alt Hacker NewsNobody pays for FOSS, we can force them to
Comments
He confuses developer adoption with cloud infrastructure maintenance, and he fundamentally misreads what software maintainers actually want.
The forking tax is great, and it requires a permissible checkpoint in the repo, which might not be available at all if you start correctly. Then the forks they use are quite literally "theirs", people don't trust hyperscalers.
Companies like redhat, jfrog, etc. have a model that is different to what one would want. They are built not on excellence but rather on taking the indemnity clauses on themselves. Hiring people to have 24/7 rotations and support, and all this Jazz and overhead that has nothing to do with being an expert at your thing.
Registry cron job paying thing...
Highly flawed and lacks fundamental understanding of the world, business, economics, and, more importantly, the actual drivers of the behaviour of the hyperscalers and business models of high-tech companies.
I'm not sure it fits the free and/or libre software philosophy but I'm a big fan of releasing otherwise free and open source software as a paid version and with some exclusive QoL features in proprietary store fronts.
For example Krita. https://krita.org/en/download/ FOSS but you can buy it on Steam, Microsoft Store, Epic Store, and Apple Store. You get one exclusive feature, automatic updates (and more recently Steam Cloud sync support), and you also support the developers (on the other hand Valve, MS, Epic, and Apple also gets a cut too).
If you read for example the Steam reviews everyone points out that it's a free software but buying on Steam is also a good and very importantly straightforward way to support the devs + the platform itself has such a pull ("buying games you never play") that people buy it just for the case of having it in their library
> Now, finally, I have an idea. It's gonna take 5000 words to get there, though, so if you don't have that kind of time, skip to the part about registries.
This article is full of LLMisms, which is to be expected but maybe it wouldn't be 5000 words and wouldn't need this disclaimer if they wrote it themselves
I feel like the main issue with projects switching between a permissive and less permissive license and back is that starting out as fully permissive in the first place was the main error.
If everybody would just agree to start their open source code as something like source-available or OpenRAIL -requiring companies with more than $5M in annual revenue to pay for the work - we wouldn't be in this situation.
Some pedantic points:
> Ruby Central, whose dependence on one big sponsor then produced the 2025 takeover
Ruby Central had two major sponsors at the time: Alpha Omega and Shopify. Also the events had much more to do with interpersonal conflicts than sponsors.
My report: https://rubycentral.org/news/rubygems-fracture-incident-repo...
That is the GitHub only portion, but the AWS root happened immediately after/during and has its own timeline https://rubycentral.org/news/rubygems-org-aws-root-access-ev...
> a depleted team
The named people we lost from the report: Sam was already way out the door. Andre was most of the way. Ellen wasn't doing that operational work. Deivid was only working on bundler and not the registry. Josef is the main operational loss, he removed himself. I'm unsure of which attack exactly Is being referenced, but Colby was promoted to full time (was planned before, just waiting on paperwork).
Other prior maintainers and security researchers did NOT leave. Maciej Mensfeld Was especially crucial. Jenny Shen. To name a few. These people are “the maintainers” too. We’ve (I’m a volunteer, came on in October 2025) brought on a number of in-kind engineers as well (companies donating engineer hours via letting employees work on company time).
I reached out to everyone unnamed that lost GitHub access. Of them, one asked for admin back (granted). None were active in operations.
Seldo’s overall point: about the fragility of all of this still stands. But I also believe the details and the nuance matter. I reached out to Laurie on bsky when this was first published but didn’t hear back.
I think I'm starting to forget, but could someone maybe tell me what the F in FOSS stands for?
Why would you write such an important article with AI? I can't share this with people I know because they will lose trust if I send them AI articles. It's really, very easy to tell because it's filled with AI rhetoric and you don't sound like this in your writing from 2020 and before
I think it's a great idea and I hope someone inside the teams of popular registries sees this and they actually give it a go. I imagine the shitstorm of reactions that it's gonna cause from people who aren't even included in the "required to pay" group and I wish the registry maintainers strength to get through this
One of the easiest ways to get paid for something is to to offer commercial support once something shifts to 'end of life' for community support. Can't get off of an old busted version - write a check for continued support! This sort of thing is reasonably easy to get through the accounting process.
Leaving a tip, paying for something free, trying to send money to a group that our infrastructure absolutely relies on - stupid hard. Commercial support, on the other hand, is very understandable to the bean counters.
> The evolutionarily stable strategy for a piece of software is "anybody may use this for anything, including commercially, for free." That's MIT, BSD, Apache, the licenses that ask for nothing. Every project that has tried to be a slightly less generous dove has lost to a project that stayed a full dove
Linux (GPLv2) seems like an obvious counterexample?
The reason I dislike this is because of the game it creates. Let's say we have someone who developed a small, well-used dependency (say: xz) but there is now incentive to be "in the dependency chain." xz is open, LLMs are really good at stealing/recreating; what stops someone from publishing rxz (maybe a rust port, maybe a gnu-r port, maybe it's "Really fast" xz, maybe it's just hoping for a typo in a registry.) This new dependency adds very little over the original xz and xz could have just used a simple PR.
On the other side of things, does accepting a PR from someone grant the author the ability to collect royalties for that software project? If so, how would you quantify that? LOC seems like a quick but really bad answer for what it is incentivizing.
For many, the entire point of "F" in "FOSS" is not getting tangled up in this kind of mess. I personally would never want to add "am I opening myself up to a lawsuit if I don't pay someone for their PR" to enter my calculus of accepting a PR. Especially if this is because I reject payment at all on a project.
Finally, if a company/employee submits code to FOSS under this model, do they now expect a return?
Nobody pays for free (& open source) software?
Great proposal Laurie! It'd be great if YC would set up an Open Source endowment also, with say 0.5% of their companies' stock (voluntarily) endowed to open source software.
Isn't this similar to the anaconda model? (Except they keep the money instead of distributing it.)
Depending on how you count, in my research group we are like 10 and in my whoooole university we are like 60.000 employees. When they went from free to restriced for big organizations I just uninstaled it.
Other than charity and donations, the only two ways of getting paid for developing FOSS are: 1) support contracts and 2) crowdfunding the next release.
Digital goods live in a post-scarsity situation. Applying the same business model as real life products is crazy and it's the reason why we have Adobe&Co.
I'm not convinced a problem is actually here. I certainly wouldn't believe LLMs, an optional tool, make any part of this fundamentally worse. Maybe superficially for people who can't adapt.
Hard pass, thanks. Just, don't expect to get paid for maintaining open source projects.
It's easy. Everyone knows the deal going in, and if somehow you missed that you're not going to get paid for this and you want out at any time -- you just stop.
If you made something of value someone else who cares enough will pick it up. Or it can languish and the earth will keep spinning. It's fine.
FOSS == Free Open Source Software, fyi.
The lions share of the packages used by company X should get the lions share of their subscription too. This is where music subscription has failed.
after reading Ford Foundation document [0] i'll go beyond and purpose FOSS not only limit commercial use but also forking [1] as it seems we have an endless stream of libraries which do the same thing, scattering even more this "fragile" ecosystem which would benefit so much of big tech's evergreen
[0] https://www.fordfoundation.org/learning/library/research-rep... [1] https://happort.org/constraining_freedom
how about making money from something else like hardware, to fund software (almost like IP is a fiction and people should be making money from tangible things rather than info)
I'm sure AI can also brainstorm more ideas for (F)OSS business models today
You seem to be forgetting the most important word in FOSS..
Honestly, the privilege and entitlement of some people. You made a thing, you did a lot of work, you gave it away for free. Nobody stole it from you. Nobody even asked you to make it. You created this situation yourself. And now you're upset that nobody paid you for the thing you make for free?
"But but but... companies are making money... off the thing... that I gave them for free!! How dare they!! There is no way I could have seen this coming!!" - Either you were ignorant and didn't realize people would sell the thing you gave away, or you knew about it and are now pretending to be outraged at the thing you knew was going to happen.
"But but but... they should pay me anyway, because they're profiting off my labor! It's what's fair!!" - What's fair is for someone to take you at your (and your software license's) word, to do exactly what you told them they could do (profit off it). What's not fair is to turn around after they're hooked on your free thing, and try to force them to pay you for it, after the fact.
The point of open source is only to open up the source code, allow people to contribute, collaborate, and share. If you want to get paid for it too, don't put an open source license on it. It's that simple. Add whatever terms you want. But don't make FOSS and then later say it's unfair for people to do exactly what your license said they could do.
“we can force them to pay for free”
Change the GPL and make the GPL only apply to NATURAL HUMANS and NOT CORPORATE HUMANS.
If the corporates want to use it, they can make a licensing agreement and put money into a trust of all who support it.
They don't want to pay? Too fucking bad.
[flagged]
The usual pushback I get from FOSS zealots is that any time I mention things like money, popularity, increasing adoption etc. they just say none of that matters because it's "not a project goal."
In fact, often they don't even want money to be a thing at all, they think capitalism is inherently evil (cough innovation) and would prefer if everyone was just poor and lived in the woods or something.
Sorry... I like the world to be a little more interesting than that.
If you want people to pay you for your software, stop writing it for free. Conversely, if you write it for free, don't expect people to pay you for it. Otherwise you are no better than someone at an intersection with a bottle of Windex and a squeegee who, unsolicited, cleans a windshield and then demands the driver to pay for it.
The original authors of Free Software and open source were career academics and others who were paid to do other things, or were sponsored by scientific and defense research grants. I don't know how anyone got the nutty idea that you could make money on FOSS itself. Practically every time someone has tried to make money on FOSS it has failed.
(Edit: this comment previously ended with "...from Netscape on down.")