Mapping the Dependencies of Publicly Funded Open Source: a Stress Test for Ethereum Rails

Transcript

Amazing. [music] Thank you very much. Uh, beautiful venue. If Prague has been always in my heart. I've been to a couple of conferences before and uh, yeah, very very happy to be here. So we are going to be talking about yeah mapping the dependencies of publicly funded open-source stress test for Ethereum rails. As I already mentioned, my name is Sophia. I work for funding coordination team at the Ethereum Foundation and as I already mentioned as well uh we are the researchers working on improving funding mechanisms within

Ethereum inside Ethereum and beyond. So for the next 20 minutes I'm going to go with you through the piece of the research. Um there's going to be some numbers that would give you a second thought on the state of open source funding. Um how open source has been funded so far in the EU and why Ethereum is the right piece of critical infrastructure to fix what for what's broken. So I know that some of you might want to go to Vitalik's talk uh later on because it's right after my talk. That's why I decided to swap the end of the presentation and put it in the beginning. So I'll start with the hypothesis with the research that I'm doing. So the hypothesis that I'm working on that I have to prove or

disprove is that a dependency aware stack built on infrastructure designed for a transparency programmability and intermediary minimization would provide a fairer more efficient funding environment than anything that exists today. So uh we'll start with numbers as I promised and I hope that uh they will uh as I said give you a second thought on how does it look like in open source not in the blockchain space but open source in general. So the supply side value it's essentially what it actually costs to build and maintain open source is at $45 billion. That's according to 2024 Harvard and University of Toronto

working paper. The authors are mentioned here the name as well. So and the demand side value what it would cost the world to replace it is at 8.8 trillion. So spend $1, save 2,000. There is not many infrastructure investments that come so close. Another interesting piece of information that I wanted to take from this working paper is that 96% of that 8.8 8 trillion demand site value is created by only 5% of open-source software developers. And according to the articles that took a review of this working paper, we are lending at about 3,000 people. 3,000 people holding up

the foundation under banking, browsers, medical devices, government services. It's crazy. Are they getting paid actually? And uh then I decided to take a look at another paper. It's an open-source software funding survey that was done in 2024 by Linux Foundation, GitHub and Harvard. They interviewed 5001 companies and out of them 159 came to them and said yes we do fund open source financially and they reported that they funded it on $1.7 billion.

Looks good, right? And the sum is good. But if we split it, if we see actually what's inside, we will see that those organizations that responded to the survey, 86 of them, they contributed to open source and employee labor. So basically, companies letting their engineers spent paid hours on open source. It's not bad. I mean Google developer is uh for example contributing to an indie solo maintainer project and this maintainer would never would never be able to afford um uh this kind of uh force that kind of power. So the problem with that is that the labor flows towards the project companies

already depend on. So um if for example Google is dependent on I don't know five projects they would just contribute to those five and nothing more. And then the second problem is that the longtail underneath the dependencies um they typically get nothing. Only the top level project um is getting this um uh this engineering power. So only 14% about 239 million of that 1.7 billion is a direct financial support. Now let's look at this number. If we look at 2 uh 238,000 uh 9 uhund sorry $9 million we will see that before maintainers pays themselves

they would have to spend on contractors. They would have to spend on project ops. They have to spend on legal. they have to spend on audits and whatn not and then uh these are all the bills that maintainer pays before paying themselves. So 4% it is roughly $9.7 million that reaches maintainers pockets. So here is the overview of all the numbers that I gave you and 8.8 trillion of demand site value and we are only paying 9.6 6 million to maintainers. And now let's divide 9.6 million to maintainers to 3,000 people that I mentioned before. And we end up

paying $3,200 per maintainer per year. I'm not going to comment that. So um organizations contribute the way they contribute. They have engineers. They have uh they give engineering powers. Um so if we want to get more direct money to maintainers, how we actually do that? The answer is governments. Governments have budgets, grants, procurement contracts, financial tools that can reach the maintainers corporate labor consistently misses. Since we are in Europe, I decided to give you an overview of the um EU programs. How does the EU support open source? And we actually find out that it's not too bad. So I'll start with NLNET. Um it's a Dutch foundation. It

gave birth to modern direct to developer grant making in Europe through the early internet protocols they supported and they're also a lead coordinator of the next generation internet initiative and over the course of 2019 to 2024 they provided support to 80,000 active contributors that was 140 million euros and it was 1,200 uh plus projects that they supported in Germany there is a sovereign tech agency this is a very interesting fund because they this fund is built explicitly for open digitalbased technologies which means that they support libraries, protocols and dev tools that align below the application layer. So the dependencies so to say you don't have to

be German, you don't have to be based in Germany. You don't have to be even based in the EU to be able to apply for this fund. And since 2022, since it just it started, uh they redistributed already around 25 million euros and they helped 60 plus projects. Um another interesting case and that happened just now is that the idea of sovereign tech agency is being brought to the EU level. One month ago, EDIC European Digital Infrastructure Consortium announced that they would like to launch a pilot um basically a support of all those as I mentioned libraries, protocols and whatnot is lying under the application layer below the application layer that

would be supported on the U level. And another number to remember is roughly 100 billion euros. um that is two umbrella programs, Horizon Europe and digital Europe and obviously open-source software projects are qualifying and are very much welcome to apply um to those calls. So why am I telling you all of this? Because there is a very interesting shift that is happening in the U law right now and it's called cyber resilience act. Um and it might change it's created for security and vulnerability uh providing better security and vulnerability for digital sovereignty in Europe but uh we think that it might change the funding redistribution mechanism. So um I'll tell a little bit about cyber resilience

act. My colleague Dvanch was already talking about it before um in one sentence but there's basically two phases uh of this um act. September 2026 is partially when it comes to force. December 2027 is when it fully comes into force. If you have non-commercial activity so if you're just open source maintainers and you accept donations if you're a public good then CRA is not going to touch you. However, if you do any commercial activity in the EU market, even if you're you yourself are not coming from the EU, then you're probably a manufacturer. Um, here I've created a QR code. Um, so I was at the conference uh two three weeks ago in Brussels and they were giving away those

leaflets with uh links. This is the legal act and also all the FAQ sections identifying the companies, find out more. So basically all the documentation that you might want to read about cyber resilience act this is all here. I digitized this page for you. So please um feel free to scan it. Um however what is important here is that what's new um the um change that is going to happen is called boom or software bill of materials or in other words the dependency graph which is created to find security and vulnerability uh problems and report on them fast enough so that um digital

products that are being sold in the EU are as I said secure However, from the funding perspective, when a funer opens up the project they are supporting, they no longer just see the top level one. They see also the dependencies that are as crucial as the project they are planning to fund. So, it will be very hard to claim that they didn't see them. So, if the funders keep backing only the brand name projects on top while ignoring the deep roots underneath, the maintainers holding those roots up stay unsupported. And um I'm going to show you a little demo that I built for the purpose of this conference, but I'm going to uh probably open source it later as well.

Um so we are taking a very specific example here, a funer um whose name is Schles Kstein. It's the state in the a federal state in the northern Germany. And they have a so-called open um innovation program. It's created so that they can fund open source software that is built from and for the state. So um inside the state paying their own guarantees in Europe is not a problem because we have sepa it's free it settles in second but what that's about the top level project what about their dependencies and the tool that I built is essentially analyzing the 10 projects that they invested money into in 2024.

They also have projects um for 2025 which is going to be in the next step um of um building the tool before I outsource it. So for now it's on um uh local host but that's how it looks like and we can see um 18 is the wrong number. Claude didn't change it unfortunately but it's 10 for now. So uh we see that there is roughly 4,000 libraries that those 10 projects that are built in Schlesvstein by Schlesvolstein maintainers um 4,000 uh libraries that they're dependent on.

These are the projects here and uh for example uh let's open up foodsoft. Uh foodsoft is a software to support regional agricultural producers. Here it is. And we can see that of the 86 direct dependencies 55 I primarily maintained outside of the EU or IFA or UK region. Um we can see where direct uh dependencies are coming from. So the first top three libraries are actually coming the maintainers of uh those libraries are coming from the US, Canada and Japan. And if we want to fund uh the all the dependencies of this project, we would need to fund across six continents in 12 different currencies. Um let's go

for example to the quick keep project. This is a project for uh quality management of child care centers. Uh here we can see the same picture and that more than half of the direct dependencies are uh maintained outside of the um EU region. uh while the very the the biggest amount of libraries uh that they're dependent on are coming from Germany and then we can see top two, top three, top four are the uh US, Singapore and Ukraine. So picture yourself now as a public funer in our case she has Vikstein um you want to do the right thing you would want to fund the project and its dependencies because

now CRA gives you that visibility and uh to fund those dependencies it's not going to be just one separate transfer anymore. If we go uh to the overview, we will see here geography um that only the cohort of 2024 for that we need to fund six continents and we need to direct money in 33 currencies. So what can funer actually do and there's two paths. Path A is to push redistribution down to the top level maintainer. Maintainer is not going to do that. They are already buried in the workload AI slope. they they are burned out. So the financial coordination it's like a second job for them and they just

don't have time for that even if they want to play fair path B is to root it through a consultancy style intermediary probably it's even worse because we are sending public funds that meant to be for open source through actors with no open-source mandate of their own and that's the catch uh 22 that I'm talking about on this slide catch 22 is any impossible situation caused by conflicting rules or systemic failure. So in our case, the CRA puts the dependency tree as the mandatory one in front of the funer. The funer may even want to um support what they see, but the financial system that would have to bring money through currencies,

jurisdictions and borders is not built for it. So can we make it cheaper uh so that the fees are closer to zero rather than 5 8 10%. Can we make it faster moving at the speed of the internet, not at the speed of banking holidays and clearing cycles? Can we make it fairer so that not only the maintainer gets all the pie and also not the maintainer who is the one who is shouldering the cost of redistribution? We believe we can and we think we can do it with Ethereum.

So coming back to the research hypothesis, basically what I see is that if we use dependency graph and we are going to have it on the mandatory level within the EU um and we use properties of Ethereum such as transparency, programmability and intermediary minimization, we would achieve fair conditions for open source funding. So what is the current progress where I am now? Uh do I talk to governments or I'm just doing my research in a little room and do not talk to anyone? I do talk to governments. I do talk to so-called open-source program offices.

So those are typically open-source enablers um strategies. So basically they try to introduce more open source solutions um in their countries and um I started in the EU because we have a very strong digital sovereignty mandate here. And also another reason is because the EU has the most advanced and developed network of open-source program offices. So it was meant to be uh that I would start from here. Um we think that decentralized infrastructure sized piece of infrastructure such as Ethereum uh that doesn't belong to any single player is a natural fit for sovereignty and that's why we are coming with that uh sort of hypothesis. Um however general

feedback is positive. Uh the countries are open for conversation. They are very much interested in the ideas. However, we found a couple of blockers such as there is a bigger problem that exists that not enough actors fund open source. While open source program offices do exist in certain states, in certain governments, in certain cities, uh the major problem is that uh they do not fund open source yet. Um but we believe it's just a matter of time considering how um strong as I mentioned already the mandate of digital sovereignty is um in the territory of the EU and the second blocker is that uh current financial infrastructure doesn't allow us to send

public money fully on chain from a government to a maintainer and uh further onto dependencies but that's something that I know uh many defi treadf stable coin rails are working on at the moment. So while governments are not quite here yet, why not try to experiment with governmentbacked agencies and there is a pilot already that runs on Ethereum rails which I would like to discuss cover um in my presentation. So um I'll create a QR code here if you want to read the announcement of uh UNICEF but essentially um UNICEF is exploring sustainable funding uh for digital open

goods public goods and uh they're using blockchain for that. UNICEF is the only part of the UN family that can receive donations and make investments using digital assets and they're using drips um network on Ethereum um in the pilot focused on the new sustainable funding solutions for digital public goods. They cured five digital public goods, set splits and let the smart contract handle distribution. When a donor sends value to the address, it forwards it to five projects automatically. And I can even show you how it works because the drip list is just here. So basically whenever you send funds um to this address you can see how it all automatically splits

to 20% each. It looks it is set up specifically on purpose that it would go evenly to all five projects. However, drip supports dependency aware splitting down the tree. So basically you can wait the project deeper in the stack proportionally to how critical they are and uh yeah that already confirms that Ethereum rails together with dependency graph can actually work. So that's the that's the research uh that I'm doing to wrap up. Um please connect with me if you have heard your country is doing something about open source strategy. If you have connections

to your open-source program offices in your countries, that would be even better. I would really appreciate that. Uh, but if you've just heard that in the news, please connect with me. I would really love to hear from you. Also, if you work on stable coin rails, you talk to national banks, I would love to hear updates on how is it going at the moment. If you're a builder placing digital products on the EU market, please read the act. This is a side quest that I'm doing trying to spread the cyber resilience act awareness because I think it's quite important and um currently I'm in the active interview phase of um governments and governmental funds. So the first published results are going to be available at the UN open

source week at the end of June. So I assume I would be open it in public uh somewhere in July and uh you will find um all of the updates on my ex and you can also connect with me on telegram. I have a slide for that. But before we finish um governments if you can't stop us collaborate with us. Thank you very much. Thank you very much. [applause] Uh fellow meme enthusiasts as well. I'm I'm it's very encouraging to see that. Ladies and gentlemen, uh any questions for Sophia?

No. Anyone here from government? Oh, yes. >> You're you're not from government, but you've got a question. Yes. >> So, the the website you showed us, which splits the dependencies and kind of points to countries of each service, how would that look like if you were a product that used blockchain or a decentralized technology? Um you mean how the dependency graph is going to be spread? >> So this talks about currencies obviously maybe you might depend on like crypto payments or rails and then also if you're using a decentralized or distributed technology or service then obviously you can't point it to one country or can

>> to one currency. Yeah. So basically I would assume so I would assume that the governments would be interested in using eurobbacked stable coins in that um sense and then uh yeah basically a magic on chain is going to happen. So that's a part that I didn't come yet to. uh but I would I see that there is going to be stable coin rails in order to redistribute uh the money and uh yeah I as I said I assume that we would start with Eurobbacked stable coins because of yeah euro um and European Union but if we are looking into um redistributing the funds within the EU um however yeah I guess the answer would be stable coins basically

because that's the thing when I interview governments they always whenever I talk to them about Ethereum. They always imagine Ethereum as a coin, not as a network. And they uh typically lack the knowledge about that we have stable coin infrastructure and that now it is possible not to send money in a volatile currency like Ethereum. So, uh they're very pleased in answer and they're like, "Oh, that's actually sounds very interesting." No, I I don't know the answer to that question. Uh but um I'm so yeah, I mentioned drips. So um I assume they might have an answer to the question. So

we can connect and I can connect you further to the providers of the infrastructure that is going to build this project. >> Wonderful. Thank you very much. Any other questions? No. Right. Yes. Wonderful. >> Hello. Um, what seems to is it government that seems to be the best like the most promising source of funding because I guess there's like what's the source of the funding primarily and then there's how is the and then there's the distribution problem. Are you focused on both problems? And if you're focused on the sourcing, which is the most

promising? >> Um, sourcing as where money comes from for funding, right? That's because I can't hear you. Sorry. >> No worries. Um, >> yes, exactly. So I'm looking into uh as I mentioned there is a bigger problem where um I can see open source is just underfunded and that's something I'm trying to bring awareness with my topic as well um on that regard and uh I'm talking also to the governments that do not fund open source and they might be that for example with my research coming to them I'm too ahead of a curve um to too too early however um they already kind of like keep that in mind. So

whenever they would have an opportunity to fund open source um then um they will be using our solution. So yeah I work on kind of like the se second step of the problem. That's correct. >> Thank you. >> Thank you. And great Space Invaders t-shirt by the way. Big fan. Yes. Thank you very much for all the questions. Round of applause for Sophia. Again, if you want to catch her around the venue, please do so. Thank you. [music]