60% of Open Source Devs Work for Free — Now One Guy Wants Big Tech to Pay Up
60% of Open Source Devs Work for Free — Now One Guy Wants Big Tech to Pay UpThe people building the software that runs the entire internet are getting paid less than McDonald’s workers. And someone finally said it out loud.
97% of commercial software uses open source dependencies. The seven biggest tech companies — worth $7.7 TRILLION combined — donated a grand total of $12.5 million to fund it. That works out to 16 cents per $100K of their income.
Steven J. Vaughan-Nichols, a tech reporter who’s been covering this beat since before most of us were born, just published an opinion piece in The Register that basically says: screw the tip jar, it’s time to send invoices.
🧩 Dumb Mode Dictionary
| Term | What It Actually Means |
|---|---|
| Open source | Software where the code is public and anyone can use, modify, or share it — for free |
| Maintainer | The person (usually unpaid) who keeps an open source project alive, fixes bugs, and reviews contributions |
| Package registry | A big online library where developers download code packages (think: npm, PyPI, Maven) — the plumbing of modern software |
| Dependency | A piece of someone else’s code that your app needs to work — like ingredients in a recipe you didn’t write |
| Post-Open licensing | Bruce Perens’ new idea: keep code free for individuals, but charge companies over $5M revenue a small fee |
| Bug bounty | A reward program where companies pay hackers to find security bugs — except now AI is flooding them with garbage |
📖 The Backstory: How Did We Get Here?
Open source started as an idealistic movement. Share the code, improve the world, right?
And it worked. Like, absurdly well. Open source now powers basically everything — your phone, your bank, your car, the servers running every social media platform. But the people who built and maintain this stuff? They got the short end of every possible stick.
- 60% of open source maintainers are completely unpaid (2024 Tidelift report)
- Of the ones who DO get paid, only 26% earn more than $1,000/year for their work
- 60% have quit or considered quitting due to burnout
That’s not a funding model. That’s exploitation with extra steps.
📊 The Numbers That Should Make You Angry
| Stat | Number |
|---|---|
| Commercial software using open source deps | 97% |
| Open source maintainers who are unpaid | 60% |
| Maintainers earning >$1K/year (of those paid) | 26% |
| Maintainers who quit or considered quitting | 60% |
| Combined market cap of top 7 donors | $7.7 trillion |
| Total donated to Linux Foundation/OpenSSF/Alpha-Omega | $12.5 million |
| Maven Central traffic from top 1% of IPs | 82% |
| Maven Central traffic from large cloud providers | ~80% |
| Open source components with no maintenance in 2 years | 91% |
That last one is wild. 91% of the open source code running inside commercial products showed no signs of active maintenance in the past two years. We’re all standing on abandoned buildings and pretending the floors are solid.
😤 The cURL Incident
Daniel Stenberg — the creator and maintainer of cURL, which is installed on literally billions of devices — had to shut down cURL’s bug bounty program.
Why? Because AI-generated submissions flooded it with garbage. Only about 5% of bug bounty submissions were genuine vulnerabilities, according to OpenSSF. The rest were AI slop — and Stenberg said dealing with them was threatening maintainers’ “survival and intact mental health.”
Think about that. The guy who maintains one of the most critical tools on the internet had to close the door on security reports because the noise was killing him. And he’s one of the lucky ones who actually gets some funding.
🗣️ What Vaughan-Nichols Is Actually Proposing
The core argument is pretty simple: stop treating open source funding like a charity and start treating it like a business cost.
His pitch:
- Package registries (npm, Maven, PyPI) handle trillions of downloads per year
- About 80% of that traffic comes from the biggest cloud providers
- Charge those companies for registry access — not for the code itself, which stays free
- Create a new organization that routes those payments directly to maintainers
He points to two orgs already doing something similar:
- HeroDevs — runs a $20M Open Source Sustainability Fund paying maintainers of critical end-of-life components
- Sentry — maps its entire dependency tree and literally cuts checks to the people maintaining each package (one of the only companies that actually does this)
But those are voluntary. Vaughan-Nichols wants something mandatory. Not optional charity — a cost of doing business.
🔮 Bruce Perens' Post-Open License
Bruce Perens — the guy who literally wrote the Open Source Definition back in 1997 — has his own proposal called Post-Open licensing.
The idea:
- Individuals and small companies (under $5M revenue): Free. Same as always.
- Big companies (over $5M revenue): Pay a small percentage, ramping up to 1% of revenue
- Payments go through a non-profit that distributes to developers
He envisions a not-for-profit corporation that also provides user support, documentation, hardware-based authentication for developers, and even help with government compliance.
The catch? Some people argue the moment you restrict commercial use, it stops being “open source” and becomes “source-available.” And enterprises will treat it accordingly — avoid it, fork the last free version, or just use the MIT-licensed release forever.
It’s a real tension. But doing nothing isn’t working either.
💬 What People Are Actually Saying
The Slashdot and Hacker News threads on this one went exactly how you’d expect — passionate, polarized, and occasionally brilliant:
- The realist take: “The moment a license is commercial-use-restricted, it’s not open source. Enterprises will fork it before the license change or just use the last MIT-licensed version forever.”
- The corporate take: “Large companies want a throat to choke. The moment they pay an ongoing contract, it becomes a financial and strategic decision — vendor management, risk analysis, tech downselection.”
- The maintainer take: “You can’t live off one-off charity donations. Depending on what people put in a tip jar is no way to fund anything of value.”
The fundamental problem everyone agrees on: the status quo is broken. Nobody agrees on what replaces it.
Cool. The People Building the Internet Are Working for Free. Now What the Hell Do We Do? ಠ_ಠ
💼 Hustle 1: Open Source Dependency Auditing as a Service
Companies have no idea what open source they’re running or who maintains it. That’s a compliance nightmare — and your opportunity.
Map dependency trees, flag abandoned packages, identify license risks, and charge companies $2K-$10K per audit. Tools like Snyk, FOSSA, and Trivy do parts of this, but most mid-size companies need a human to explain it to their legal team.
Example: A freelance DevSecOps consultant in Lisbon, Portugal started offering “open source health checks” to fintech startups using a combination of Trivy scans and manual review. She charges €3,000 per engagement and does two per month alongside her day job.
Timeline: First client within 2-3 weeks if you already have DevOps experience and a LinkedIn presence in tech
📝 Hustle 2: Paid Open Source Maintenance Contracts
If you maintain an open source package — even a small one — you can offer paid support contracts directly to companies using it. Tidelift already does this as a marketplace, but you can also do it independently.
Put a FUNDING.yml in your repo, set up GitHub Sponsors, and directly reach out to companies in your download logs. Even a package with 10K weekly downloads has commercial users who’d pay $500/month for guaranteed response times.
Example: A developer in Kraków, Poland maintained a niche Python data validation library. He noticed a Fortune 500 company in his download stats, cold-emailed their engineering lead, and signed a $1,200/month support contract within two weeks.
🛡️ Hustle 3: AI Bug Report Triage Service
With 95% of bug bounty submissions now being AI-generated garbage, maintainers are drowning. Offer to be the filter.
Set up as a third-party triage service: you review incoming vulnerability reports for open source projects, separate real bugs from AI slop, and give maintainers a clean queue. Charge per project or per month.
Example: A security researcher in São Paulo, Brazil pitched a $800/month triage service to three mid-size open source projects after reading about cURL’s bug bounty shutdown. Two signed up within a month. He spends about 10 hours/week filtering submissions.
📊 Hustle 4: Open Source Compliance Consulting for EU Companies
The EU’s Cyber Resilience Act (CRA) is making open source compliance mandatory for products sold in Europe. Most companies have zero idea how to handle this. Be the person who explains it.
Focus on small-to-mid European companies shipping software with open source components. They need SBOM (Software Bill of Materials) generation, license auditing, and CRA compliance documentation.
Example: A former sysadmin in Rotterdam, Netherlands got CRA-certified through a Linux Foundation course, then started consulting for Dutch IoT startups at €150/hour. She books about 20 hours/month, all through word-of-mouth referrals in local tech meetups.
🛠️ Follow-Up Actions
| Step | Action |
|---|---|
| 1 | Run npm ls or pip list on your own projects — see how deep your dependency tree goes |
| 2 | Check Tidelift and GitHub Sponsors for maintainer funding options |
| 3 | Read the Post-Open Zero Cost License draft from Bruce Perens |
| 4 | Look at HeroDevs if you maintain end-of-life packages |
| 5 | Search your package download stats for corporate IP ranges — those are your potential paying customers |
Quick Hits
| You Want To… | Do This |
|---|---|
 Check if your project has abandoned deps |
Run npm audit or use Trivy/Snyk to scan your dependency tree |
| Get paid for your open source work |
List on Tidelift, set up GitHub Sponsors, or cold-email your corporate users |
 Understand the Post-Open debate |
Read Perens’ draft license and the FOSS Force analysis of it |
 Protect your projects from AI spam |
Implement structured bug report templates and require reproducible PoCs |
 Start an SBOM compliance side gig |
Take the Linux Foundation’s CRA course and target European SaaS companies |
The entire internet runs on code maintained by people who earn less than a Starbucks barista. Maybe it’s time we stopped pretending that’s fine.
!