// HACKER NEWS — CYBERSECURITY
Nobody pays for FOSS, we can force them to
The first time I thought it would be a good idea to write a blog post about the economics of open source was 2013, so this post has been in the works a while. The closest I got before today was 2022, when I wrote a stream-of-consciousness rant into my iOS notes that ended with basically "nothing fucking works". And then that sat there for 4 more years, because "nothing works" is too depressing to bother writing 5000 words about. Now, finally, I have an idea. It's gonna take 5000 words to get there, though, so if you don't have that kind of time, skip to the part about registries.
I've written before about hawks and doves, which is a model from evolutionary biology. You have a population of animals competing for some resource. Some of them fight for it (hawks) and some of them share it (doves). A population that is all hawks is unstable: everybody's constantly getting hurt, and the first two doves to show up cooperate with each other and out-compete everyone. A population that is all doves is unstable too: the first hawk to show up competes with everybody and wins every time. What's stable is a mixture of both types, in proportions such that changing your behaviour doesn't help you, so nobody does. That mix is called an evolutionarily stable strategy, or ESS, and the important word is "stable." It's not the best strategy (arguably that's all doves, where nobody gets hurt), it's just the one the population ends up at and can't leave. I find it a useful way of thinking about software, because software has hawks and doves too.
Closed source is the hawk. It competes: it withholds the code, charges a premium for having something nobody else has, and fights to keep it that way. Open source is the dove. It cooperates: it gives the code away and takes the gains from everybody else giving theirs away too. The resource they're competing over is money, ultimately, though it shows up first as users and as developer attention.
The equilibrium we've landed on is very specific. The evolutionarily stable strategy for a piece of software is "anybody may use this for anything, including commercially, for free." That's MIT, BSD, Apache, the licenses that ask for nothing. Every project that has tried to be a slightly less generous dove has lost to a project that stayed a full dove, and I can give you a lot of examples:
Nobody who has tried to charge for open source at the license level has held the line against a competently run fork, and I don't think that's because of ideology. The people running those companies would love to charge for their code, and most of the people forking it don't care much about freedom in the abstract. It's because of the structure of the market. Disruption, in the original sense, is when a much worse and much cheaper product takes over the bottom of the market, then gets gradually better until it's eaten the whole thing, and there's nothing to stop that process repeating until the product costs nothing at all. Software has been getting disrupted like this for as long as there has been software, and what you end up with is a market with two halves: an enormous cheap half that nearly everybody uses, and a much smaller expensive half that makes nearly all of the money. Android has the market share and iOS has the profits, and they are both gigantic successes depending on which number you're looking at. Free wins share and closed wins profit, and both of them win.
So far this is fine. Free software wins, closed software makes money, everybody has a niche. The problem is what the free layer looks like from the inside.
Sixty percent of open source maintainers are not paid for the work. That's from Tidelift's 2024 survey, and it's the same number they got in 2023, and the same number they got in 2021. Of the unpaid ones, 61% work alone. Nearly 60% of all maintainers have quit or thought about quitting, and the reasons they give are the ones you'd guess: they have a life, they lost interest, they burned out.
The amount