Who pays free crypto developers?
The Tor project, which enables anonymous surfing using encryption and numerous proxies, doesn't need the money of the CII, however. The project is financed mainly through larger donors; it gathered more than US$ 2 million in 2012, giving rise to suspicion: Although the project regularly publishes a report  listing sources of donations, they included various government organizations once again in 2012. Skeptics speculate that these offices are influencing the development work.
Even without the suspected backdoor, Tor is in the national interest of the US government, because it allows dissidents in authoritarian countries to communicate. The Tor project flatly denies the existence of a backdoor  and refers critics to the freely accessible source code for its software.
The Tor project's hosting costs are low because volunteers operate the network's computing nodes (relays; Figure 2); most of the money is spent on development, research, and marketing.
In Germany, projects actively need to seek support from authorities or governments and apply for appropriate tenders. In this way, the GnuPG project also received short-term financial support from Germany's BMI.
In some cases, companies also finance the complete development of a project. One prominent example of this is OpenVPN , which is backed by OpenVPN Technologies Inc. "Partners" generate revenue with support contracts and commercial VPN services. In such a model, however, the project depends on a single company, which alone decides which patches to accept and who reviews the software on its behalf.
To raise more money, the GnuPG project started a crowd-funding campaign on Goteo in 2014 (Figure 3) . This form of donation is only suitable for clearly defined objectives; the project wants to revise its website and fund new infrastructure with the funds raised. However, the developers first need to raise user awareness of the campaign and mobilize them. This requires massive work and advertising overhead. If the project hands out rewards depending on the amount of the donation, such as T-shirts, additional costs and other expenses arise.
Most projects are looking for one thing: more time for development. You can only get this if the dedicated developers have enough money to live on. As Werner Koch, the maintainer and creator of GnuPG, outlines in the interview, crowd funding does not typically provide permanent funding, and the figures for OpenSSL and GnuPG clearly show that donations alone cannot solve the problem in the long run.
Above all, projects in which the companies that benefit from the work employ the developers, or substantially finance the development work, seem to be successful.
As Marquess of the Open SSL project stated: "The ones who should be contributing real resources are the commercial companies and governments who use OpenSSL extensively and take it for granted.
- OpenSSL: http://www.openssl.org
- Heartbleed bug: http://en.wikipedia.org/wiki/Heartbleed
- GnuPG: https://www.gnupg.org
- Core Infrastructure Initiative on OpenSSL: http://www.linuxfoundation.org/news-media/announcements/2014/04/amazon-web-services-cisco-dell-facebook-fujitsu-google-ibm-intel
- Blog post on OpenSSL financing: http://veridicalsystems.com/blog/of-money-responsibility-and-pride/
- OpenSSH: http://www.openssh.com
- OpenSSH book: https://https.openbsd.org/cgi-bin/order?B09=1&B09%2b=Add
- PSW Group: https://www.psw-group.de/en
- OpenSSL consulting: http://opensslfoundation.com/what.html
- CII making progress: http://www.linuxfoundation.org/news-media/blogs/browse/2014/06/announcing-rapid-progress-core-infrastructure-initiative
- Tor financing: https://www.torproject.org/about/financials.html.en
- Tor Project on backdoors: https://www.torproject.org/docs/faq.html.en#Backdoor
- OpenVPN: http://openvpn.net
- Crowd funding for GnuPG: http://goteo.org/project/gnupg-new-website-and-infrastructure
Buy this article as PDF
Mozilla’s product think tank sinks silently into history.
TODO group will focus on open source tools in large-scale environments.
New tool will look like GParted but support a wider range of storage technologies.
New public key pinning feature will help prevent man-in-the-middle attacks.
Carnegie Mellon researchers say 3 million pages could fall down the phishing hole in the next year.
The US government rolls new best-practice rules for protecting SSH.
Klaus Knopper announces the latest version of his iconic Live Linux system.
All websites that use these popular CMS tools could be vulnerable to denial of service attacks if users don't install the updates.
According to a report, many potential victims of the Heartbleed attack have patched their systems, but few have cleaned up the crime scene to protect themselves from the effects of a previous intrusion.
DARPA and NICTA release the code for the ultra-secure microkernel system used in aerial drones.