We eagerly welcome audits and fixes from any source,” the Foundation said. Cash, while welcome and useful, isn’t sufficient. Conduct security audits and feed back the results.

“One of the most valuable things businesses that use open source can do is contribute back. The ASF described the Log4j vulnerability as “an unfortunate combination of independently designed features within the Java platform” and argued that disabling antiquated and unnecessary default features would have prevented the issue. The foundation’s statement comes on the heels of the ongoing Apache Log4j incident where a remote code execution vulnerability in a little-known Java-based logging utility led to a global incident response crisis. “Only a tiny percentage of downstream companies (reusing the same code within their own products) choose to participate ,” the Foundation said, noting that any future directives must “avoid placing additional unfunded burdens on the few maintainers who are already doing the work.” Companies that build open source into their products rarely participate in their continued maintenance,” the ASF said in a position paper published ahead of a high-level White House meeting on open-source software security.

“ community is defined by those who show up and do the work. The Apache Software Foundation (ASF) is calling out for-profit companies leeching on open-source code, warning that “only a tiny percentage” of downstream vendors are contributing to securing the open-source ecosystem.

Apache open