the survey being administered during the economic
downturn resulting from the COVID-19 pandemic, very few respondents were out of the workforce.
Figure 4: Employment Status

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 13

Over half (51.65%) of

Beyond whether or not the respondents were
employed, the survey also aimed to understandwhether they were directly compensated fortheir FOSS efforts. In aggregate, of 577 survey
respondents, 48.7% said they are paid for timespent on open source contributions by theircurrent employer, 2.95% said another party pays
them, 4.33% said they are not paid because
their employment contract prevents them fromaccepting payment for open source development,
and 44.02% said they are not paid for any otherreason. Interestingly, most of those paid for working on a FOSS project also contributed to other FOSS
projects without being compensated. Further, whether or not a respondent was paid was related to theirrole in a given FOSS project.

respondents reported thatthey receive payment for their
FOSS contribution from either
their employer or a third party.

Figure 5: Contributors Receiving Payment By Contributor Status per ProjectThus, Figure 5 shows whether or not a survey respondent was paid for their work on a specific FOSS project,
as well as their level of contribution to that project. Therefore, in Figure 5, if a respondent contributed totwo projects, one where they were paid and a maintainer, and the other where they were unpaid and only
an occasional contributor, they would show up twice since the data is at the project level. For simplicity, inmost other analyses in this report, a contributor is considered to be a “paid contributor” if they are paid forany projects they work on and an “unpaid contributor” if they are not paid for any of their work.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 14

Figure 6: Countries by Ratio of Paid Contributors to Total Respondents% of Respondents Paid for FOSS

Total Responses

United States of America

Country

63.8%

174

Germany

58.7%

75

France37.1%

35United Kingdom

42.9%

28

Canada57.1%

21

Netherlands

75.0%

20

India

15.8%

19

China

29.4%

17

Austria63.4%

11

Brazil

45.5%

11

Japan

45.5%

11

Australia

30.0%

10

Other

43.5%

145

For example, Figure 6 considers the percent of respondents that are paid for any of their FOSS contributions
to better understand differences across countries in their likelihood to be paid. It is interesting to note thewide variance in the percentage of respondents that are paid for their contributions across countries.
However, it should be noted that some of the countries have few respondents, making the findings difficult
to generalize.
Importantly, this survey focuses on people, not projects. Some projects may not have anyone paid tocontribute to them, even if they are important and even if some of the contributors are being paid to workon other projects. In short, even though many contributors are paid, it is possible that some of the criticalprojects they work on do not receive financial support or that other contributors working alongside them
are still unpaid.
As the analysis below on contributors’ motivations illustrates, financial motivation often is not the criticalfactor spurring FOSS contribution. However, the role of financial incentives in the FOSS ecosystems isdifficult to unravel.
More than half (56.12%) of the respondents said that involvement in FOSS projects was moderately
important, very important, or extremely important in getting their current job. A sizable minority (32.81%)
of respondents reported that involvement in FOSS projects was “not important at all” in getting theircurrent job. Similarly, 54.82% believed that their participation in FOSS projects has positively impacted
their salary or job prospects.
Benefits also flowed to employers. Among the respondents, 81.41% reported that the skills that theyacquired from working on FOSS were “valuable” or “very valuable” for their current employer. Respondents
said that they learned how to write and test production-level code, organize asynchronous work as a team,and communicate and collaborate with a team. Respondents also said that they learned how to perform
code reviews, how to use version control, and that they benefit from clean code being prioritized over “uglyworkarounds.” Respondents benefited from learning about “workflows, issue tracking and resolution, bug

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 15

reporting, timezone distributed work, gaining trust in developer communities.” They also said that learning
about FOSS libraries helped them know what solutions exist when they are writing code.
Finally, the research team sought to understand how the stance of the respondents’ employers towards
FOSS contribution to projects that are unrelated to their work during their free (non-work) time haschanged over the past decade. Therefore, the survey asked respondents about the status of contributing
to non-work related FOSS projects during their free time in the intellectual property policy of theiremployer today, five years ago, and ten years ago.
Figure 7: Employer’s IP Policy Related to FOSS Contributions During Free Time

Figure 7 shows the results of these questions. Although it is encouraging that policies preventing
individuals from contributing have gone down over the last ten years and that policies saying individuals
are free to contribute have gone up, there is still a great deal of uncertainty related to employers’
contribution policies. As the figure below shows, 17.48% of respondents say their current employer does
not have a clear policy towards FOSS contribution, while 5.59% say that they are unsure what the policy is.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 16

Current FOSS Contributions
The survey asked respondents about various aspects of their present (and future) contributions to FOSS. In
particular, questions were asked about the projects they contributed to, their motivations for contributing,and their likelihood of contributing in the future.
As mentioned above, survey respondents came from the pool of targeted contributors based on findings
related to the most widely used FOSS projects or the open survey that any FOSS contributor could take. In
general, responses across these two groups were fairly consistent. However, because the prior researchfindings had greater representation from projects written in Java and JavaScript, there is a noticeable skew
towards those projects from that group.
Figure 8: Top Project Languages Reported by Respondent Pool

Language# of Projects (Invited)

Language# of Projects (Open Survey)

Java

351

C

335

JavaScript

275

Python

221

C#

146

C++

134

Scala

94

Go

126

C++

83

JavaScript

109

TypeScript

81

Java

106

Python

64

Shell

70

Go

62

PHP

40

C

50

HTML

31

Shell

35

Rust

25

Ruby

26

Typescript

22

HTML

21

Ruby

21

PHP

14

C#

16

Kotlin

14

Perl

14

Haskell

13

Rust

9

Figure 8 shows the top languages of projects survey respondents contribute to, broken into these twogroups. Importantly, the survey asked respondents to list up to five projects they contributed to, so thetotal number of projects represented is greater than the number of respondents. Figure 8 shows that
despite the skew towards Java and JavaScript projects for the direct distribution (invited) respondents,
there is a heavy representation from projects in numerous languages in both respondent groups. The
diversity of languages used by respondents reflects the diversity of languages used in FOSS projects.
The survey respondents indicated that many communication channels are used by FOSS projects.
The most common ones were issue trackers (90.35%), mailing lists (56.80%), and instant messenger
applications like Slack and IRC (51.10%). Nearly half (47.03%) have never met face-to-face with their FOSS
project partners.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 17

Respondents also indicated how important some characteristics were when considering whether or
not to contribute to a FOSS project. A majority (57.89%) said the presence of an open source license wasextremely important, with another 25.53% stating it was very important (for a total of 83.42%). Thissuggests that FOSS projects should make it extremely easy for potential contributors to identify theirlicense. Three other characteristics were considered extremely important or very important by a majority
of FOSS developers: responsive maintainers (80.39%), active development (65.75%), and a welcoming
community (63.19%). Other characteristics that many consider extremely important or very important (inorder) are widespread use (41.2%), presence of a contributing guide (39.91%), employer uses/encourages
contributions to it (37.58%), and being neutrally governed (27.69%). FOSS projects would be wise to
implement all of these where they can.
Many considered the presence of a Code of Conduct important. It was considered extremely important(8.93%), very important (15.26%), or moderately important (21.59%) by 45.78% of respondents. However,
3.73% tend to avoid projects that have one. It’s useful to understand that far more respondents foundthem important even though they can raise controversy.
The most common response to asking about the importance of a developer’s certificate of origin (DCO)
was that they did not know what it is (32.73%). DCOs have potential advantages, but many contributors do
not know what they are; there may need to be an effort to explain them.
Respondents also noted that they tended to avoid contributing to projects with certain characteristics.
The top characteristics they most avoided were projects with a contribution agreement to a for-profit
organization (23.16%), a contributor license agreement aka CLA (15.33%), and a contribution agreement
to a non-profit organization (10.44%). FOSS projects should consider avoiding these characteristics whenpractical, especially the first one, as they reduce the potential number of contributors (and thus may put
the project at risk).

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 18

Motivations
In asking survey respondents about their motivations for contributing to FOSS, the research team drew
upon the extensive academic literature6 on this topic and presented respondents with the following ten
motivations and asked them to rank order them based on importance to why they contribute:• I enjoy learning• I am paid to develop FOSS
• I value the recognition of my peers• Contributing allows me to fulfill a need for creative, challenging, and/or enjoyable work
• I use this piece of FOSS and needed the specific features/fixes I added• Since I use FOSS, I feel I should contribute back to it• I believe in the mission of FOSS or the particular area I contribute to (e.g., privacy software)• I expect my contributions will help me advance my career• I enjoy working with my peers and my community• I enjoy helping others
These motivations were displayed in a random order to each respondent to limit possible bias.7 Figure 9ashows this question’s results by focusing on the motivations most commonly included in respondents’ top
three or bottom three responses.8 It is interesting to note that all three of the top three responses are nonmonetary motivations, while all three of the bottom three responses are extrinsic motivations. The needfor a feature or fix and the enjoyment of learning were the two most commonly occurring motivations in
respondents’ top three choices. Conversely, being paid to develop FOSS was the most likely motivation
to show up in an individual’s bottom three choices. Since many contributors are not paid to contribute to
FOSS, it makes sense that this would be at the bottom of the list. However, even when analysis split out
the motivations by contributors that report being paid for FOSS contributions versus those that are unpaid(Figure 9b, middle two columns), payment is still close to the bottom of the motivations.
Figure 9b also shows the results of this question broken out by whether or not a respondent says
their maximum level of involvement in any of the projects they contribute to is as a Maintainer or Core
Developer versus an Occasional or One-Time Developer (first two columns) as well as by the number ofyears they have been contributing to FOSS (final two columns). In both tables in figure 9b the cell withthe most common answer in its column has the darkest shade, while the least common has the lightest
shade. Throughout all of these subsample analyses, the results are fairly consistent with the full sample
results. Notable exceptions are that Occasional/One-Time developers and those only contributing to FOSS
for five years or less are more likely to say that since they are a user of a FOSS project, they believe theyshould contribute to it (reciprocity) is a larger motivation than their need for creative work. Further, paid
contributors are more likely to rank their belief in the FOSS mission as an important motivator than theneed for creative work. Importantly, research9 has shown that a contributors’ motivations can change overtime, and thus these sub-sample analyses may reflect shifting motivations as a user gets more involved in
the community.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 19

Figure 9a: Contributor Motivations# of Times
Rankedin Top 3

Most frequently found in respondents’ top three
Motivation
I use this piece of FOSS and needed the specific features/fixes I added

278

I enjoy learning

276

Contributing allows me to fulfill a need for creative, challenging, and/or enjoyable work

222

Since I use FOSS, I feel I should contribute back to it

205

I believe in the mission of FOSS or the particular area I contribute to (e.g. privacy software)184

I enjoy helping others

154

I am paid to develop FOSS99

I enjoy working with my peers and my community

89

I value the recognition of my peers

38

I expect my contributions will help me advance my career83# of Times
Ranked in
Bottom 3

Most frequently found in respondents’ bottom three
Motivation
I am paid to develop FOSS

326

I expect my contributions will help me advance my career252

I value the recognition of my peers

216

I enjoy working with my peers and my community

133

I believe in the mission of FOSS or the particular area I contribute to (e.g. privacy software)

128

I use this piece of FOSS and needed the specific features/fixes I added

123

I enjoy helping others

117

Since I use FOSS, I feel I should contribute back to it

110

Contributing allows me to fulfill a need for creative, challenging, and/or enjoyable work96

I enjoy learning

62

Figure 9b: Contributor Motivations by Highest Reported Contributor Status & FOSS Experience# of Times Rankedin Top 3

Maintainers Occasional/ Core/ 1X

PaidContributors

UnpaidContributors≥10 years
in FOSS≤5 years in
FOSS

Enjoy learning

158

107

115

137

120

69

Needed specific features

178

92

146

119

145

47

Need for creative work

160

103

126

User, feel I should
contribute
Believe in missionof FOSS

Report on the 2020 FOSS Contributor Survey

72

40
106

The Linux Foundation & The Laboratory for Innovation Science at Harvard 20

# of Times Ranked
in Bottom 3

Maintainers Occasional/ Core/ 1X

PaidContributors

UnpaidContributors≥10 years
in FOSS≤5 years in
FOSS
79

Paid

188

127

117

189

156

Career advancement

172

74

129

115

157

Peer recognition

147

63

123

82

117

Needed specificfeatures39
40

Finally, the survey asked respondents how likely they are to contribute to FOSS in the future.
Overwhelmingly, respondents said that they are “Extremely Likely” to keep contributing, showing a strong
commitment to the FOSS ecosystem (Figure 10). Interestingly, when breaking out responses based on thehighest level of contribution to FOSS projects (Maintainers, Core Developers, Occasional Developers, or
One-Time Developers), higher contribution levels are related to a higher likelihood of saying “Extremely
Likely.” Survey participants who had ever stopped contributing to FOSS (temporarily or permanently) wereasked why they had done so. Lack of time (due to professional, family, or social commitments) was themost common reason selected. Additional responses to this question can be seen in the detailed answers
for question 9 in the Appendix.
Figure 10: Future FOSS Contribution

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 21

Time Allocation
To better understand how much time respondents spend on contributing to FOSS, the survey included
various questions related to time allocation, including how they spent their time in the past, what FOSS
tasks they spend their time on, and how the coronavirus pandemic impacted their time spent on FOSS.
Figure 11 shows the number of hours per week spent on FOSS broken out by the highest contributor statuslevel. As with many things related to FOSS, the hours contributed follow a roughly power-law distribution
where most contributors spend a few hours a week. A handful of respondents spend more than 50 hours
per week, with one reporting working on FOSS 70 hours per week. The more hours per week a contributor
spends on FOSS, the more likely they are to have reported that they are a maintainer or core developerof at least one project. Most respondents who reported only being an occasional or one-time contributor
spend less than four hours per week, while nearly all of them spend less than twelve hours per week.
Figure 11: Hours per Week Spent on FOSS By Contributor Status

To better understand how the relationship between hours per week spent on FOSS and whether or nota respondent is being paid for their efforts, the research team looked at the subset of respondents thatreported being paid for FOSS work. Figure 12 shows the percentage of hours spent during paid work time
versus free time, broken out by the number of hours per week spent on FOSS (in 8-hour blocks).

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 22

Figure 12: Percent of Hours Spent on FOSS Projects Occurring During Paid Work vs. Free Time

On average, respondents spending 0-16 hours per week on FOSS do roughly 50% of those hours during
paid work. Meanwhile, respondents spending 16-32 hours per week do 65-70% of those hours during paid
work. Respondents spending 32-64 hours per week on FOSS do 75-80% of those hours during paid work.
The one respondent who reported doing 70 hours of FOSS per week reported that 38 of those hours wereduring paid work, while the other 32 were during their free time. In aggregate, no matter the number ofhours spent on FOSS during paid work time, nearly all respondents also spend some of their free timeworking on FOSS.
The FOSS ecosystem is continuously evolving over time. To better understand the human side of thisevolution, respondents were asked to compare the amount of time they spend on FOSS now to the amountof time they spent five or ten years ago. To be eligible to answer these questions, a respondent first had
to indicate that they had been active in FOSS for more than five or ten years, respectively. Therefore,
the sample size across these questions varies, and the results are broken out by the length of time an
individual has been participating in FOSS.
Figures 13 and 14 show how a respondent’s time spent on FOSS today compares to that spent five years
ago for respondents with 5-10 years of experience in FOSS and 10+ years of experience in FOSS, respectively.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 23

Figure 13: Time Spent on FOSS Now vs. 5 Years Ago for those with 5-10 Years Experience

5-10 Years Contributing to FOSS

Current
Average
Hrs/WkCurrent
MedianHrs/WkNumberofResponses

Current weekly time spent for this subset overall

10.78

5

151

Time spent for those responding that they spend more time
now than 5 years ago

15.37

8

72

Time spent for those responding that they spend less time
now than 5 years ago

3.77

2

49

Time spent for those responding that they spend sameamount of time as 5 years ago

11.21

5.5

30

Figure 14: Time Spent on FOSS Now vs. 5 Years Ago for those with 10+ Years Experience

10+ Years Contributing to FOSS

Current
Average
Hrs/WkCurrent
MedianHrs/WkNumberofResponses

Current weekly time spent for this subset overall

15.78

10

297

Time spent for those responding that they spend more time
now than 5 years ago

22.66

20

99

Time spent for those responding that they spend less time
now than 5 years ago

7.87

4

114

Time spent for those responding that they spend sameamount of time as 5 years ago

18.42

10

84

Figure 15 shows how time spent on FOSS today compares to that spent ten years ago for only those with 10+
years of FOSS experience. In aggregate, these three figures show a few trends. First, it is clear that whilesome respondents are spending more time than they used to, some are spending less. Second, it is interesting
to note the similarities in percentages between Figure 13 (people with 5-10 years of FOSS experience andtheir contribution activity five years ago) and Figure 15 (people with 10+ years of FOSS experience andtheir contribution activity ten years ago). In both, close to half of respondents reported spending moretime, roughly a third reported spending less time, and the remainder reported spending the same amountof time. This is noticeably different from Figure 14 (people with 10+ years of FOSS experience and theircontribution activity five years ago) where the three options are closer to equal, with a slightly higher
percentage spending less time and a slightly lower percentage spending the same amount of time.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 24

Figure 15: Time Spent on FOSS Now vs. 10 Years Ago for those with 10+ Years Experience

Current
Average
Hrs/WkCurrent
MedianHrs/WkNumberofResponses

Current weekly time spent for this subset overall

15.9

10

294

Time spent for those responding that they spend more time
now than 10 years ago

21.06

20

139

Time spent for those responding that they spend less time
now than 10 years ago

7.65

4

108

Time spent for those responding that they spend sameamount of time as 10 years ago

19.59

10

47

10+ Years Contributing to FOSS

Related to the shifting amount of time spent on FOSS over time, respondents were asked whether thecurrent COVID-19/coronavirus pandemic had changed the amount of time they spent on FOSS. The
survey found that 66% of respondents said they were spending the same amount of time on FOSS once
the COVID-19 pandemic hit, while 24% said they were spending more time, and 10% said they werespending less. However, as mentioned in the Demographics section, given that responses to the survey
came overwhelmingly from men (93.2%), these findings may not reflect the experiences of women who
contribute to FOSS, particularly those impacted by increased family responsibilities during the pandemic.10
Finally, to understand how FOSS contributors allocate their time spent on FOSS, respondents were asked
to share the percentage of their time on FOSS that goes towards the following activities:• Contributing new code
• Improving existing functionalities• Maintaining projects• Performing organizational or administrative functions• Reporting or documenting bugs and unexpected behaviors• Offering ideas for new features• Contributing documentation• Responding to security issues
Respondents also had the opportunity to enter other tasks such as answering user questions, reviewing
code, and project community management under an “Other” category. In aggregate, they spentapproximately 5% of their contribution time on all of these miscellaneous tasks.
In addition to asking how they allocate their time, the survey also asked respondents how they would ideallylike to allocate their time. Figure 16 shows the differences in preference for actual versus ideal time allocations.
For tasks like contributing documentation, improving existing functionalities, and responding to security
issues, the time allocated roughly matches the time the respondent desired to spend. However, the“general housekeeping” tasks like maintaining projects, reporting or documenting bugs and unexpectedbehaviors, or performing organizational or administrative functions tended to take a larger percentage oftime than respondents would have liked. Conversely, contributors noted that they did not allocate as muchtime as desired to the more creative tasks of contributing new code and offering ideas for new features.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 25

Figure 16: FOSS Time Allocation: Actual vs. Ideal

Figures 17 and 18 respectively show the actual time spent on FOSS tasks broken out by maintainers/
core contributors versus occasional or one-time contributors and by paid versus unpaid contributors.
Overall, it is clear that FOSS contributors spend the largest proportion of their time contributing newcode or improving existing code. However, maintainers and core contributors also spend a good dealof time maintaining projects and performing administrative functions while occasional or one-time
contributors spend a good deal of time on bug reporting and documentation. Likewise, paid contributors
spend noticeably more time on administrative work than unpaid contributors. Importantly, all typesof contributors spend very little of their time on responding to security issues, which is a likely area ofconcern for the future health of the FOSS ecosystem and is discussed further below.
Figure 17: FOSS Time Allocation: Maintainers/Core Contributors vs. Occasional/ One-Time Contributors

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 26

Figure 18: FOSS Time Allocation: Paid vs. Unpaid Contributors

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 27

High-Level Takeaways &Suggested Actions
This survey delved into a great deal of detail on various dimensions of FOSS contributions. Below is asummary of a few key high-level takeaways that emerge from the results. Additionally, there are suggested
actions related to each of these takeaways for open source project managers, as well as companies andorganizations, looking to help sustain the FOSS ecosystem.

1. Contributors’ Motivations

The need for a featureor fix and the enjoyment

The top three motivations of all contributors
are non-monetary motivations.
The most commonly occurring motivations in respondents’
top three choices were “the need for a feature or fix” (a morefunctional motivation, indicating how FOSS is helpful in mostcontributors’ work), the “enjoyment of learning,” and the“need for creative expression.” Conversely, being paid todevelop FOSS was the most likely motivation to show up in
an individual’s bottom three choices. Even after splitting out
motivations by contributors that report being paid for FOSS
contributions versus those that are unpaid, payment remains
in the bottom three of each group’s motivations. This
result may sound counter-intuitive, especially in light of theincreased prevalence of paid contributions and the existing
assumptions that these contributors might be contributing
only because it is part of their work income. This stresses theimportance of software professionals using FOSS for learning
purposes that can potentially benefit their employers.11

of learning were thetwo most commonlyoccurring motivations
for contributing to FOSS,
while receiving payment
for contributions wasnear the bottom—forboth paid AND unpaid
contributors.

Suggested Actions: Leverage Motivations
The strong desire of contributors, paid and not paid, to learn should guide FOSS projects’ and organizations’approaches toward contributors. FOSS contributions need to be perceived and communicated as an importantlearning mechanism for contributors. With the constant pace of change and new knowledge that
contributors need to master, FOSS has become a clear and efficient path for learning and professional
development. Companies ought to recognize the important added value of this knowledge. Additionally, FOSS
projects should consider making it easy to get started with a FOSS project such as pre-created images ordemos so that learning can begin quickly. FOSS projects could also provide some educational materials(such as tutorials or getting started guides) about their projects to help those motivated by a desire to learn.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 28

It also appears that many contributors would be interested in learning more general material, such as how
to develop secure software (as long as its application is not very burdensome). Several respondents listed afree online course on how to develop secure software as a desirable contribution from an external source.
OpenSSF has developed a set of three free courses on how to develop secure software on the non-profit edX
learning platform. These courses are part of the Professional Certificate program, Secure Software Development
Fundamentals (for a fee, developers can take various tests to show that they mastered the material).
The “need for creative work” was highly rated (3rd motivation), so FOSS projects should keep their work
creative to attract unpaid contributors and not focus on making it ”less creative.” Balancing creative andmore mundane tasks for contributors could keep project members more engaged.
The fact that payment to contributors is generally not reported as a strong motivator is an important
finding as recently there have been various efforts to pay FOSS projects and their contributors for theirefforts directly. However, it is important to note that this survey’s results show that the vast majority of
respondents are employed full-time, and thus basic needs are likely being met for them. Also, more thanhalf of respondents are paid to develop FOSS. Thus it is difficult to precisely discern the importance ofbeing paid for working on FOSS, even though these paid contributors rated being paid as very low on theirmotivations for contributing.
Although their motivations for contributions are not primarily financial, it would be an overreach to saythat money does not matter for FOSS. Note that more than a third of respondents (36.43%) listed financial
contributions as potentially beneficial to at least one of the FOSS projects they contribute to, and financial
contributions were considered the most important after code contributions (see Figure 20). The researchteam interprets this as suggesting that financial contributions to support FOSS development could behighly beneficial to increase their security and sustainability if primarily directed toward specific purposes,
e.g., for adding security-related tools to the CI pipeline, security audits, and computing resources.
Some projects may not have anyone paid to contribute to them, even if they are important and even if
some of the contributors are being paid to work on other projects. The 215 respondents identifying ascore participants and maintainers (40 and 175, respectively) contribute — on average — to 2.13 projects
for which they are paid and 1.2 projects for which they are not. Figure 19 shows how many FOSS projects
these paid maintainers and core participants contribute to in addition to the initial five projects theyreported initially in the survey — either regularly or occasionally. Although the survey did not ask whether
respondents received payment for work on these additional projects, Figure 19 shows that more than halfof those paid by their employer to contribute to FOSS for at least one of their primary projects participate
significantly in other FOSS projects as well. Participation in these additional projects could be a natural
result of their paid work (e.g., contributing to the upstream dependencies of the project they are paid towork on) or it could result from unrelated interests (e.g., hobby projects).

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 29

Figure 19: Participation of Core Participants & Maintainers Paid by their Employers in Projects Beyond the Initial 5 Identified

In short, even though many contributors are paid, it is possible that some critical projects need financial
support or that their contributors are unpaid. For less desirable tasks (e.g., less creative), more funding
may be required than expected because many contributors are not motivated primarily by money.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 30

2. Need to Increase Security
There is a clear need to dedicate more effort to the security of FOSS.
One of the survey goals was to understand the state of security in FOSS, and indeed it found that
respondents report spending very little of their time on responding to security issues (an average of 2.27%of their total time spent). Moreover, the respondents do not report a desire to increase this significantly;
in fact, the average of percent of time reported they would like to spend on security was only 0.06%
higher. In addition to questions about their efforts, survey participants were asked what would be themost beneficial contribution to their FOSS projects from external sources. Some of the topmost requested
contributions were proposed bug/security fixes, free security audits, and simplified ways to add securityrelated tools to their CI pipelines (Figure 19). This indicates that there is a clear need for these efforts, but
existing contributors are not interested in dedicating substantial additional time to it.
Text responses indicated that many respondents had no interest in increasing time and effort on security;
it was not simply that they wanted to be proactive. One respondent said, “I find the enterprise of security
a soul-withering chore and a subject best left for the lawyers and process freaks. I am an application
developer.” Another said, “I find security an insufferably boring procedural hindrance.”
Thus, efforts focused on dramatically increasing the time contributors spend on security are unlikely to bewelcomed by many existing FOSS contributors, especially if they require significant new steps to be performed
by developers. Therefore, alternative methods for incentivizing security-related efforts need to be considered.
Further, given the discussion on incentives, it is unlikely that simply offering money to contributors forfocusing on security will move the needle a great deal (although for some smaller, understaffed projects,
this could potentially help).
Figure 20: Value of Contributions from External Sources

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 31

While regular audits can

Suggested Actions: Improve Security Practices
while Limiting the Burden on Contributors
Actions related to security can be thought of in threebuckets: improving existing code by addressing security
issues, rewriting code, and incorporating security into newcode. In all of these cases, developers are not interested indramatically increasing their time on security, so identifying
ways to reduce or distribute the effort will be important.
To improve existing code by addressing security issues, thevulnerabilities must be identified (e.g., using audits andtools), and then the appropriate fixes must be developed andproposed. The CI pipeline also needs to be modified overtime to detect problems and prevent recurrences.

ameliorate security
concerns in the shortterm, establishingsecure coding andsecurity best practices
as every FOSS member’s
responsibility will be key
for the long term.

Developers generally do not want to become security auditors;
they want to receive the results of audits. The Open Source
Security Foundation12 (OpenSSF) is discussing launching efforts
to audit critical FOSS projects, possibly including the development of proposed patches to fix problems
found. However, these audits require funding, so organizations that do not have the resources to pay theirown employees to contribute to FOSS could instead make small contributions towards security auditsof the FOSS upon which they rely. These audit reports should include specific mergeable changes toimplement those reports.
Organizations that pay employees to contribute to FOSS could redirect some of their efforts to identify andaddress known security issues in their relevant projects. In particular, organizations can have employees
submit patches to correct vulnerabilities identified or incorporate automated tools to detect vulnerabilities
without a significant false-positive rate.
Instead of fixing existing code, developers could rewrite portions or entire components of FOSS projects
that are prone to vulnerabilities. A rewrite might be advisable for other reasons, e.g., the project’s orcomponent’s structure might be so convoluted that it’s challenging to maintain. Often such rewrites begin
with developing tests so that functionality and reliability are not lost. If a rewrite is to be done, there
should be an effort to produce a substantially more secure result.
One way to improve a rewrite’s security is to switch from memory-unsafe languages (such as C or C++)
into memory-safe languages (such as nearly all other languages). This would eliminate entire classes ofvulnerabilities such as buffer overflows and double-frees. These vulnerability classes loom large; Microsoft
reports that 70% of all security bugs from 2006 through 2018 have consistently been memory safetyissues.13 Some projects are pursuing this approach, e.g., Mozilla’s Oxidation project is rewriting portionsof Firefox in Rust, a programming language that is memory-safe by default.14 However, this approach
has many challenges. It requires significant effort to rewrite the code, and perhaps more importantly, asignificant effort for the existing contributors to learn to use the new language well if they do not know it
already. The project may find it challenging to agree on that new language since there are always tradeoffs, and the new language selection would have a large impact on all contributors.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 32

All of this effort will, at best, have no immediate visible advantage to users since they will typically notsee an immediate functional improvement. Rewriting a portion is less risky than trying to rewrite an
entire component. Still, that approach is also more complicated because of the increased complexity ofcalling between components that are written in different languages. Using a different language can also
complicate compilation (where applicable) and use of the component, e.g., if its callers are typically written
in C, it’s often simplest to write the component in C. Switching to a memory-safe language could havesignificant long-term advantages, but it presents significant shorter-term costs. It’s likely to be consideredmore of an option for network-facing components or those typically used to process untrusted data.
However, this might be an area where one-time funding could produce significant long-term improvements.
Incorporating security into new code in the FOSS ecosystem needs to become a priority for all FOSS
stakeholders. If organizations, projects, and contributors incorporate secure coding and other security
best practices into any new code additions, the foundations of open source will become much more robust.
The following are just a few examples of actions that could improve security, without placing significant
additional burdens on developers:
1. Make secure development training a requirement for hiring or continued professional development
for paid FOSS developers. As noted earlier, the OpenSSF has developed a set of three free courses on
how to develop secure software on the non-profit edX learning platform. These courses are part of theProfessional Certificate program, Secure Software Development Fundamentals (for a fee, developers
can take various tests to show that they mastered the material).
2. Use badging programs, like the Core Infrastructure Initiative’s Best Practices Badge15, as a powerful
new norm that encourages projects to develop — and maintain — secure software development practices.
3. Ask influential FOSS contributors to stress the importance of security and specific steps to make thesoftware more secure.
4. Partner with mentoring programs, such as The Linux Foundation’s LFX16 and Google’s Summerof Code17, to have them incorporate security best practices to help the next generation of FOSS
contributors learn secure software development from the start.
5. Encourage projects to incorporate many different security tools and automated tests as part oftheir continuous integration (CI) pipeline. Platforms (such as GitHub and GitLab) could provide
useful defaults and make it especially easy to incorporate these tools and tests. This could include
automatically-generated merge/pull requests to change a CI configuration to add such tools, including
an appropriate configuration for them in that circumstance. This request could be generated after
automatically determining a project’s specific technology stack (such as its languages and framework).
Once a project successfully addresses problems found in a configuration, later merge/pull requests
could be automatically generated that would modify the configuration to increase tools’ sensitivities.
Finally, a better understanding of why FOSS developers do not like to spend time on security issues may
require follow-up interviews and qualitative deep dives with key maintainers and organizations that
employ FOSS developers. Such efforts would likely lead to possible additional mechanisms for addressing
security concerns.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 33

3. Contributions Linked to

The survey shows justEmployment

over half of respondents

Nearly half (48.7%) of contributors stated they
are paid by their employer to contribute.

(51.65%) are paid forat least some of their

The survey shows just over half of respondents (51.65%) are
paid for at least some of their FOSS contributions by theiremployer or a third-party, while just under half (48.35%)
are volunteer contributors. Yet, most paid contributors
contribute to multiple projects and frequently make unpaid
contributions to other projects. Over the past few years,
there has been debate about the growing influence of money
in an ecosystem that was once mostly driven by volunteer
work. There may be a concern that FOSS projects will bepushed in a direction that is most beneficial for the employer
of a paid contributor (especially when that contributor is a
project maintainer), rather than in a direction that is best
for all users of the project. Further, there is concern about what happens if the organizations paying
employees to contribute decide that it is no longer cost-effective to do so. This would be a particularly
important concern if there was a large negative economic shock (e.g., a recession) that impacted the entire
tech industry which is where most of the paid contributors work.

FOSS contributions

by their employer or athird-party, while justunder half (48.35%) arevolunteer contributors.

If these contributors, especially those who spend most of their paid working hours contributing to FOSS,
then were redeployed to spend their working hours on internal proprietary work, would the volunteer
contributors pick up the slack, or would there be a large decrease in the total amount of contribution effort
towards FOSS? Of course, there are also some potential benefits to paid contribution efforts that could
help lead to increased stability and sustainability in FOSS. Suppose more individuals are paid to work on
FOSS. In that case, there is a decreased reliance on contributors having enough free time (which can ebb
and flow due to life considerations, as discussed above) to maintain critical FOSS projects successfully.

Suggested Actions: Balance Corporate and Project Interests
To help address concerns related to corporate influence in FOSS, greater transparency of corporate
involvement should be available. Although the level of corporate involvement in some large projects isclear, it is often less so in smaller projects. Corporate involvement in FOSS should be made clear to reduce
accusations of hidden agendas. Further, to help reduce fears of companies retracting their participation,
they can make clear commitments to support FOSS in general and specific FOSS projects for at least
several years. Additionally, paid contributors should be incentivized to dedicate time mentoring newvolunteer contributors to encourage new contributor development.
An additional option is for FOSS project governance decisions to ensure paid contributors do not crowd out
volunteer contributors and prevent a single company from dominating contributions to essential projects.
The obvious solution is to transfer the FOSS project to a foundation and establish neutral governance sothat no single organization controls it. When respondents were considering whether or not to contribute toReport on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 34

a FOSS project, 52.54% said it was extremely important, very important, or moderately important to haveneutral governance (by a foundation or otherwise not controlled by a single company). However, it may bedifficult to convince a dominating company to do this (when there is one), such as when one company is
the primary contributor to a project because they are the project’s primary users. If the company will notyield the project to an independent foundation, the community may be better off that this project is open
source than proprietary, but will need to either come to terms with it being dominated by one company or
possibly fork it into a competing project.

4. Corporate FOSS Policies
Despite companies’ increasing openness towards their employees’ involvement in
FOSS, many still do not have clear FOSS policies.
Over the last ten years, companies have increasingly allowed their employees to contribute to FOSS.
45.45% of respondents stated that they are free to contribute to FOSS without asking permission, compared
to 35.84% ten years ago. Today, 30.30% of respondents can contribute after receiving permission, up from24.78% (for a total of 75.75% who may contribute to FOSS). However, 1.17% of respondents reported that
their company does not permit employees to contribute to FOSS projects at all. Additionally, a significant
percentage of respondents reported that their firms either have unclear policies (17.48%) or that they areunaware (5.59%) of what the policies are. By comparison, ten years ago only 35.84% were free to contributewithout asking permission, 24.78% needed to ask permission, 7.08% were not permitted to contribute atall, 25.66% had unclear policies, and 6.64% were unsure of the policies in place. Although there have been
positive changes over the past decade, there is still room for improvement.

Suggested Actions: Clearer Policies for More FOSS Contributions
Companies should embrace clear policies on FOSS. These policies should, ideally, allow FOSS contribution
as this can benefit the company. This survey finds that the two top motivations as “love of learning”
and “needed a feature in this FOSS” and that these two are highly connected. This means that software
professionals gain significant and satisfying learning that is also highly beneficial for their work by using
and contributing to FOSS. Previous studies have also shown that contributing to FOSS is associated withhigher company productivity in many settings.18 Allowing employees to contribute to FOSS can also allow
companies to attract higher caliber programming talent (65% of respondents said their current employer’s
support of FOSS influenced their decision to join the organization, and 81% of respondents said the skills
the acquired in FOSS were either valuable or very valuable to their current employer). Further, althoughcompanies are increasingly allowing their employees to contribute to FOSS, it would be ideal if they also
made a push for their employees to contribute to the security of these projects, either individually or
through collaborative efforts such as the Open Source Security Foundation (OpenSSF).

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 35

Conclusion
The goals in running this survey were to understand the state of security and sustainability in FOSS and
identify opportunities to help improve them and ensure FOSS’s viability in the future. In particular, thissurvey focused on the “human side” of FOSS, more than the technical side, although the two are certainlyinter-related, and these findings relate to both. These results identified reasons for optimism about the
future of FOSS (individuals are continuing to contribute to FOSS, companies are becoming friendlier to
FOSS to the point of paying some employees to contribute, etc.), but also areas of concern (in particular,
the lack of security-related efforts, and potential difficulties in motivating such efforts).
In the end, free and open source software is, and always has been, a community-driven effort thathas led to the development of some of the most critical building blocks of the modern economy. Thissurvey highlights the importance of the security of this important dynamic asset. Likewise, it will take acommunity-driven effort, including individuals, companies, and institutions, to ensure FOSS is secure andsustainable for future generations.
By continuing such discussions with, and analysis of, the FOSS contributor community, end-users and otherstakeholders will better understand how they can help sustain FOSS into the future. Therefore, the LinuxFoundation and the Laboratory for Innovation Science at Harvard aim to run future iterations of this survey
annually. If you would like to be involved in such efforts, please sign up here: http://bit.ly/2021-FOSS-Survey

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 36

A Thank You to FOSS
Contributors
As a thank you to the open source contributors who kindly gave us their time and insight by completing
this survey, the authors would like to acknowledge that without the following individual respondents — andmany others — this research would not have been possible. The following contributors authorized us toshare their names/identifiers, allowing us to publicly thank them for their time.
@KengoTODA@MarcoRossignoli@webknjaz (Sviatoslav Sydorenko)
2E0PGS
Aaron Friel
AaronRobinsonMSFT
adambkaplan
Aditya Bisoi
adrpo
Ajith P Venugopal
Alexander Usyskin
Alexey RomanovAlexey Rusakov
alshopov
Alvaro Carballo Garcia
Alvin Smith
Andreas Lindhé
andreevym
Andrew Johnson
Andrew Landsverk
andreybleme
Andrzej Leśkiewicz
Anonymouse64
ansvonwa
Anthony Zotti
Anuradha Udunuwara
arouelArshad Bashaartem-smotrakov
aularon
Baruch Siachbauen1bcornec

Report on the 2020 FOSS Contributor Survey

beikovBence A. Toth
Benjamin Krämer
benjamingr
Bernd Eckenfels
Bert Laverman
bobfriesenhahnboenrobot
bokub
borgdylan
Brian Cipriano
Brian London
Brian Warner
Bryce Cronkite-Ratcliff
burtonr
BWPandaC. Masloch
Caleb Cushing
Cengiz Can
Christian Murphy
chtompki
Cogitricolltoaction
cooperka
Craig Andrews
Crt Mori
CXuesong
cyyberDaniel Barlow
DanielaDanielRuf
daninteldaveisfera

David Hebbeker
davidkhala
DAXaholic
Debajit RoydelagenDenys Tsomenko
derekcollison
dhalperiDhruv Aggarwal
DiegoRBaquero
dilawardjjodavdrabinowitz
EdChdX
Edison Henrique Andreassy
eduardbadillo
Emmanuel DELOGET
ennerfEric Newberry
Erwin Janssen
Eugene Platonov
Eugenio Palumbo
fahimfarookme
faissaloo
Fardalefelixmulder
FFY00
frague59
Francois MarierFrederickGabriel Schulhof
Gary E. Miller
gaurav9822

The Linux Foundation & The Laboratory for Innovation Science at Harvard 37

gauravbrills
GeorgLink
gesellix
Ghan Vashishtha
ghane
giorgioazzinnaro
Giorgos Gaganis
glyn
Grant Hutchinsgrexe
Grzegorz Rożniecki
GsealyGuiRitter
GustavoARSilva
H. Chase Stevens
Harald Brabenetz
Harald Welte
Hasan Arous
Hendrig Sellik
https://github.com/c-rindi
https://github.com/enesacikoglu
iblamefish
IDA Kenichiro
ihrigbilgrosso
In Gyu Hwang
j4ng5yJack-Works
Jacob Lalonde
JamesNK
Jamo Luhrsen
Jan Henke
Jan Lübbe
JanStureNielsen
japgolly
Jason Sturges
Jasper Moeys
javad-alipanahJeff Sheets
Jeffrey Ulatan
jgonggrijp
jmaceyJoe Pearson
Johannes Kohnen
Jonas Öberg
Joris-van-der-Wel

Report on the 2020 FOSS Contributor Survey

Josh Cummings
Joshua Humphries
Jostein Kjønigsen
Juan José López Villar
juliangruber
Justin Szaday
Kahbazi
KangZhiDong
Karen Bennet
Karsten Ohme
Ken Guest
Kevin Croft
kilian hefti
kitplummer
kulabunkwwallkyranetleon-barrett
Leonardo Teixeira Menezes
LeSpockylextizlisterenko
Liyan Jin
LJHarbLorenz Nickel
Luc Van Oostenryck
madcampos
Mael Le Guen
maradoMarcel Raad
Mario Rugiero (github/Oppen)
MarkDacek
markdrothMartin Fuzzey
Mateusz Gozdek
mathbenmathdesc
matiaszanolli
MatthewZMD
Matti Vaittinen
mbiesiadMc
mcgrofmeirotstein
Mekki MacAulay
meskiomhewedy
Michael Hausegger
michelkazi
mightyiam
Miha-x64
MikeCamel
Miloudi Adel
Mirana Lova
miromannino
Mkeskells
mpollmeier
myd7349
Mykhailo Kaskun
Mykyta Potapenko
myungjoo
NAVA Mathieu
Neal Murphy
nekia
Nicholas Renner
NingZhang-e
NoodleOfDeathnope
nyetwurk
obscurerichard
Oleksandr Kozlenko
Oleksij Rempel
Oliver Sampson
oprogramador (Piotr Sr)
osiegmar
Oskar Duycz
Pedro Lino
pengisgood
perrin4869
Phillip Johnson
prasanths96
psilospore
raboofrafaelsamenezes
ramrunnerrbergmanredivoreinhapa
Rhys Perry
Richard Laager (rlaager)
Robert Hancock
Robert J Lipe

The Linux Foundation & The Laboratory for Innovation Science at Harvard 38

Robert Jacobson
RobertvanderHulst
RomanHargrave
romearaRory Graves
Rosica Dejanovska
Rouven Wessling
rtfpessoa
rweislederrwky
s-ayush2903
Samer Masterson
Sammy Chu
Santhoshsbrl
schumaml
seratchsibelius
siblingzconsult
SieuDoTia
SinopsysHK
siriakSkjolbersmbapeReport on the 2020 FOSS Contributor Survey

Solomon Peachysourabhsparkala
Stefan Haun
Stephan van den Akker
Steve Gagné
Steve Manuelstukselbax
sumnerevans
swaldmanswinslow
syntheticnightmar3
Taylor Wood
tealegTeoman “QuanticDev” Soygul
theMcQ
TheRealHaui
TheToolbox
Thomas Harning Jr.
Tobias Jakobsson
Tobias Schlatter
Toke Høiland-Jørgensen
Tomáš Janoušek
trevorlinton
Trishank Karthik Kuppusamy

tswastUgljesa Jovanovic
Umer Salman (umer936)
Utsav Akruwalavamsi-kavuri
vchrombie
vibhuti019
Victor Homyakov
VictorNicollet
Vishal anand
Vivek Ganesan
WalterCouto
Weixin Wang
Wentao Liu
Winston Weinert
xcatliu
Yann E. MORIN
yasserzamani
Yurii Kadirov (@sirkadirov)
YUTARO IINO
z3ntu
Zeeshan Shahid
ZZMarquis龙腾

The Linux Foundation & The Laboratory for Innovation Science at Harvard 39

Endnotes
1. “State of the Software Supply Chain,” Sonatype, 11 July 2016,
https://www.sonatype.com/hubfs/SSC/Software_Supply_Chain_Inforgraphic.pdf?t=1468857601884.
2. Klint Finley, “Open Source Won. So, Now What?” Wired, 11 August 2016,
https://www.wired.com/2016/08/open-source-won-now/?GuidesLearnMore.
3. Emily Olin, “Corporate Open Source Programs are on the Rise as Shared Software Development
Becomes Mainstream for Businesses,” The Linux Foundation, 30 August 2018,https://www.linuxfoundation.org/uncategorized/2018/08/corporate-open-source-programs-are-onthe-rise-as-shared-software-development-becomes-mainstream-for-businesses.
4. Klint Finley, “Diversity in Open Source Is Even Worse Than in Tech Overall,” Wired, 2 June 2017,https://www.wired.com/2017/06/diversity-open-source-even-worse-tech-overall/.
5. For example, StackOverflow’s “2020 Developer Survey” (https://insights.stackoverflow.com/survey)
showed that male and female respondents differed on a variety of reasons that they code and why
they choose their current employer.
6. For example, Karim R. Lakhani and Robert G. Wolf, (2005). “Why Hackers Do What They Do:
Understanding Motivation and Effort in Free/Open Source Software Projects.” In Perspectives on Free
and Open Source Software, edited by Joe Feller, Brian Fitzgerald, Scott Hissam, and Karim R. Lakhani.
Cambridge: MIT Press.; Josh Lerner & Jean Tirole, (2002). “Some Simple Economics of Open Source.” The
Journal of Industrial Economics, 50(2), 197-234.; Jeffrey A. Roberts, Il-Horn Hann, & Sandra A. Slaughter,(2006). “Understanding the Motivations, Participation, and Performance of Open Source Software
Developers: A Longitudinal Study of the Apache Projects.” Management Science, 52(7), 984-999.; Sonali
K. Shah, (2006). “Motivation, Governance, and the Viability of Hybrid Forms in Open Source Software
Development.” Management Science, 52(7), 1000-1014.
7.

These motivations are consistent with the three primary groups of motivations for contributing to user
communities and FOSS that are found in the academic literature (as discussed in Sonali K. Shah and Frank
Nagle, “Why Do User Communities Matter for Strategy?” Special Issue on Open Innovation. Strategic
Management Review 1, no. 2 (2020): 305–353) : self-focused intrinsic motivation (learning, creativity, afeature needed, sense of community), community-focused intrinsic motivation (reciprocity, belief in the
mission, helping others), and extrinsic motivation (recognition, payment, career advancement). However,importantly in our context when a user says they were motivated by needing a feature, we do not know
if this need is purely intrinsic for a project they are doing in their free time, or if it is needed for their
paid work. Thus that particular motivation could be either self-focused intrinsic, or extrinsic. Given thehigh rating of this motivation, future versions of the survey will seek to disentangle these two possibilities.

8. The “Total of Respondents Ranking It” column contains different values for each response as it waspossible for a respondent to not rank some of the motivations. This occurred only a handful of times.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 40

9. Cliff Lampe, Rich Wash, Alcides Velasquez, & Elif Ozkaya,(2010, April). “Motivations to Participate in
Online Communities.” In Proceedings of the SIGCHI Conference on Human Factors in Computing
Systems (pp. 1927-1936).
10. Deepa Mahajari, Olivia White, Anu Madgavkar, and Mekala Krishnan, “Don’t Let the Pandemic Set
Back Gender Equality”, Harvard Business Review, 16 September 2020,
https://hbr.org/2020/09/dont-let-the-pandemic-set-back-gender-equality
11. As discussed in Frank Nagle, (2018). “Learning by Contributing: Gaining Competitive Advantage
through Contribution to Crowdsourced Public Goods.” Organization Science, 29(4), 569-587, andFrank Nagle, (2019). “Open Source Software and Firm Productivity” Management Science, 65(3), 11911215, companies can reap benefits from the learning that occurs when they use FOSS and allow theiremployees to contribute to it.
12. Open Source Security Foundation (OpenSSF), https://openssf.org/.
13. Catalin Cimpanu, “Microsoft: 70 Percent of All Security Bugs are Memory Safety Issues,” ZDNet, 11
February 2019,https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/.
14. “Oxidation,” Mozilla Wiki, https://wiki.mozilla.org/Oxidation.
15. “Best Practices Program,” The Linux Foundation Projects: Core Infrastructure Initiative,
https://www.coreinfrastructure.org/programs/best-practices-program/.
16. “Mentorship,” The Linux Foundation: LFX Tools, https://lfx.linuxfoundation.org/tools/mentorship/.
17. “Google Summer of Code,” Google, https://summerofcode.withgoogle.com.
18. As discussed in Frank Nagle, (2018). “Learning by Contributing: Gaining Competitive Advantage
through Contribution to Crowdsourced Public Goods.” Organization Science, 29(4), 569-587,
companies can reap benefits from the learning that occurs when they allow their employees tocontribute to FOSS.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 41

Appendix: Full Survey Text
and Detailed Data
As mentioned in the Methodology section, the pool of submitted surveys included many partiallycompleted submissions. The first question — about geographic location — was the only question that all
participants were required to answer, in order to comply with international research policies regarding
data. Therefore, the results below each survey question represent an analysis of the answers that
respondents did provide, even if those same respondents left other questions unanswered. Overall, therespondent pool for each question (N) will represent a subset of the overall pool of 1,196 individuals who
answered the demographic questions and at least one question about their FOSS contributions. Separate
from each question’s respondent pool is the raw number of participants who saw the question and choseto leave it blank. Each potential response is followed by the percentage of that question’s respondent
pool that selected it. Text responses have been summarized to highlight major trends or unique insights.
Display and skip logic has been added in under the question text in italics.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 42

Demographics
1. To determine which privacy law stipulations apply (such as GDPR), would you please select thecountry in which you currently reside?
N = 1196

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 43

2. How old are you?
N = 1192 Saw but didn’t respond: 4

3. What is your gender?
N = 1192 Saw but didn’t respond: 4

Software Development and FOSS Background
4. How many years have you been developing software?
N = 1174 Saw but didn’t respond: 22

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 44

5. Have you received formal training insoftware development? (e.g., classes in highschool or university, coding boot camps, etc.)
N = 1181 Saw but didn’t respond: 15

7.

6. Have you received formal training indeveloping secure software? (e.g., classes,
badges, coding boot camps, etc.)
N = 1180 Saw but didn’t respond: 16

What year did you begin working on open source (FOSS) projects? (e.g., 2009)
N = 1166 Saw but didn’t respond: 30

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 45

8. Are you currently contributing to any FOSS projects actively? (e.g., at least one commit in thelast 36 months)
N = 1179 Saw but didn’t respond: 17

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 46

9. There are many reasons that people stop participating in an open source project. If yourparticipation in FOSS has ever stopped, please rate your agreement with the following reasons
as they apply to your personal situation.
This question was only shown to those who responded to question #8 that they are not currently contributing
to FOSS.
a. I lost interest in the project
N = 126 Saw but didn’t respond: 22

b. I started to contribute to another open source project
N = 122 Saw but didn’t respond: 26

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 47

c. I disagreed with the technical direction of the project
N = 121 Saw but didn’t respond: 27

d. I had a personal disagreement with some of the participants
N = 124 Saw but didn’t respond: 24

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 48

e. My time became constrained by other professional commitments
N = 132 Saw but didn’t respond: 16

f.

My time became constrained by family or social commitments
N = 131 Saw but didn’t respond: 17

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 49

g. My employment contract prevented me from participating in open source projects
N = 123 Saw but didn’t respond: 25

h. My work supervisor did not approve of my participation in open source projects
N = 118 Saw but didn’t respond: 30

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 50

i.

Participation by others in the project stopped
N = 118 Saw but didn’t respond: 30

j.

The project accomplished all of its goals that were of concern to me
N = 122 Saw but didn’t respond: 26

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 51

k. My employer’s technical needs changed and I was redeployed to another project
N = 120 Saw but didn’t respond: 28l.

Other (please enter below)
N = 54 Saw but didn’t respond: 94
Text Response Summary:In addition to the common response that time constraints led to the end of their contributions,a few also noted that economic constraints or the end of payment for their contributions
were the cause. Several noted that contributions were tied to the respondent’s employment;
when they changed jobs or companies, their contributions ended. Still others left projects
when they lost interest or felt as though they had fixed all the issues that they wanted tochange. Perhaps most troubling, but less frequently mentioned, was that contributing had
become “unattractive,” as their efforts were met with unreasonable demands from end
users, attacks from others, as well as “negative personal and professional outcomes.”

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 52

Current FOSS Contribution
10. Please list the FOSS projects to which you contribute in the formats modeled below. If morethan five, please list only the five in which you are currently most active. (e.g., at least one
commit in the last 36 months)
GITHUB example format for antlr/antlr4: https://github.com/antlr/antlr4
GITLAB example format for sublime-music: https://gitlab.com/sublime-music/sublime-music
SOURCEFORGE example format for gpshell: https://sourceforge.net/projects/globalplatform
OTHER: please just list the full repository url for the project

11. Did you know anyone involved in the following project(s) prior to your participation?
N = 903 respondents answered this question about 2,998 projects
4 individuals saw (but did not answer the question) about 7 total projects
37.12% of projects had someone the respondent knew on the project before joining
62.88% of projects did not have someone the respondent knew on the project before joining

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 53

12. In the FOSS projects to which you contribute, which channels are generally used forcommunication? (please select all that apply)
N = 912 Saw but didn’t respond: 11
90.35% use issue trackers (e.g., GitHub Issues, BugZilla, etc.)
56.80% use email/mailing lists
51.10% use instant messenger (e.g., Slack, IRC, etc.)
40.79% use documentation
21.27% use video conferencing (e.g., Zoom, Skype, etc.)
19.30% use in person
7.24% use “Other”
Text Response Summary (N = 65)
Most text responses entered for “Other” listed various chat, messaging, and networking
platforms (including Gitter, WeChat, Discord, LinkedIn etc). One frequently mentioned
social media platform used for general communication was Twitter. General forums (e.g.,
StackOverflow, Reddit) and project-specific forums were often named as well.
Other means of communication listed were audio conferencing or calls, hack weekends
and conferences, unit tests, code reviews, pull or merge requests, and online pairing.

13. How often in the past have you met face-to-face with FOSS project partners?
N = 910 Saw but didn’t respond: 13

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 54

14. In the FOSS projects to which you contribute, which channels are most effective for resolving
technical disagreements (e.g., accepting new features, how to fix bugs, etc.)? (please select allthat apply)
N = 896 Saw but didn’t respond: 27
74.22% use issue trackers (e.g., GitHub Issues, BugZilla, etc.)
38.06% use instant messenger (e.g., Slack, IRC, etc.)
37.83% use email/mailing lists
20.42% use in person
17.97% use video conferencing (e.g., Zoom, Skype, etc.)
12.28% use documentation
2.68% use “Other”
Text Response Summary (N = 23)
While some responses here were similar to those for general communication (including
Gitter, Discord, etc), forums tended to be the preferred method. Gerritt code reviews andpull or merge request comments were commonly mentioned as well.
The next set of questions pertains to your level of engagement in each FOSS project named.
Active contributors to a FOSS project are identified as either “maintainers”, “core participants”,“occasional participants” or “one-time participants.”“Maintainers” are software maintainers or package maintainers who are the final decision makers over all or
portions of source code that goes into a build or release. Maintainers would likely also identify as a subset of core
participants.
“Core participants” may have been involved in the project since inception or joined later and regularly
participated in major discussions about project direction, and have significant on-going roles in the work,
possibly including accepting patches to the code base. Core participants may be referred to as “Committers” in a
project community.
“Occasional participants” would not normally participate in ongoing or weekly project discussions, but
occasionally provide contributions over longer periods of time.
“One-time participants” is someone who provides a specific set of suggestions or contributions and then exit
involvement one their work is done; these are sometimes called “drive-by commits.”
Given these definitions, please answer the following questions:

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 55

15. Do you regard yourself as a maintainer, core, occasional, or one-time participant on thefollowing project(s)?
Respondents were asked to identify their level of contribution for each of the projects they had listed inquestion 10
N = 853 respondents answered this question about 2,885 projects
4 respondents saw but did not answer the question about 7 total projects
Here the individual’s contributor status is determined as the highest status indicated by that individualon any listed project:

16. Aside from the projects you have alreadyidentified, in how many other FOSS projects
would you consider yourself to be amaintainer or core participant?
N = 887 Saw but didn’t respond: 20

Report on the 2020 FOSS Contributor Survey

17. Approximately how many other FOSS
projects would you consider yourself to bean occasional participant?
N = 889 Saw but didn’t respond: 18

The Linux Foundation & The Laboratory for Innovation Science at Harvard 56

18. Do you have authority to give commit rights in the project(s) below?
This question was only shown to respondents who indicated that they were a maintainer or core participant
on at least one of the projects they listed in question #15
N = 475 respondents answered this question about 1,009 projects
9 respondents saw but did not answer the question about 21 projects
Respondents have commit authority to 81.17% of the projects
Respondents do not have commit authority to 18.83% of the projects
19. How many total FOSS projects have you had commit rights to?
N = 762 Saw but didn’t respond: 13

20. When developing software, what are your main sources for security best practices? (please
select all that apply)
Respondents were also asked to elaborate on which specific sources in each resource category they use
N = 606 Saw but didn’t respond: 169.
Responses and Summaries of Entered Text:
a. 10.73% In-person Classes
Overwhelmingly, the text responses referred to college and university courses that the
respondents had taken, either as part of a degree or an elective. Another popular source werelectures at workshops, camps, meet-ups, conferences, job-related training courses, or even
impromptu mentorship from colleagues. Some of the other training courses and certifications
mentioned were Sensepost, SANS and Global Information Assurance Certification (GIAC).

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 57

b. 15.51% Corporate training
Beyond general descriptions of internally organized training sessions on privacy, software security,
cybersecurity, data protection and latest industry trends, some respondents specifically citedreceiving training on cross-site scripting prevention and secure software development. Formal
training often occurred through outside organizations like Open Web Application Security Project’s
Security Shepherd, Watchcomm, the Linux Foundation, Microsoft, Google, IBM and Red Hat.
c. 25.91% Open Web Application Security Project — OWASP
By far the most cited OWASP resource was the Top 10 Web Application Security Risks, followedby the OWASP Cheat Sheet Series and Best Practices guides. Other resources — including theApplication Security Verification Standard (ASVS), dependency checker, wikis, video courses, andvulnerability scanning tools — were also mentioned frequently.
d. 46.54% Online articles / blogs
Several popular blogs came up in the text responses, including LWN, Y Combinator, Schneier on
Security, Google’s Project Zero, GitHub’s blog, Red Hat security blog, Troy Hunt’s blog, Paragon
Initiative Enterprises blog, Niebezpiecznik.pl, Heise Online, DZone, and a variety of blogs on
Medium. Instead of mentioning specific blogs, others reported finding useful links on Reddit,
Hacker News, StackOverflow, StackExchange, Dev.to, Twitter, and Google search results related totheir issues of interest. Several respondents also turned to “the documentation of the libraries”
they use and project specific blogs, such as the Mozilla Developer Network, Django, and Linuxpages. A few “official” sources came up as well, including Common Vulnerabilities and Exposures(CVE), the Internet Engineering Task Force (IETF), and the French National Cybersecurity Agency (ANSSI).
e. 16.17% Books
Bruce Schneier’s works Applied Cryptography and Cryptography Engineering featured prominently
in the respondents’ lists. Beyond those two books, only a handful of others received multiple
mentions, including the following:• Security Engineering: A Guide to Building Dependable Distributed Systems by Ross
Anderson• UNIX Network Programming by W. Richard Stevens• The Art of Unix Programming by Eric S. Raymond• The Linux Programming Interface: A Linux and UNIX System Programming
Handbook by Michael Kerrisk• Writing Secure Code by Michael Howardf.

50.66% Forums, like Stack Overflow or Reddit
By far, StackOverflow was the forum that respondents most often reported consulting for
security best practices. Other sites in the Stack Exchange Network also featured prominently,
including those dedicated to cryptography, software engineering, and information security.
Respondents mentioned Reddit second most often citing several subreddits like r/programming/,

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 58

r/reverseengineering, r/crypto, r/netsec, r/security, and r/hacking. A few other sites came up in
responses, such as Discord, Baeldung, Google groups, Lobste.rs, and other project- or languagespecific forums.
g. 8.42% CII Best Practices Badge
No text responses were requested when respondents selected this option
h. 8.75% Online Classes
Online courses related to security on Coursera, Pluralsight, Udemy, and Udacity appeared
frequently in respondents’ text entries. Again, social media channels like YouTube and LinkedIn(via the Learning platform) received significant mentions. Some respondents cited the official
documentation, tutorials and guidance from security team members as their preferred “classes.”i.

7.26% Podcasts
Some of the podcasts that respondents cited most often were This Week in Tech’s Security Now
and FOSS Weekly. Other notable inclusions were CppCast, Changelog’s GoTime, Talk Python to Me,
Software Engineering Radio, Open Source Security Podcast, and Säkerhetspodcasten. Two YouTube
channels — LiveOverflow and Computerphile — appeared as well.

j.

13.20% Mailing Lists
Unsurprisingly, most text responses cited project-specific lists most often. However, there werea few broader, security-related mailing lists that received specific attention: https://seclists.org/
fulldisclosure, https://seclists.org/oss-sec/, and https://www.openwall.com/lists/oss-security/.
Security-specific announcements from CVE, Debian, SuSE, OpenJDK, RedHat, Linux Kernel, andApache were also highlighted on the list.

k. 30.03% Other
One of the most valuable resources was identified by one respondent as “experience combinedwith common sense.” Along with formal education and on-the-job training, these resources aresubstantial time commitments and may not be possible for every contributor. However, the second
most cited resource for security best practices was advice from other FOSS contributors, coworkers, and friends in cybersecurity. Peer review — whether in person, over IRC, via Request For
Comments (RFCs) or through mailing lists — was another resource several respondents mentioned.
One respondent pointed out that “working through problems collaboratively” was invaluable: “I
without a doubt couldn’t know what I know about security today if it weren’t for all the people who
were willing to point out errors, listen to me walk through potential security issues, or correct meby pointing out articles of current best practices.”
Conferences, hacking challenges, capture the flag games, and other collaborative learning
experiences were cited as well. Even for individuals that are unable to attend these events in realtime, videos of the talks and presentations online provide valuable information that contributors
can access at their convenience.
A third useful resource that many respondents noted was the integration of automated security
tools and tests into continuous integration pipelines. They specifically identified static analysis
tools and penetration test tools as helpful for improving security.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 59

Not all respondents were enthusiastic about discussing security best practices. One respondent
said that they “find security an insufferably boring procedural hindrance.” Another is quoted in full
here: “I find the enterprise of security a soul-withering chore and a subject best left for the lawyers
and process freaks. I am an application developer.”21. For the FOSS projects where you are a maintainer or core participant, do you have the following
security processes in place?
This question was only shown to respondents who indicated that they were a maintainer or core participant
on at least one of the projects they listed in question #15
a. Do you have a security policy in place?
N = 312 respondents answered the question about 603 projects
415 respondents saw but did not answer the question about 1,202 projects

b. Do you have a vulnerability disclosure policy in place?
N = 314 respondents answered the question about 606 projects
415 respondents saw but didn’t answer the question about 1,199 projects

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 60

c. Do you have support for SSL/TLS on the website?
N = 316 respondents answered the question about 601 projects
414 respondents saw but didn’t answer the question about 1,204 projects

d. Is there a maintainer/core participant with a security focus?
N = 315 respondents answered the question about 605 projects
415 respondents saw but didn’t answer the question about 1,200 projects

e. Do you use a static analysis tool?
N = 317 respondents answered the question about 606 projects
413 respondents saw but didn’t answer the question about 1,199 projects

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 61

f.

Do you use a software component/dependency analysis tool?
N = 315 respondents answered the question about 607 projects
414 respondents saw but didn’t answer the question about 1,198 projects

g. Do you use a dynamic analysis tool?
N = 312 respondents answered the question about 605 projects
415 respondents saw but didn’t answer the question about 1,200 projects

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 62

h. Do you use a threat model for the project?
N = 314 respondents answered the question about 604 projects
415 respondents saw but didn’t answer the question about 1,201 projects

i.

Does the project have a CII Best Practices Badge?
N = 308 respondents answered the question about 593 projects
416 respondents saw but didn’t answer the question about 1,212 projects

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 63

22. For each of the following security practices, please indicate which specific tools do you use:
This question was only shown to respondents who reported that one or or more of the projects to which they
contribute used the named security practice(s) in question #21
a. Static Analysis Tools (e.g., Coverity Scan)
Text responses to this question overwhelmingly cited Coverity Scan and clang security checkers,
like Clang Static Analyzer, clang-tidy, and clang-analyze. SonarQube and SonarCloud appeared
several times as well. Other respondents cited Cppcheck, LGTM, a variety of linting tools (e.g., pylint
and ESLint), and GitHub code scanning. Custom internal tools were included in the list also, thoughless frequently. Often respondents stated that they used multiple static analysis tools.
b. Dynamic Analysis Tools (e.g., OWASP ZAP)
Tools like Google’s OSS-Fuzz, syzkaller, and LLVM’s libFuzzer topped the list of text responses forthis question. Valgrind, american fuzzy lop, and the Go Toolchain were also mentioned frequently,
along with various sanitizers like ASan, UBSan, MSan, KASAN, and clang sanitizers.
c. Software Component / Dependency Analysis Tools (e.g., Snyk)
Security features offered through GitHub frequently appeared in these responses, including
Dependabot, security alerts, vulnerability warnings and scans. The second most often cited tool
was Snyk (others like WhiteSource, Sonatype’s Nexus, and Synopsys’ BlackDuck CoPilot werementioned as well, though not as frequently). Respondents also cited npm audit and OWASP
Dependency-Check. However, in the words of one respondent, “tools are pretty bad in that they
misidentify vulnerabilities very often which is very frustrating as a maintainer.”
23. Do the FOSS projects you work on require or strongly encourage digital signatures on commits
to be accepted (e.g., as pull requests, merge requests, and/or patches), to know who (by realname or username) is proposing the change?
N = 722 Saw but didn’t respond: 21
50.42% No, none of them do
32.27% Some of them do, some do not
17.31% Yes, all of them
24. Do the FOSS projects you work on perform digital signatures on released versions (e.g., use
cryptographically signed git tags (“git tag -s”) or cryptographically signed release packages
wherever the project releases the package), so that recipients can verify who released it even if
the distributing repo might be subverted?
N = 720 Saw but didn’t respond: 23
41.53% Some of them do, some do not
35.97% No, none of them do
22.5% Yes, all of them do

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 64

25. Please select the projects that do not require digital signatures for change requests to be accepted.
Only respondents who answered “Some of them do, some do not” to question #24 saw this question. They
were asked to select which of the projects they had listed in question #10 do not require digital signatures.
For security reasons, the results of this survey question are not included in this public report.
26. For the projects that you indicated do not require digital signatures, what influenced thatdecision? This question was only shown to respondents who reported that one or or more of the projects towhich they contribute do not use digital signatures in questions #23 and #24. For security reasons, the resultsof this survey question are not included in this public report.
N = 405 Saw but didn’t respond: 206
Text Response Summary
Many respondents replied that there were no specific reasons, simply inertia and/or
acceptance of the default (no digital signatures) of the platform they use. Others mentionedthat the measure seemed unnecessary — either due to the size of the project, current
review processes, trust in the platform used for commits, the perception that risks are
low, or difficulty of faking identities. As one respondent explained, “Trust is placed in thesubsystem maintainers who review, sign-off, and forward changes, and in the public review
system, rather than trusting individual contributors.”
Several respondents expressed concern that the additional barrier could deter contributors(both new and existing), given the time and effort required to implement the system andeducate contributors on how to use it. “No projects require it, because the friction that [it]would cause for contributions is never worth the security benefits of having it.”
27. What would encourage you to require digital signatures in projects that don’t currently?
This question was only shown to respondents who reported that one or or more of the projects to which they
contribute do not use digital signatures in questions #23 and #24
N = 387 Saw but didn’t respond: 225
Text Response Summary
Many respondents replied that they would be motivated to require digital signatures if itwere easier to implement, e.g., “an easy process that I can use, understand, and insist upon
for contributors to supply them over channels like github.” Again, many expressed concern
over the requirement becoming a barrier for would-be FOSS contributors, due to the lackof a “user-friendly workflow.” A significant portion also pointed out that they do not see thebenefit of digital signatures when code reviews would reveal any “bad-faith contributions.”
One respondent stated that they “suspect most security failures are due to buffer overflow
than nefarious people hacking git commits. Think you’d get a lot more secure software if
you banned C than if you required signatures.” Some respondents indicated that they were
unsure of how to implement digital signatures and would benefit from a tutorial.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 65

28. Do the FOSS projects you work on require the use of two-factor authentication (2FA) at somepoint (e.g., on login, merge acceptance, push to public tree, or using a previously-unseen device)in order to accept a change request (e.g., pull request, merge request, or patch) in order toreduce the risk of accepting a malicious change from an account with a stolen password?
Examples would include using the GitHub organizational setting “Require two-factor
authentication for everyone in the organization” or ensuring 2FA is enabled for all users who
can accept change requests.
N = 654 Saw but didn’t respond: 34
47.55% No, none of them do
32.11% Some of them do, some do not
20.34% Yes, all of them
29. Do the FOSS projects you work on require the use of two-factor authentication (2FA) at somepoint (e.g., on login, merge acceptance, push to public tree, or using a previously-unseen device)
to release a new version in order to reduce the risk of a malicious release from an account witha stolen password?
Examples would include using the GitHub organizational setting “Require two-factor
authentication for everyone in the organization” or requiring 2FA to release to a languagespecific package repository.
N = 643 Saw but didn’t respond: 45
44.95% No, none of them do
32.66% Some of them do, some do not
22.4% Yes, all of them
30. For the projects that you indicated do not use two-factor authentication (2FA) to accept change
requests or release new versions, what influenced that decision?
This question was only shown to respondents who reported that one or or more of the projects to which they
contribute do not use digital signatures in questions #27 and #28
N = 323 Saw but didn’t respond: 191
Text Response Summary
The majority of respondents indicated that not including 2FA was a lack of decision rather
than a decision. They said they were either unaware it was an option or that because it is
not the default behavior, it was not considered, or was considered too restrictive to require.
“It wasn’t a decision, it was the default.”
31. What would encourage you to use two-factor authentication (2FA) in projects that don’t
currently?
This question was only shown to respondents who reported that one or or more of the projects to which they
contribute do not use digital signatures in questions #27 and #28
N = 387 Saw but didn’t respond: 225

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 66

Text Response Summary
Respondents indicated that they would be incentivized to use 2FA if there was “evidence ofneed for low-risk projects.” Many said that the projects they work on have only a handfulof contributors and they do not see the need for 2FA on small projects. Others pointed outthat they find the process difficult to use and said that they would like it to “work smoothlywith git-push.” Respondents do not want to add to the barriers that stop people fromcontributing to FOSS.
One respondent said, “Adding extra hoops through which to jump would be detrimental
to the project generally. Our goal is to make the contribution process as easy as possible
while limiting who has commit access so that we can sufficiently read over the code being
contributed, specifically for [that] sake.”
32. What steps would you recommend that the Linux Foundation take to help improve FOSS security?
N = 380
Saw but didn’t respond: 285
Text Response Summary
Many respondents mentioned that the Linux Foundation should provide training and freeresources promoting and simplifying static analysis, security scans, best practices, digital
signatures, and 2FA. The idea of automating security checks was also brought up by several
respondents, including automated health checks that could be run by contributors andmaintainers.
“I think companies like GitHub are in a great position to try and tackle that by providing
some sort of “validated package.” GitHub provides a full ecosystem — repos, build agentsand package feeds. So a validated package could be built only using validated packages, nothave access to the internet during build, signed by a trusted party, etc.”

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 67

33. When thinking about whether to contribute to a FOSS project, how important are thefollowing things?
a. Presence of an open source license
N = 615 Saw but didn’t respond: 24

b. Presence of a code of conduct
N = 616 Saw but didn’t respond: 23

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 68

c. Presence of a contributing guideN = 614 Saw but didn’t respond: 25

d. Presence of a developer certificate of origin (DCO)
N = 611 Saw but didn’t respond: 28

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 69

e. Presence of a contributor’s license agreement (CLA)N = 613 Saw but didn’t respond: 26

f.

Presence of a contributor’s assignment agreement (CA) to a non-profit
N = 613 Saw but didn’t respond: 26

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 70

g. Presence of a contributor’s assignment agreement (CA) to a for-profit
N = 613 Saw but didn’t respond: 26

h. Active development
N = 616 Saw but didn’t respond: 23

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 71

i.

Responsive maintainers
N = 612 Saw but didn’t respond: 27

j.

A welcoming community
N = 614 Saw but didn’t respond: 25

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 72

k. Widespread use
N = 614 Saw but didn’t respond: 25

l.

Employer uses/encourages contribution to this FOSS project

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 73

m. Neutrally governed, e.g., by a foundation or not controlled by a single company
N = 614 Saw but didn’t respond: 25

n. Other? (Please specify below)
N = 119 Saw but didn’t respond: 520
Text Response Summary
Respondents indicated that they also consider whether contributions are likely tobe accepted, whether the project is something they use professionally or personally,
and whether it is easy to build the project and run existing tests.
Please select the response that most closely reflects your experience for each of the following
statements:
34. I feel as though I am a member of the FOSS community.
N = 615 Saw but didn’t respond: 12

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 74

35. When I contribute to a FOSS project, I generally…
N = 602 Saw but didn’t respond: 25

36. Please rank your primary motivations for contributing to the FOSS project you spend the mosttime on by clicking and dragging the items below. (#1 indicates the most important, #10 is theleast important)
N = 534 Saw but didn’t respond: 87

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 75

37. How likely are you to contribute to FOSS projects in the future?
N = 617 Saw but didn’t respond: 9

38. Why do you feel that way?
N = 474 Saw but didn’t respond: 150
Text Response Summary
Respondents who indicated that they would contribute in the future cited their desire
to give back to the community and to help to improve software that is used around theworld. One frequently cited motivation is that there will always be more bugs to fix. One
respondent noted the benefits of the collaboration: “... I think this improves my skills bothas a technician as well as a human being by working together with previously unknown
people.” Another noted the satisfaction contributing brought:“Working on FOSS is one of the ways I feel I make a contribution to the world. It is much
more satisfying than working on proprietary software.” Those who said they would not
be contributing to FOSS in the future predominantly cited their lack of time, e.g. “I amoverburdened and need to focus on other things.”

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 76

Time Allocation
39. How many hours per week — on average — do you spend on all your FOSS projects combined?
Please add all time spent on any kind of contribution including active development,
documentation, performing organizational or administrative functions, etc.
This question was presented to respondents as a text box where they could enter a numeric value, but for
simplicity in this report, the results are separated into the five categories below: < 8 hours, 8-20 hours, 20-40
hours, 40-60 hours, and >60 hours.
N = 586 Saw but didn’t respond: 33

40. Is this more or less time than you were spending on FOSS projects on average 5 years ago?
This question was only shown to respondents who reported that they had started contributing to FOSS atleast 5 years ago in question #7
N = 574 Saw but didn’t respond: 45
44.08% More
33.45% Less
22.47% The same
41. Is this more or less time than you were spending on FOSS projects on average 10 years ago?
This question was only shown to respondents who reported that they had started contributing to FOSS atleast 10 years ago in question #7
N = 302 Saw but didn’t respond: 17
48.01% More
36.42% Less
15.56% The same

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 77

42. Have the circumstances created by the coronavirus changed the number of hours per week you
spend on all your FOSS projects combined?
N = 554
Saw but didn’t respond: 65
65.88% No, there has been no change
24.37% Yes, I spend more hours per week on FOSS now
9.75% Yes, I spend fewer hours per week on FOSS now
43. What percentage of those [reported number from #38] hours spent on FOSS projects do you
devote to the following tasks? Please ensure that the sum of the values you entered in eachcolumn equal 100 percent.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 78

Text Response Summary
Other tasks that respondents reported related to project communication (such as answering userquestions, contributing to discussions, marketing, project websites, and “emotional support”), reviewing
code, or community management (organizing votes, devising project progression, discussing proposed
behavior changes, working on ethical and social issues, as well as writing proposals for changes).
Contributors also mentioned mentoring and teaching others, reading mailing lists and keeping up-to-datewith project developments, as well as working on improvements to infrastructure, architectural design,
bug fixes, testing and continuous integration and continuous delivery (CI/CD).

Employment
44. What is your current employment status?
N = 593 Saw but didn’t respond: 7

45. Does your current employer encourage you to contribute to FOSS as part of your work?
This question was only shown to those who reported their employment status in question #42 as full-time,
part-time, temporary worker, temporarily out of the workforce, or otherN = 586 Saw but didn’t respond: 957.51% Yes
42.49% No

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 79

46. How does your current employer encourage you to contribute to FOSS? Please select all that apply.
This question was only shown to those who reported their employer encourages them to contribute to FOSS
as a part of their work in question #43
N = 327 Saw but didn’t respond: 10

Text Response Summary
Some respondents stated that their employers encourage them to contribute to FOSS
through strictly verbal encouragement. Some respondents said the employer allows
contribution if it is useful for the project and many said their employer encourages
releasing internal projects as FOSS.
47. Did your current employer’s support for FOSS influence your decision to join that organization?
This question was only shown to those who reported their employer encourages them to contribute to FOSS
as a part of their work in question #43
N = 331 Saw but didn’t respond: 6
65.26% Yes
34.74% No
48. How much did their stance on FOSS influence your decisionThis question was only shown to those who reported yes, their employer’s stance on FOSS influenced theirdecision to join that organization in question#47
N = 214 Saw but didn’t respond: 2

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 80

49. What percentage of those [reported number from #38] hours spent on FOSS projects occurred
during paid working time versus during your free time? Please ensure that the sum of the values
you entered equal 100 percent.
This question was only shown to those who reported their employment status in question #42 as full-time,
employed part-time, temporary worker, temporarily out of the workforce, or otherN = 531 Saw but didn’t respond: 0
39.14% Average paid time 		
51.56% Average free time
50. Is this more or less time than you were spending on FOSS projects during work hours 5 years ago?
This question was only shown to those who reported their employment status in question #42 as full-time,
part-time, temporary worker, temporarily out of the workforce, or other AND reported starting their FOSS
contributions at least 5 years ago in question #7.
N = 414 Saw but didn’t respond: 10
36.96% More
33.82% The same amount22.22% Less
7.0% Not applicable
51. Is this more or less time than you were spending on FOSS projects during work hours 10 years ago?
This question was only shown to those who reported their employment status in question #42 as full-time,
part-time, temporary worker, temporarily out of the workforce, or other AND reported starting their FOSS
contributions at least 10 years ago in question #7.
N = 277 Saw but didn’t respond: 5
46.57% More
24.91% The same amount
21.66% Less
6.86% Not applicable
52. Does your supervisor consider this allocation of work time to FOSS projects as part of your corejob tasks?
This question was only shown to those who reported any percentage of time spent on FOSS occurring during
work hours.
N = 334
Saw but didn’t respond: 3
71.26% Yes
28.74% No

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 81

53. What is your current occupation?
This question was only shown to those whoreported their employment status in question#42 as full-time, part-time, self-employed or
freelancer, temporary worker, temporarily outof the workforce, or other. Respondents were
given a drill-down menu of occupations from the
Bureau of Labor Statistics Standard Occupational
Classification system
N = 493 Saw but didn’t respond: 36

Report on the 2020 FOSS Contributor Survey

54. Under which sector would your current
employer fall?
This question was only shown to those whoreported their employment status in question#42 as full-time, part-time, temporary worker,
temporarily out of the workforce or other.
N = 463 Saw but didn’t respond: 10

The Linux Foundation & The Laboratory for Innovation Science at Harvard 82

55. What type of department are you in?
This question was only shown to those who reported their employment status in question #42 as full-time,
part-time, temporary worker, temporarily out of the workforce or other.
N = 463 Saw but didn’t respond: 10

56. How often do you write software or otherwise contribute to software productions in yourcurrent job? Note: This could be either closed (proprietary) or open (FOSS) software.
This question was only shown to those who reported their employment status in question #42 as full-time,
part-time, self-employed or freelancer, temporary worker, temporarily out of the workforce or other.
N = 516 Saw but didn’t respond: 11

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 83

57. What is (or was) your most recent annual salary? (Please specify the currency. If your currency
is not listed, please convert it to USD here) While you can choose not to answer, please notethat the answer to this question will be kept strictly confidential and will be used only in an
aggregated form without any personal identifiers.
Respondents were presented with three dropdown menus: “Currency”, “Salary Range”, and “Gross (pre-tax)
or Net (post-tax).” The ten offered currency options came represented the the countries with the most FOSS
contributions: US Dollars, Euros, Australian Dollars, Canadian Dollars, Pound Sterling, Japanese Yen, Indian
Rupee, Hungarian Forint, Russian Rubles, Brazilian Reals, and Chinese Yuan Renminbis
N = 475 Saw but didn’t respond: 118
Mode of the salary range for each currency option, in order of most often selected currency to least
often selected currency:

58. What year did you join your current company?
This question was only shown to those who reported their employment status in question #42 as full-time,
part-time, self-employed or freelancer, temporary worker, temporarily out of the workforce or other.
N = 462 Saw but didn’t respond: 11

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 84

59. What was your annual salary when you joined your current company?
(Please specify the currency. If your currency is not listed, please convert it to USD here)
While you can choose not to answer, please note that the answer to this question will be kept strictly
confidential and will be used only in an aggregated form without any personal identifiers.
This question was only shown to those who reported their employment status in question #42 as full-time,
part-time, self-employed or freelancer, temporary worker, temporarily out of the workforce or other. Similar
to question # 55, respondents were presented with three dropdown menus: “Currency”, “Salary Range”,
and “Gross (pre-tax) or Net (post-tax).” The eleven offered currency options came represented the countries
with the most FOSS contributions: US Dollars, Euros, Australian Dollars, Canadian Dollars, Pound Sterling,
Japanese Yen, Indian Rupee, Hungarian Forint, Russian Rubles, Brazilian Reals, and Chinese Yuan Renminbis
N = 377 Saw but didn’t respond: 96
Mode of the salary range for each currency option, in order of most often selected currency to least
often selected currency:

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 85

FOSS at Work
60. Are you paid for any of your time spent on open source contributions?
N = 577 Saw but didn’t respond: 16

61. Please select the FOSS project(s) to which you contribute as part of your paid employment.
Respondents were asked to select which of the projects they had listed in question #10 they contributed to aspart of their paid employment
N = 262 respondents answered the question about 992 projects
Saw but didn’t respond: 18
65.52% of projects are contributed to as part of a respondent’s paid employment
34.48% of projects are not contributed to as part of a respondent’s paid employment
62. 5 years ago, what FOSS project(s) did you contribute to as part of any paid employment.
This question was only shown to those who reported starting their FOSS contributions at least 5 years ago
in question #7. They were asked to type in FOSS projects they had contributed to as part of their paid employment.
N = 151 Saw but didn’t respond: 304

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 86

63. 10 years ago, what FOSS project(s) did you contribute to as part of any paid employment.
This question was only shown to those who reported starting their FOSS contributions at least 10 years ago inquestion #7 and they were asked to type in FOSS projects they had contributed to as part of their paid employment.
N = 89 Saw but didn’t respond: 213

64. Which compiler(s) do you typically use? (Please select all that apply.)
N = 571 Saw but didn’t respond: 18

Text Response Summary
Many respondents listed Roslyn, Kotlin, JVM, Go, TypeScript, OpenJDK, AdoptOpenJDK, Scala, Javac, and MSBuild.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 87

65. In your current job, are the internal software projects (e.g., applications used within your employer’sorganization) that you work on closed (proprietary), open source (FOSS) or a mix of both?
This question was only shown to those who reported their employment status in question #42 as full-time,
part-time, temporary, temporarily out of the workforce or other AND that they write software or otherwise
contribute to software production in their current job in question #58.
N = 417 Saw but didn’t respond: 42
59.95% work on a mix of both closed and open software projects internally27.82% work on closed software projects internally12.23% work on closed software projects internally
66. In your current job, are the software products (e.g., solutions that your employer sells tocustomers) that you work on closed source (proprietary), open source (FOSS) or a mix of both?
This question was only shown to those who reported their employment status in question #42 as full-time,
part-time, temporary, temporarily out of the workforce or other AND that they write software or otherwise
contribute to software production in their current job in question #58.
N = 445 Saw but didn’t respond: 14
38.2% work on closed software products
37.98% work on a mix of both closed and open software products
12.36% work on open software products
11.46% reported that they don’t develop software for sale (N/A)
67. Do you build on or incorporate FOSS components into closed (proprietary) software?
This question was only shown to those who reported their employment status in question #42 as full-time,
part-time, temporary, temporarily out of the workforce or other AND that they write software or otherwise
contribute to software production in their current job in question #58 AND if they indicated that the internal
software projects (question #64) and/or the software products (question #65) they work on contained closed
software or a mix of closed and open software.
N = 390 Saw but didn’t respond: 2
78.72% Yes
21.28% No
68. Which FOSS components do you usually build on or incorporate into non-FOSS projects? (Pleaseuse a comma to separate multiple projects.)
This question was only shown to respondents who reported that they build on or incorporate FOSS
components into closed software in question #66
N = 229
Saw but didn’t respond: 75
Text Response Summary
Respondents answered that they use components such as various Apache components,
Antlr4, Spring Boot, Spring Cloud, .NET Core, U-Boot, Protobuf, ReactJS, Ruby on Rails,
PostgreSQL, Django, JSON.NET, Pandas, AngularJS, Bootstrap, Tensorflow, and Node.js. A
common answer was expressed by one respondent as: “Tons of things! What tech stack
isn’t like 90% FOSS at this point?”

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 88

69. Which of the following best categorizes your work on open source (FOSS) projects?
This question allowed for multiple selections and was only shown to those who indicated that the internal
software projects (question #64) and/or the software products (question #65) they work on contained open
software or a mix of closed and open software.
N = 306 Saw but didn’t respond: 14

Text Response Summary
Respondents listed categories such as networking libraries, compilers, simulation modeling,
Java libraries, Python libraries, scientific computing, machine learning, blockchain,documentation, spatial analysis, middleware, developer tools, graphics, and accessibility.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 89

70. Which of the following best categorizes your work on closed source (proprietary) projects?
This question allowed for multiple selections and was only shown to those who indicated that the internal
software projects (question #64) and/or the software products (question #65) they work on contained closed
software or a mix of closed and open software.
N = 348 Saw but didn’t respond: 40

Text Response Summary								Respondents listed categories such as compilers, machine learning, developer tools, portals,
inventories, embedded devices and software, web services, desktop applications, trading
systems, cryptography, scientific computing, documentation, graphics, and web applications.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 90

71. How important do you think your involvement in FOSS projects was to getting your current job?
This question was only shown to those who reported their employment status in question #42 as full-time,
part-time, temporary, temporarily out of the workforce or other.
N = 506 Saw but didn’t respond: 11

72. Do you feel your participation in FOSS projects has positively impacted your salary or job
prospects?
This question was only shown to those who reported their employment status in question #42 as anythingother than full-time caretaker or permanently out of the workforce.
N = 560 Saw but didn’t respond: 10

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 91

73. How valuable were the skills that you acquired from working on FOSS for your current
employer?
This question was only shown to respondents who indicated that FOSS contributions is considered partof their core job in question #51 or if they answered that they received any kind of payment for FOSS
contributions in question #59
N = 339 Saw but didn’t respond: 13

74. Could you explain or give an example of how these skills were valuable?
This question was only shown to respondents who answered anything except “Not valuable” in question #70
N = 200 Saw but didn’t respond: 131
Text Response Summary
Respondents said that they learned how to write and test production-level code, organize
asynchronous work as a team, and communicate and collaborate with a team. Respondents
also said that they learned how to perform code reviews, how to use version control, and thatthey benefit from clean code being prioritized over “ugly workarounds.” Respondents benefited
from learning about “workflows, issue tracking and resolution, bug reporting, timezone
distributed work, gaining trust in developer communities.” They also said that learning
about FOSS libraries helped them know what solutions exist when they are writing code.

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 92

Employer Policies
All of the questions in the “Employer Policies” section were only shown to those who reported their employment
status in question #42 as full-time, part-time, temporary, temporarily out of the workforce or other.
75. How does your employer’s intellectual property agreement/policy affect your contributions to
FOSS projects, unrelated to your work, during your free time?
N = 429 Saw but didn’t respond: 34
76. Thinking back to five years ago, how did the intellectual property agreement/policy of youremployer at that time affect your contributions to open source unrelated to your work, during
your free time?
This question was only shown to those who reported starting their FOSS contributions at least 5 years ago inquestion #7.
N = 362 Saw but didn’t respond: 89
77. Thinking back to ten years ago, how did the intellectual property agreement/policy of youremployer at that time affect your contributions to open source unrelated to your work, during
your free time?
This question was only shown to those who reported starting their FOSS contributions at least 10 years ago inquestion #7.
N = 226 Saw but didn’t respond: 74

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 93

78. Please select the statement that is closest to your current employer’s policy on using FOSS
applications or infrastructure.
This question was only shown to those who reported that they write software or otherwise contribute tosoftware production in their current job in question #58.
N = 511 Saw but didn’t respond: 54

79. Please select the statement that is closest to your current employer’s policy on incorporating
open source libraries or code into your code base.
This question was only shown to those who reported that they write software or otherwise contribute tosoftware production in their current job in question #58.
N = 428 Saw but didn’t respond: 21

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 94

80. Please select the statement that is closest to your current employer’s policy on contributing
upstream (e.g., sending any changes you make to an open source project back to the original
maintainers for inclusion into an upcoming release of the software).
This question was only shown to those who reported that they write software or otherwise contribute tosoftware production in their current job in question #58.
N = 433 Saw but didn’t respond: 16

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 95

Suggested Action
81. Think of the FOSS project to which you contribute that needs the most assistance. What type ofcontribution from external sources would be most beneficial? (Please select all that apply.)
N = 527 Saw but didn’t respond: 46
36.43% included financial contributions in their response
52.12% included code contribution — new features in their response
65.66% included code contribution — bug/security fixes in their response
33.59% included a free security audit in their response
17.46% included a free online course on how to develop secure software in their response
25.62% included simplified ways to add security-related tools to the continuous/integration pipeline
4.18% included training in their response (see text response summary below):
Text Response Summary
Most respondents requested online, live session, demos featuring training on bestpractices, quick start guidance (both for those new to a project and those new to FOSS ingeneral), security, threat modeling, and secure software development. One respondentsuggested, “free training on sites such as CodeAcademy, Udemy, and Pluralsight.”
10.06% selected to include other suggestions (see text response summary below):
Text Response Summary
Additional suggestions:
1. Assistance with infrastructure and development workflow, including hosting services,
built-in security features in package managers, automatic testing, tools to audit
dependency vulnerabilities, access to build and test machines, as well as performance
audits and optimizations
2. Sponsoring and simplifying security tools — like encryption, two-factor authentication,and digital signatures — to increase their use
3. Creating, standardizing, and implementing project documentation
4. General assistance with code contribution, reviewing/maintaining, and triaging issues(e.g., bugs, new features, questions)
5. Information on how to improve funding and professionalize the donation process (e.g.,
invoices or receipts)
6. Marketing assistance for FOSS projects, as well as raising public awareness about open
source in general

Report on the 2020 FOSS Contributor Survey

The Linux Foundation & The Laboratory for Innovation Science at Harvard 96