Re: Common Good Cyber Fund Grant Program for Debian

On Wed, Jul 22, 2026 at 06:42:31PM +0200, Hector Oron wrote:
> Hello Adrian,
> 
> El mié, 22 jul 2026 a las 13:21, Adrian Bunk (<[email protected]>) escribió:
> 
> > The first problem would be the requirement "that the applicant is a
> > qualifying nonprofit organization", which is the old issue that Debian
> > is not a legal entity.
> >
> > Perhaps SPI might be sufficient.
> 
> Yes, SPI qualifies.
> 
> > > (since all of it would require
> > > financial control and lots of paperwork)?
> >
> > This is the longstanding problem that a non-profit project of our size
> > and asking for donations should really have a proper budget process and
> > annual financial reports on our website.
> 
> That should be covered by SPI, the non-profit, Debian is associated project.

What about money in other TOs?

Is "A current operational budget" something Debian has?

> > The program you are linking to would be one person paid full-time for
> > two years, and then there would have to be both a suitable project
> > planned, and confidence that paying money there won't have a negative
> > impact on the unpaid volunteers working in that area.
> >
> > A project that might fit the last bullet point of Objective 1 in this
> > grant would be to make our own infrastructure more resilient, two years
> > wouldn't be too much for designing, discussing and implementing improvements.
> >
> > But such a project would have to be properly planned before applying.
> > And it would need someone available with the required skills in
> > security and AI.
> 
> When reading your email about "security team burnout", I thought this
> fund could be an option to mitigate such concern, however, how could
> make it fit and work for the project? Would it be valuable?

The general problem with such grants is that they are for additional 
features[1] - this is temporary funding of additional work, not 
long-term funding of everyday work.

> Regards

cu
Adrian

[1] with a very loose definition of "features",
    e.g. new hardware might get funded