Tiffany Farriss Says Public-Sector Budgets Should Fund Open Source Maintenance

Public institutions should make open-source maintenance a planned procurement cost, Tiffany Farriss, interim CEO of the Drupal Association, told The DropTimes in written responses following UN Open Source Week 2026.

Her proposal goes beyond asking organisations to donate to the software they use. Tiffany argues that users, vendors and open-source communities need shared sustainability standards covering maintenance funding, contributions back to projects and responsible vendor participation. Procurement teams could then translate those expectations into contract language.

The Drupal Association announced Tiffany's appointment as interim CEO on 15 July 2026, saying she would focus on strengthening its financial and operational foundation during an expected six to 12-month tenure. The DropTimes sent the questions following her UN Open Source Week participation and her work on open-source sustainability and governance.

UN Open Source Week ran from 22–26 June 2026 at United Nations Headquarters in New York. At a Sovereign Tech Agency breakfast reception on 23 June, Tiffany gave one of three short talks on “Strengthening Digital Infrastructure: Sustaining Open Source for the Public Good.” The event organisers identified her there as CEO of Palantir.net and a longtime Drupal Association board member.

Palantir.net published “Freedom is Not Free: A Model for Open Source Sustainability” as an adaptation of that presentation. The piece argues that public institutions need a structured way to pay for the technical and human infrastructure surrounding open-source software, with maintenance treated as an operating expense rather than charitable support.

Asked what would need to change in public procurement, the formal process through which public bodies purchase goods and services, Tiffany said, “Right now there is no standard for what open source sustainability requires of users (or those who implement it).”

She proposed a cross-project standard for responsible open-source use and implementation. Her written response identified giving code back, paying for maintenance at a set rate and selecting vendors involved in the relevant open-source ecosystem as possible requirements. Once such a standard exists, she said, it could provide a basis for procurement language and expectations.

That does not mean public-sector open-source procurement lacks guidance altogether. The Open Source Observatory provides guidance on the use, maintenance and procurement of open-source software by public administrations, while OpenChain ISO/IEC 5230 defines requirements for open-source licence compliance programmes. Tiffany is calling for a different layer: a cross-project sustainability standard that sets common expectations around upstream funding, contribution and responsible vendor participation.

Asked which costs remain most invisible to institutions using open source, Tiffany answered, “All of them. In open source, we often conflate free as in speech and free as in beer. Code is and always will be free.”

She argued that producing more code can reduce the cost associated with creating the code itself, but does not eliminate the infrastructure or human work required to maintain an open-source project. As those systems modernise, she said, projects take on operational costs that continue to scale. Those costs can include security work, release systems, continuous integration, update distribution and coordination.

You May Like

Blog

Drupal Usage in Top Universities Worldwide: A Progress Report and Seeking Support

Blog

Drupal Usage in Top Universities Worldwide: A Progress Report and Seeking Support

The Drupal Association's 2025 financial overview, published on 4 August 2026, gives that argument concrete Drupal context. It reported that spending on Drupal.org, including its website, Composer endpoints, GitLab, continuous integration, authentication and global content delivery network, rose from $1.3 million in 2022 to $2.1 million in 2025. The Association said Drupal.org had become its largest single cost without a direct funding mechanism.

Formal sustainability standards can create a different problem if compliance becomes easier for large organisations to demonstrate than meaningful participation. “The largest vendors are often the worst open source participants, but they are very good at demonstrating compliance with established standards,” Tiffany said.

She said the open-source community needs to establish a sustainable participation standard in partnership with businesses and end users. On how those expectations should apply across organisations of different sizes and locations, Tiffany added:

Whatever the standards become, they should be proportional to the size of the vendor and the global cost index in order to be inclusive geographically and encourage diverse ecosystem participation.

Tiffany did not identify a specific global cost index or formula for making those adjustments.

Drupal's contribution credit system can record forms of participation beyond code, including through manual credit. Asked specifically about governance, mentoring, documentation, security coordination and community mediation, Tiffany said, “It can be onerous to use the contribution credit system for this now, but it does allow it to be captured manually, which is better than any other system I’m aware of.”

Funding was not the only sustainability issue she addressed during UN Open Source Week. At the Sovereign Tech Agency's Maintain-a-thon 2.0, Tiffany led the session “Governance at Scale: What Actually Travels.” The published session description argued that governance structures rarely transplant cleanly from one project to another and that what can travel is the capacity to understand a project's context before its governance fails.

Asked what Drupal had learned about governance that other open-source communities or public institutions could reuse, Tiffany began with a short answer: “That context matters.” She then explained why:

Governance fails occur not because we chose the wrong model or practices, but because we didn’t regularly evaluate whether those practices still fit us. The project changed. The governance didn't.

Tiffany said effective governance depends on developing the capacity to read a situation clearly and tending existing structures by asking the necessary questions before the answers are required. She described the aim as acting before a crisis or “kerfuffle” forces those questions onto the community.

Her view of digital sovereignty follows the same logic. Asked whether open-source governance and maintainer sustainability should be treated as part of sovereignty alongside hosting, software choice and data control, Tiffany answered, “Absolutely.”

The DropTimes also asked what first step a public-sector Drupal user could take within one year to become a better open-source participant. Tiffany's response was equally brief: “Become a Drupal Certified Partner.”

The Drupal Certified Partner programme is designed primarily for Drupal service providers that demonstrate contribution to the project. Its current qualification requirements include weighted contribution credits, a Drupal case study and an annual participation fee that varies by organisation size, with possible regional adjustments. A public institution that uses Drupal would not automatically fall into that service-provider category, and Tiffany did not elaborate on how a government body outside it should translate her recommendation.

Tiffany owns Palantir.net, which is a Drupal Certified Partner. After becoming interim CEO of the Drupal Association, she stepped back from day-to-day operations at Palantir.net as of 20 July 2026 and is operating under a conflict-of-interest framework during her interim tenure.

Tiffany's final response returned to public procurement. Asked what governments, Open Source Program Offices, funders and open-source communities could do together before the next UN Open Source Week, she proposed making upstream maintenance an explicit project expense.

Agree on procurement language that requires an open source maintainer line item where a % of the project budget is allocated to upstream project contributions - patches, maintainers, the not-for-profit foundations that support the projects used.

A line item is a separate, named expense in a project budget or contract. In this case, it would reserve a stated share of project spending for upstream work, meaning work returned to the original open-source projects and organisations responsible for maintaining them. Tiffany did not specify what percentage should be allocated.

The approach would move upstream support into financial planning before a contract is awarded instead of leaving it as voluntary spending after implementation. In the Palantir.net adaptation of her UN Open Source Week presentation, Tiffany similarly described an explicit open-source maintenance entry in contracts as a way to recover maintenance costs from institutions using the software.

In a 21 July 2026 Drupal Association blog post, Tiffany returned publicly to several of the same funding questions after taking up the interim CEO role. She said large enterprises and governments relying on Drupal had lacked a clear mechanism for understanding or paying for the maintenance and services they use, and identified collaboration with other open-source projects on a shared standard for sustainable use as one of her priorities.

The Association's August financial overview later reported that Drupal.org's rising costs had no dedicated funding mechanism and that donated or in-kind services were covering a growing share of the infrastructure bill. Tiffany's procurement proposal addresses the same underlying problem at an earlier point in the spending process: making the cost of sustaining open source visible when institutions budget for the systems that depend on it.