cURL: how we take advantage of unpaid work 💻

Whenever we buy an iPhone, for example, we assume the people who wrote the code were paid to do so, right? While that is true for everyone who benefits from software copyright, virtually every technology company uses thousands of small pieces of free code, made available through open source projects on sites such as GitHub or GitLab.

Quite often, these developers do not mind working without being paid. Writing open source software lets them sharpen their skills, see new perspectives from the community, or simply help the industry by developing innovations at no cost.

According to Google, which maintains hundreds of projects of this kind, open source “enables and encourages collaboration and the development of technology, solving real problems”. But when software is used by millions of people and maintained by a community, or by a single person, entirely as a volunteer, the process can sometimes go very, very wrong.

The catastrophic Heartbleed bug in 2014, which compromised the security of hundreds of millions of websites, was caused by a problem in an open source library called OpenSSL, which was kept going by one full-time developer who relied on not making mistakes, despite the updates and changes to code used by millions. At other times, developers simply get fed up and walk away from the projects.

It is hard to demand that programmers who work for free keep problems at bay or keep software maintained even when they no longer have any interest in it, for whatever reason. Even so, many companies try to do exactly that and, by not maintaining these projects properly, the whole technology ecosystem ends up much weaker.

And that is precisely why many programmers are asking companies to pay them, not for the code, but for support services. One of the best examples of what we are talking about comes from Daniel Stenberg. He is one of those developers and the creator of cURL, one of the best-known open source projects in the world.

Developers use cURL to transfer information between two systems, usually in an API where one service needs to request or send data from another service. According to Stenberg, cURL is part of billions of smartphones, many hundreds of millions of televisions and at least a hundred million smart cars, as well as every iPhone ever made and almost every modern device we touch every day, without exception.

The scale at which this system is used lets us assume that the creator does most of the work of maintaining it, with the support of a volunteer community. Even so, many companies that use the code do not even know who it belongs to. Daniel lives near Stockholm, in Sweden, and invented cURL in 1998. To this day he keeps the project going entirely for free, although he recently took a job at a company called wolfSSL, which now pays him to work on it as close to full time as possible.

Companies that still rely on this particular piece of open source software occasionally hire the creators of these projects to build new pieces. In this case, wolfSSL gave Stenberg the job not only of maintaining cURL but also of building technical support for the system.

The programmer never expected his creation to become so popular. In fact, it took several years before Stenberg realised that cURL was being used so widely. Because the code is open to free use, there was no reason for companies to tell him they were using it. The developer only realised how successful the software he built had become when people started talking to him after seeing his name in the system's “About” window. “I never anticipated any of this,” the specialist has said, adding that he feels annoyed when “it seems people try to take advantage instead of contributing to support the project, given how much they get out of it”.

For the first 20 years of cURL's existence, Stenberg says he worked on it in his spare time and managed to keep his ‘real job’ developing software. Maintaining the project, of course, took a lot of work: he spent hundreds of hours improving the system, fixing bugs and refining the code. Of the 25,000 updates made in the repository, Stenberg created 14,000 of them. No other developer contributed as much to the software; at most, another developer contributed a little over 2,000.

cURL's survival is down to a range of sponsors who funded the project's hosting and other costs (although Stenberg says no large company contributed) and to contributors such as this specialist, who gave his time entirely. The developer says he believes it is important that open source exists and that he has never regretted creating the software in this form.

What frustrates him is only one thing: when companies demand his help. Last year, a foreign company contacted him in a panic after pausing a firmware upgrade on millions of devices because of a problem with cURL. “I had to explain that I could not travel to another country at such short notice to help them solve this problem, because I work on cURL in my spare time and I have a full-time job,” he says.

But because he really cares about the project, Stenberg found a friend to help. That friend did travel to the country in question and helped solve the issue. To compensate open source programmers for this kind of service, Stenberg believes large technology companies should pay for technical support contracts. That way, besides rewarding developers for the time spent, they would help keep the projects running.

With his work for wolfSSL, Stenberg hopes to persuade companies such as Apple to pay for support, but that effort is still at a very early stage. Technical support contracts are not exactly cheap, and they often run to thousands of dollars in exchange for help using projects and specialist support when something goes wrong. Even so, the kind of companies that need this service are typically well off.

It is still not clear that companies are interested in this kind of contract. When the founder of cURL asked the company to pay his travel expenses, after being asked to fly to the other side of the world, he was told no. That is what really frustrates him. “I think I get annoyed when it seems people take advantage of us instead of contributing their share to the project they are benefiting from,” he says.

But he still sees support contracts as a long-term solution for keeping open source going: “The money needs to go to the authors and not only to the curators or large open source projects/companies”.

Many people in the open source community oppose the idea that they should be paid in any way, which remains a controversial topic. Many believe monetisation kills the idea of it being ‘free’, but the reality is that people who work without getting anything in return also need to eat and feed their family, like anyone else.

Today, when a developer or a company emails Stenberg asking for help as quickly as possible, he says his attitude has changed: now the programmer replies that “maybe, but only maybe, I can help in exchange for payment of a technical support contract”. Asked whether he will keep cURL for ever, now that 20 years have passed, Stenberg says he does not intend to abandon the project that has already become a large part of his life. “Assuming, of course, that I find a way to be paid to do it,” he adds.