播客节目《Green Squares》第214期邀请开源库libcapstan的主要维护者Erin Marsh接受访谈，讨论当前开源基础设施面临的挑战。
libcapstan是一个关键基础设施项目，月均下载量达8000万次，被40000个包依赖[1]。Erin自2019年因报告bug获得commit权限后逐渐接管了整个项目[1]。
作为项目的唯一维护者，Erin面临AI Agent贡献的困扰。她每周收到约60个AI Agent提交的pull request，但其中仅有3个在全年被证明有用处[1]。与此同时，安全维护工作量巨大——每月约收到10份安全报告，其中仅约1/15描述真实问题[1]。她曾尝试利用AI辅助验证漏洞，但账户随后被供应商禁用[1]。
项目的经济状况同样困难。2022年有第三方基于libcapstan发起CapstanCoin，该币种约有200万美元流通，但Erin未从中获得任何收益[1]。去年她申请资金支持被拒，拒绝理由是她缺乏标准过程参与经验——这一障碍源于Firefox兼容性问题导致她无法参加视频会议[1]。
与此同时，竞争性项目的崛起加剧了困境。capstan-rs项目在一个月内获得4万个star，相当于libcapstan关注度的10倍，其作者随后被OpenClaw公司招聘[1]。讽刺的是，OpenClaw公司的clean-room实现复制了libcapstan 2021年以来的一个bug[1]。
Erin Marsh, the sole maintainer of libcapstan—a critical infrastructure library downloaded 80 million times monthly and depended upon by 40,000 packages—shared insights into the modern challenges of open source maintenance during an episode of the Green Squares podcast hosted by Tyler [1].
Marsh assumed control of the project after receiving commit access in 2019 following a bug report [1]. She described an overwhelming influx of AI-generated contributions, receiving approximately 60 pull requests per week from AI agents, though only about 3 proved useful over an entire year [1].
Security vulnerabilities present another significant burden, with Marsh reporting roughly 10 security reports submitted monthly, though only about one in 15 describes an actual problem [1]. She attempted to leverage AI for vulnerability verification but had her account suspended by the vendor [1].
The project has faced financial pressures. In 2022, an individual launched CapstanCoin based on libcapstan, circulating approximately $2 million in value, yet Marsh received no financial benefit from the initiative [1]. A grant application she submitted last year was rejected, with the lack of experience participating in standard processes cited as the reason—a barrier created when Firefox compatibility issues prevented her attendance at required video conferences [1].
Notably, a rival project called capstan-rs gained 40,000 stars within one month, approximately 10 times the adoption rate of libcapstan [1]. OpenClaw, a company, subsequently recruited the capstan-rs author, and their clean-room implementation replicated a bug that had existed in libcapstan since 2021 [1].