Stewarded open source is not enough: who can cut you off?

Dries Buytaert wrote a good post this week: License-only versus Stewarded Open Source. His point: the license tells you nothing about what kind of project you’re depending on. A weekend hobby project and business-critical infrastructure can ship under the exact same license. What separates them is stewardship: maintainers reviewing contributions, fixing bugs, responding to security issues, managing releases. The license makes code available; stewardship makes it dependable. He’s right, and the vocabulary is useful. But there’s a third distinction hiding underneath it, and I’d argue it’s the more dangerous one to get wrong: stewardship tells you whether someone cares for the code. It does not tell you whether that same someone can cut you off from it. The most stewarded project in the world Here’s the uncomfortable case for Dries’s framework: WordPress. By his definition, WordPress is about as stewarded as open source gets. Full-time maintainers, a security team, release management,…