Filippo Valsorda

Filippo Valsorda is an Italian cryptography engineer and open-source maintainer best known for maintaining the Go cryptography standard library and for creating the tools age and mkcert. Since 2022 he has worked as an independent, professional open-source maintainer, and in 2024 he founded Geomys, a small firm of maintainers paid on retainer by the companies that depend on their code.

Valsorda attended the Recurse Center and worked on the cryptography team at Cloudflare. He became widely known in 2014 for his web tool that let anyone test a server for the Heartbleed OpenSSL bug. He joined Google in 2018, where he led the Go Security team, worked on the design of the Go Checksum Database and TLS 1.3 in Go, and became a maintainer of Go's crypto packages.

In May 2022 he left Google to test a different way of funding open source: instead of donations or support contracts, he sold retainers that give companies professional maintenance of critical dependencies plus direct access to his expertise. By February 2023 he had six clients, including Tailscale, Protocol Labs, Latacora, Smallstep, the Interchain Foundation and Glasklar Teknik, and wrote that he was earning the equivalent of his Google total compensation.

In July 2024 he turned the experiment into Geomys, bringing in Nicola Murino, maintainer of Go's SSH package, and Dominik Honnef, maintainer of Staticcheck and Gotraceui, as associate maintainers, plus an administrative director. Clients pay a fixed monthly retainer for the whole portfolio, which includes Go's crypto packages, the FIPS 140-3 Go Cryptographic Module, x/crypto/ssh, Staticcheck, bluemonday, age and mkcert. Geomys also sells commercial FIPS 140-3 services.

Valsorda matters because he turned open-source maintenance into a real, well-paid profession without venture capital or a paid fork, and he publishes the model so other maintainers can copy it.