tidelift

[UziTech]

I am looking into ways to get some funding for marked to be able to complete some of the harder tasks (like becoming spec compliant).

I thought I would open this issue for @phated to explain more about how tidelift would work with a team of maintainers.

A couple questions that I have:

• How is Tidelift different from a bug bounty program?
• What is expected of the maintainers on a regular basis?
• Where does the money come from? and where does the money go (with respect to multiple maintainers)?

[phated]

1. Tidelift doesn't have you fix bugs. Currently, they only have you complete the list of tasks at https://tidelift.com/about/lifter-tasks
2. Mostly that the project stays maintains, and all the tasks be completed. If new tasks are added or old ones re-open, they let you know.
3. The money comes from Tidelift, and the core maintainers that want to sign up can decide as a team how the money is split. It goes to your personal accounts, unless there is an organization backing you.

I also wanted to note that the income fluctuates based on subscriber usage. Last month, marked had income, and this month it doesn't.

[styfle]

Thanks!

I took a look at the "lifter tasks" and I think most of the tasks are done and some we will need to do once we're signed up.

• Create a coordinated disclosure plan: https://github.com/markedjs/marked/security/policy
• Set up two-factor authentication: my account is already using 2FA on GitHub and npm
• Security maintenance plan: TODO https://github.com/markedjs/marked/security/policy
• Add release notes: we use GitHub Releases
• Versioning scheme: currently only the latest version receives updates
• Resolve issues affecting subscribers: I dont see any specific issues in tidelift yet
• Resolve license conflicts: https://github.com/markedjs/marked/blob/master/LICENSE.md
• Verify license: MIT https://github.com/markedjs/marked/blob/master/LICENSE.md
• Marketing the Tidelift Subscription to your users: TODO
• Commitment: TODO
• Discuss income with the whole project: TODO

[styfle]

This is a great feature 💯

[UziTech]

Thanks @phated. I think it would be nice to use the money for something like https://issuehunt.io/ to get more interest on certain issues.

[phated]

@UziTech Tidelift income must go to an individual or company owned by one of the maintainers. It is 1099 income and the person receiving it would need to pay taxes on the money. You could spend the money on issuehunt after that though.

[UziTech]

@phated that is what I meant. Create a company account then use the post-tax money to get issues fixed.

[phated]

@UziTech That makes sense. I noticed @styfle signed up for Tidelift too. Are you both looking to sign the Lifter Agreement?

[styfle]

I assumed that all the maintainers needed to create Tidelift accounts? Is the Tidelift account different than the Lifter Agreement?

[phated]

Sorry, I forgot to link to the agreement: https://docs.tidelift.com/article/57-lifter-agreement

It is a legal agreement that sets up each "lifter" as a subcontractor to Tidelift.

[joshbruce]

Seems interesting. To stretch the conversation a bit - potentially. Why Tidelift compared to something like GitHub Sponsors?

MarkedJS as an organization can be tied to a company. The sponsors YML file can be set in such a way to allow users to contribute to the org or the individual maintainers...or any name we throw in there. (I remember skirting this conversation before and the concern was partly reimbursing contributors.)

For example, this project where someone can back me specifically, 8fold, or both: https://github.com/8fold/php-shoop

This would avoid the overhead of being 1099s with TideLift (unless I missed something in the GitHub agreement on that score) - though I'm not strictly opposed - again stretching the conversation.

ps. still catching up on information - been in developer land for a bit.

[phated]

@joshbruce Yeah, you missed the fine-print with GH Sponsors—they will be sending you a 1099 if you make more than 600 in a year.

Just wanted to give y'all a heads up that I've moved on from Tidelift, so you'll probably need to touch base with the rest of the team that is still around.

Cheers. 🍻

[joshbruce]

Thanks for the tip on the 1099 @phated - much appreciated. Hopefully this isn't off-base, but wish you well on the next adventure!