Top stories

Being able to fork your own version is a desirable goal and by design. The original author can and will probably not want to take his project in all kind of imaginable directions.

That is "source available", that is a fine decition if you like it. Just don't call it FOSS.

https://store.steampowered.com/app/280680/Krita

I'm not sure it fits the free and/or libre software philosophy but I'm a big fan of releasing otherwise free and open source software as a paid version and with some exclusive QoL features in proprietary store fronts.

For example Krita. https://krita.org/en/download/ FOSS but you can buy it on Steam, Microsoft Store, Epic Store, and Apple Store. You get one exclusive feature, automatic updates (and more recently Steam Cloud sync support), and you also support the developers (on the other hand Valve, MS, Epic, and Apple also gets a cut too).

If you read for example the Steam reviews everyone points out that it's a free software but buying on Steam is also a good and very importantly straightforward way to support the devs + the platform itself has such a pull ("buying games you never play") that people buy it just for the case of having it in their library

Filebot used to be open source. I bought it on the AppStore, it was a way to support development and I figured it would give me easier updates that would just happen in the background.

When Apple moved to ARM, the App Store version lagged behind. An ARM version was available, but not in the App Store. I assume this is because that ARM version was a separate download instead of being a universal app, and the x86 app would run on everything (for now).

The app is no longer open source, and is paid. To get the ARM version (due to my stubbornness in not wanting to install Rosetta), I had to pay again just to get the app through a different means of distribution.

Too many run-ins with silly issues like this can really sour a person on the “free app in a paid store” model.

That can happen regardless of which storefront you use to buy a free app. It's more of a developer-specific nitpick than a chronic problem with FOSS and freeware.

If you're happy to sponsor the app's development, then owning the App Store version should make you feel proud. The developer is still able to make a living thanks to you, and they're offering extended support if you're unwilling to use a fork of the free version. A good example of this is Dwarf Fortress, which I have bought on Steam 3 times now so that I could gift it to two of my friends. God willing, nothing will prevent me from buying a 4th and 5th copy when Christmas rolls around.

Sounds like the problem is the app later became nonfree.

Not a very effective way to support the devs though: only about 60% of what you pay gets to the developers, because of Steam's cut and VAT.

Yet by the active unique user numbers they have estimated sold at least ~168k copies and maybe upwards ~500k https://steamdb.info/app/280680/charts/ And that's Steam alone. I'd be really curious compared to this how many people click on the Donate button on the Krita homepage.

That's a lot of purchases imo for a project like this. I'm kind of ambivalent about the store cuts but they give a huge enough exposure to any game or software.

https://github.com/utmapp/UTM

UTM is another great example of this, which is basically a GUI for QEMU. They have a Mac App store $9.99 version and the free open source version:

The free software philosophy aside, I feel like another problem is that once you start accepting payments then you start accepting various forms of responsibility/liability/accountability/etc. along with it. At a high enough price it'd become worth it, but that might not be anywhere near the price that your customers/users want to support you at.

Maybe but lots of $2 apps exist from random devs who don't take much responsibility.

Free open source -> compile it yourself

Affordable binaries and SASS are fine options that I’d like to see

I think I have donated more for Inkscape, Gimp, Firefox, and Libre Office than I ever spent on proprietary software. I also tend to buy paid versions of open-source apps in app stores, where available. It's great when a piece of open-source software has an easy donation link / button.

That said, I tend to trust all closed-source software significantly less, even if it's given away for free. Especially is it's given away for free.

Without knowing how much you've paid for proprietary software, that could be a lot, or a little. If you're coming from a position where there is alternative FOSS software available to use, that's your bubble/sphere of experience. In other realms, say software for doing aerospace CAD, there is no FOSS available because it's just such a niche piece of software.

I don't think this counts as an exclusive feature. But yes this pay for the binary model "libre non gratis" is a very good model.

I feel like the main issue with projects switching between a permissive and less permissive license and back is that starting out as fully permissive in the first place was the main error.

If everybody would just agree to start their open source code as something like source-available or OpenRAIL -requiring companies with more than $5M in annual revenue to pay for the work - we wouldn't be in this situation.

https://fair.io/

Yeah its a bait and switch. People want the social credit, early adoption, and community embrace of being open source, but they also want a captive business model.

It's not a bait and switch because the old version of the software that was released with the old license can still be used as such. If you call this bait and switch then I suppose this means that you somehow feel entitled to future versions of the software having the same license, forever.

That’s the thing with software, you can automate most future updates, with LLMs and whatnot.

Also, the initial software probably didn’t have a lot of known cves when it was sold.

They won't do this, because starting out as non-free doesn't get the same traction. Now that I think about it, it's basically a form of enshitification: draw people in with one deal, then after they're onboard, change it to something less favorable.

Why is it enshittification if you only have to pay when you have >$5M in revenue? Is your world so shit if you cross that threshold?

I think the issue is more on how you audit such things. Governments struggle (partially by design, but still) to get proper audits on who uses what and how much money they make.

The theory is great, but I'm unsure how you execute this.

Well, that's even more reason to not complain about it.

It isn't about catching every last >5m business out.

It is about having a rule that can be enforced when it is obvious to do so.

35m agoHN ↗

Fair enough. I'm in support of it, but it seems like any company >5m is also going to give a big legal fight if and when they are challenged on such aspects.

But I'm all for a good attempt at taking our wealth back either way.

I'm just observing the incentives. There is a reason these licenses have not taken off, especially for nascent projects.

The usual pushback I get from FOSS zealots is that any time I mention things like money, popularity, increasing adoption etc. they just say none of that matters because it's "not a project goal."

In fact, often they don't even want money to be a thing at all, they think capitalism is inherently evil (cough innovation) and would prefer if everyone was just poor and lived in the woods or something.

Sorry... I like the world to be a little more interesting than that.

money, popularity, increasing adoption

These are the currencies of the VC world, and many open source developers don't release their work for those reasons (myself included, limited though my contributions are). It seems strange to deride them as making the world uninteresting because of this.

they think capitalism is inherently evil

Modern society has done a wonderful job proving that sentiment right. I can't blame them.

would prefer if everyone was just poor and lived in the woods or something.

I'd prefer if everyone had proper control over the tools they used. Whether they choose to live in the woods to use such tools or use them to make society a worse place is the double edged of 'free' (as in freedom)

I completely understand those skeptical about perverse incentives from not making software 'free' (as in beer). It shouldn't be a surprise that adding monetary inventice changes the entire incentive structure.

The financialisation of everything is, frankly, fairly toxic, so it's reasonable argument.

47m agoHN ↗

Call it names all you want, under capitalism, we all need money to pay for food and rent and it's got to come from somewhere.

I’m not sure who is worse, the people who want everyone to be poor and live in the woods, or the ones who want to monetize every human interaction until you need a microtransaction to unlock your front door.

Maybe there’s a balance to be struck.

31m agoHN ↗

The funny thing is that some of these "FOSS zealots" misunderstood the point of FOSS and believe that it is required to work for free, after the source has been released.

Most of the "FOSS zealots" should know that Stallman supported capitalism and the commercialization of free software in the form of paid support which this model has worked for many years and Stallman made his own money from speaking fees thanks to the GNU project.

The truth is, FOSS only works if someone else is paying.

Now, finally, I have an idea. It's gonna take 5000 words to get there, though, so if you don't have that kind of time, skip to the part about registries.

This article is full of LLMisms, which is to be expected but maybe it wouldn't be 5000 words and wouldn't need this disclaimer if they wrote it themselves

The only llmism I sensed is the use of "load bearing". Im usually queasy after reading llm slop, and stop before the end. This didn't have that effect.

Maybe the llms are getting better, but either way, this article reads like a real hunan write the whole thing.

This article feels like it was written by a human who has just read to much llm writing

Humans don't write things like: "Now, the popular way to tell this story is "the system is breaking," and I don't think that's right, and the distinction matters."

It felt like unedited, unstyled Claude output. e.g. "No, and the difference is the important bit."

Before LLMs no load was ever borne

Stop whining about it, the constant whining is worse than the LLM prose

It's really not, actually. Often I read the comments before the article and getting a head's up that the article is slop is invaluable.

It's not only not 'worse than the LLM prose', it's a community service!

I don't know about you, but I personally really appreciate when people warn me in advance that something is going to be a waste of time.

"and I don't think that's right, and the distinction matters" Yeah right. lol

I for one always appreciate it. The comments help me judge whether I'm right or wrong in my own opinion.

While I’m usually one to also get annoyed at uncurated slop, this doesn’t strike me in any way as LLM text, and likely something the author meant in earnest. I reads lot of LLM text. What part about it appeared generated to you?

From my perspective the piece was well structured, paced and thought through (and yes, a bit long)

https://developer.nvidia.com/blog/introducing-cuda-rust-two-...

The whole paragraph titled "Isn't this just Tidelift again?" is exactly how Claude describes something it is excited about.

57m agoHN ↗

I’d recommend looking through the 20+ years of Laurie’s writing in the archives. The LLMs may very well be mimicking him. I wouldn’t put LLM assisted writing past him, but I feel like this is being judged on topical similarity, and is not the standard kind of egregious incoherent slop that has little substance or lacks coherence. See for example:

How is this a LLM output? A LLM can easily write out those 5000 words.

Now, the popular way to tell this story is "the system is breaking," and I don't think that's right, and the distinction matters. The system isn't breaking. It's stable, at a level of human cost we've collectively decided to put up with.

Reads like an LLM to me. "Load bearing" also used a few paragraphs down.

Isn't this similar to the anaconda model? (Except they keep the money instead of distributing it.)

Depending on how you count, in my research group we are like 10 and in my whoooole university we are like 60.000 employees. When they went from free to restriced for big organizations I just uninstaled it.

Yes, but anaconda has a free competitor (pypi).

If pypi started charging too, you'd have nowhere else to go.

You seem to be forgetting the most important word in FOSS..

For them it is not the most important word, apparently.

But it is one of the words.

It can still be free for most people but paid for companies who make >$5M revenue.

Conditionally free is also free.

The Free in Foss is not "Free as in beer".

No, but "free as in speech" effectively precludes making money from sales of the software. As soon as you sell it to one person, that person can give it to others for less than he paid you (all the way down to free), so nobody has a reason to pay you any more. There's a reason FOSS survives on donations or service, rather than selling copies of the software.

The software still remains free, it's the registry that would become a paid service under such a model, that's what was proposed in the article. And even then, the registry would remain free for individuals, so it would merely be a price of convenience

I think I'm starting to forget, but could someone maybe tell me what the F in FOSS stands for?

https://en.wikipedia.org/wiki/Threshold_pledge_system

"Free as in speech, not free as in beer."

I'm not reading an AI slop article, but there's nothing in either the Free Software Definition or the Open Source Definition restricting the selling of software. It does prevent you from restricting people from sharing that software once they've bought it, but you could always use a threshold pledge system to ensure you get enough money before releasing anything:

"Free as in speech, not free as in beer."

As I understand it, if you have the first, the second follows from it. So it's effectively the same.

Not the same at all. Free as in beer means you get nothing. Free as in speech allows you to get as much money as you can using a threshold pledge system. This isn't just theoretical: the famous 3D modelling software Blender was released this way, becoming Free Software only after a €100,000 payment.

Sorry, I phrased it badly. I meant that in practice free-as-in-speech implies free-as-in-beer for copies: once anyone can redistribute the code.

"We encourage people who redistribute free software to charge as much as they wish or can. ... So if you are redistributing copies of free software, you might as well charge a substantial fee and make some money. Redistributing free software is a good and legitimate activity; if you do it, you might as well make a profit from it. ... Distributing free software is an opportunity to raise funds for development. Don't waste it!" https://www.gnu.org/philosophy/selling.html

Indeed! While reading the original post, I was reminded of the old essays where RMS made it abundantly clear that charging for delivery media was absolutely ok - and if you wanted GNU updates, you should send in the stamps necessary to send them back to you.

Maintaining a popular registry is very hard work, hard enough that commercial entities would rather pay than having to do it themselves. It is literally SaaS. It could absolutely be monetized for the common good - although the gamification worry is real, and the governance would be really difficult to defend from sharks. But there might be clever ways to fix those issues.

The one thing you cannot fix is the cross-planet level playing field that registries provide. Today, a small African company can pull from a registry more or less in the same way as large US corporations. If you put a toll booth up, the toll will soon be too high for people in various parts of the world.

The reason I dislike this is because of the game it creates. Let's say we have someone who developed a small, well-used dependency (say: xz) but there is now incentive to be "in the dependency chain." xz is open, LLMs are really good at stealing/recreating; what stops someone from publishing rxz (maybe a rust port, maybe a gnu-r port, maybe it's "Really fast" xz, maybe it's just hoping for a typo in a registry.) This new dependency adds very little over the original xz and xz could have just used a simple PR.

On the other side of things, does accepting a PR from someone grant the author the ability to collect royalties for that software project? If so, how would you quantify that? LOC seems like a quick but really bad answer for what it is incentivizing.

For many, the entire point of "F" in "FOSS" is not getting tangled up in this kind of mess. I personally would never want to add "am I opening myself up to a lawsuit if I don't pay someone for their PR" to enter my calculus of accepting a PR. Especially if this is because I reject payment at all on a project.

Finally, if a company/employee submits code to FOSS under this model, do they now expect a return?

This new dependency adds very little over the original xz and xz could have just used a simple PR.

I kind of like the incentives created by this competition. This "what if someone takes your software, adds one feature, and sells it" argument has been made many times and I think the answer is that you, as the original maintainer, are in the best position to add features and if you squander that position you deserve to lose.

Seriously imagine the consequences of this "eat or be eaten" approach. What it incentivizes is not feature development per se, but fragmentation for the sake of it. This in turn leads to less attentation toward maintaining the shared base of the fragmented forks, as it has been superseded with features X and Y in different, probably incompatible forks.

My point is that the original maintainer can defuse the forks by including the same features. That leaves users no reason to bother using the forks.

It's a good point, and it also depends on the feature being good and sensible and in demand enough to push users away from the default.

And then it incentivizes people to make good forks, like neovim vis-a-vis vim.

how about making money from something else like hardware, to fund software (almost like IP is a fiction and people should be making money from tangible things rather than info)

I'm sure AI can also brainstorm more ideas for (F)OSS business models today

If you want people to pay you for your software, stop writing it for free. Conversely, if you write it for free, don't expect people to pay you for it. Otherwise you are no better than someone at an intersection with a bottle of Windex and a squeegee who, unsolicited, cleans a windshield and then demands the driver to pay for it.

The original authors of Free Software and open source were career academics and others who were paid to do other things, or were sponsored by scientific and defense research grants. I don't know how anyone got the nutty idea that you could make money on FOSS itself. Practically every time someone has tried to make money on FOSS it has failed.

(Edit: this comment previously ended with "...from Netscape on down.")

In what world was Netscape a failure? Made some people an awful lot of money and then gave us Firefox... Pretty far from failure

Netscape basically died and was replaced by Firefox which doesn't/can't effectively charge users for the software so instead makes money by selling default search engine, etc.

Netscape existed as the internet was coming into existence. You used to have to buy a physical copy in the store to install it. People barely knew how to use their computers so the activation cost for bypassing their "pay wall" was high enough.

Netscape was included free with almost every ISP installation disk.

Netscape lost the ability to charge before it went open source. Among other things, Microsoft released internet explorer for free (part of embrace, extend, extinguish, afaik).

The open sourcing of Netscape 5.0 happened in early 1998, and AOL purchased Netscape later that year. Firebird/Firefox came a few years later.

First, a self-correction: Netscape did not produce open source products until it open-sourced Navigator 5.0 in 1998. Until then, Navigator was freeware: free to download and run, but not open source.[1] I shouldn't have mentioned them, but my point still stands.

Second, it depends on what you define as success and failure. Netscape made its pre-IPO shareholders money if they timed their stock sales right. But the stock didn't go up because the company was profitable. It went up along with every other dot-com stock until the 2000-2002 crash, based on hopes and dreams, not fundamentals. The company never turned anywhere near close to a profit.

To me, a successful company is one that makes a sustainable profit based on its business fundamentals, not one that makes its founders and early investors rich in an investment bubble.

[1] Correction: Netscape did charge for the browser if used in a commercial context, but few people actually paid up.

Netscape was actually selling a licence, which became free for endusers and eventually the entire browser was free, as the company concentrated on its Enterprise Server as a source of revenue. Netscape becoming freely available for endusers is pretty much what made the Web a mass phenomenon.

31m agoHN ↗

Most people only measure success as something like being a B or Trillion dollar company, and thats part of the reason in a different way why nobody pays for FOSS.

There's nothing stopping you from charging money for FOSS software. Sell the first one for as much as it cost to write it.

I assume you mean "sell it before you open source it."

If you found one willing buyer while it was still closed source, odds are there are others. Why deprive yourself of additional income? Open sourcing does happen from closed source, but usually that's long after the income stream has exhausted itself (see, e.g., https://github.com/microsoft/ms-dos).

55m agoHN ↗

Or before you make it. Lots of folks get paid to make open source- they are employees, contractors, and creators with patrons who pay them to create.

There's nothing stopping you, true. But I think you will find that nobody is going to buy software for whatever thousands of dollars it took you to make it. So the limitation in this case is a practical one, not a legal or moral one.

That suggests there's never been a viable market for commercial software at all, which is obviously wrong.

That's kind of black and white thinking though. No one is going to pay a million dollars for QuickBooks, but a lot of people paid several hundreds. Just because no one pays you to develop a new QuickBooks (at least pre LLM), doesn't mean there's not a market there.

21m agoHN ↗

Okay, then sell it until you make a million bucks then open source it.

I can't possibly take this at face value since it's obvious that people (businesses) pay others many tens or hundreds of thousands and millions of dollars to build software for them. So, what do you really mean?

Honestly, there's a real elegance to this model.

I'd argue the best possible model for goods that have no marginal costs (aka IP) is the "pay me to create it" model.

As in, let a creator decide how much they value creating the work. Then pay them that to create it - then release it free for everyone.

---

No ridiculous societal restraints that cost time and money to enforce (poorly) as IP law. Compensation is happening. Creating is encouraged.

Practical constraints make it unlikely we'll get much closer to this than Kickstarter (and equivalents) but it's a very honest model, that works with intellectual property by default.

Are you aware of what FOSS stands for?

23m agoHN ↗

You know that F stands for free as in freedom not beer?

Otherwise you are no better than someone at an intersection with a bottle of Windex and a squeegee who, unsolicited, cleans a windshield and then demands the driver to pay for it.

This seems like a pet-peeve that's slipped through, because

1) It's really not; the FOSS developers never forced anyone to use their software, even if they're asking for payment for a product that was originally "marketed" as "free",

and

2) With the damage to society done by the work of many of the people in the tech industry and "respectable" white collar work in general, they should hope to be as virtuous as the window washers. Service done, pay for service, they go away and don't bother you for a while? No subscription shenanigans? Don't have to give them my credit card number? No annoying marketing emails? Not intentionally designing their service to be addictive? Geez. Adobe, Google, Facebook, Amazon employees make them look like saints. People give themselves way too much of a pass just because they sit in an air-conditioned office all day.

I have found not all open source to be the same in the modern era. The FOSS of yesteryear has been replaced by a lot of projects aimed at enterprise where the FOSS offering is the "free demo." This may have been novel and clever of the original pioneers of the practice, but there's a lot of cargo culting going on.

The worst offenders release the source but with gotcha licensing, wait for the enterprise to use it, then detect their usage and go in demanding payment or be sued. This happened to my team enough times to be a pattern.

One does wonder, if we'd gotten really used to the idea of paying for software, if advertising, and the resulting tracking that came from it, would have really taken off as much.

The thing is; if your software wasn't offered for free, nobody would use it because someone else would offer their alternative for free.

Also, the most difficult problems which software solve are hidden problems. Sometimes critical, but hidden nonetheless. Nobody cares about system failure, at all, until it happens to them.

No matter how good your software is, you can't effectively market it as "reliable" because every single piece of software ever created in the world claims to be realiable even though almost none of them are! The label has lost all of its meaning and hence, cannot be communicated.

So this means that far worse competitors can gain adoption and take the entire market from you if there is any friction at all between the user and your product. Open source is an attempt to reduce friction as close as possible to 0.

Anyway this creates a hyper-competitive environment. If you don't have a voice in the economy, open source can seem like your only option to gain any adoption at all. It's a business model born out of desperation, not out of choice.

if your software wasn't offered for free, nobody would use it because someone else would offer their alternative for free.

That suggests there's never been a viable market for commercial software at all, which is obviously wrong.

The label has not lost its meaning. Everybody knows what it means and wants it, just almost everybody “selling it” is claiming it without regard for the truth of their claim for their own financial gain. In polite society that is called lying and fraud.

https://en.wikipedia.org/wiki/Open_source

You entirely miss the point of open source.

Open source is not about your ability to charge for the software. It is about the ability of the users of your software to modify it.

"Open-source software has its roots in the culture of source code sharing that dates back to the origins of computing in the 1950s. The term was formalized in 1998 with the founding of the Open Source Initiative, succeeding the free software movement initiated in the 1980s, with the intention of overcoming the ambiguity of the word "free" — meaning both freedom and gratis — to better appeal to the business world."

You seem to be caught up in the 'free' part of 'free software'. It does not mean 'gratis software'.

https://en.wikipedia.org/wiki/Free_software

I know what it means. The problem is that people are expecting to be paid after they've already released it to the public for free.

4m agoHN ↗

You can make it work. Odoo is making money selling services, and there are many businesses making money re-selling Odoo in one form or another: partially rebranding, SaaS, support...

A non negligible amount of FOSS follows a similar path: yes, they are OSS, but if you really need it, you'll be better served paying a fee to someone who knows how to make it work properly.

I think a small issue with foss and monetization is that you can accept money for said software hell even release it with expectations that you have to pay for it, but you can't insert a clause in the license that stipulates that the foss rights only applies to paying or paid customers.

Thus there is no legal protection you really got if you go foss as a developer when it comes to ensuring fair compensation.

12m agoHN ↗

Is there any well known, successful FOSS that isn't also free as in gratis?

I understand the distinction but have literally never encountered it in practice.

Open source was never about doing stuff for free - at least not originally.

It’s about the definition of ownership. What does it mean to own a program?

When you distribute the program, you must also distribute the code for it. That’s open source.

It's not about the definition of ownership, either. The author of FOSS software retains ownership, unless they explicitly convey it to someone else.

It's about how software is licensed--the terms and conditions under which someone can make a copy. That's why it's called the GNU Public License, or the MIT License, and why there's a LICENSE file.

The mere act of copying does not convey ownership, and never has.

I think the license was the best tool available for the ideology around ownership.

The lions share of the packages used by company X should get the lions share of their subscription too. This is where music subscription has failed.

The evolutionarily stable strategy for a piece of software is "anybody may use this for anything, including commercially, for free." That's MIT, BSD, Apache, the licenses that ask for nothing. Every project that has tried to be a slightly less generous dove has lost to a project that stayed a full dove

Linux (GPLv2) seems like an obvious counterexample?

Arguably that happened because Linux was, in fact, the most generous option: the BSDs effectively refused to get contributors beyond their very small groups, and refused to incorporate patches to support "bad" hardware or nonfree blobs - meanwhile, Linux was built around modules that could contain anything regardless of license, and happily accepted new patches and unknown maintainers. You still see it today: Linux literally built its own distributed VCS (git), while some BSDs are still on the hyper-centralized CVS.

If there isn't an even more generous option is simply because building a mainstream OS is incredibly hard.

Change the GPL and make the GPL only apply to NATURAL HUMANS and NOT CORPORATE HUMANS.

If the corporates want to use it, they can make a licensing agreement and put money into a trust of all who support it.

They don't want to pay? Too fucking bad.

Or, you know, just use a different license?

Other than charity and donations, the only two ways of getting paid for developing FOSS are: 1) support contracts and 2) crowdfunding the next release.

Digital goods live in a post-scarsity situation. Applying the same business model as real life products is crazy and it's the reason why we have Adobe&Co.

I'm not convinced a problem is actually here. I certainly wouldn't believe LLMs, an optional tool, make any part of this fundamentally worse. Maybe superficially for people who can't adapt.

“we can force them to pay for free”

Hard pass, thanks. Just, don't expect to get paid for maintaining open source projects.

It's easy. Everyone knows the deal going in, and if somehow you missed that you're not going to get paid for this and you want out at any time -- you just stop.

If you made something of value someone else who cares enough will pick it up. Or it can languish and the earth will keep spinning. It's fine.

Some pedantic points:

Ruby Central, whose dependence on one big sponsor then produced the 2025 takeover

Ruby Central had two major sponsors at the time: Alpha Omega and Shopify. Also the events had much more to do with interpersonal conflicts than sponsors.

My report: https://rubycentral.org/news/rubygems-fracture-incident-repo...

That is the GitHub only portion, but the AWS root happened immediately after/during and has its own timeline https://rubycentral.org/news/rubygems-org-aws-root-access-ev...

a depleted team

The named people we lost from the report: Sam was already way out the door. Andre was most of the way. Ellen wasn't doing that operational work. Deivid was only working on bundler and not the registry. Josef is the main operational loss, he removed himself. I'm unsure of which attack exactly Is being referenced, but Colby was promoted to full time (was planned before, just waiting on paperwork).

Other prior maintainers and security researchers did NOT leave. Maciej Mensfeld Was especially crucial. Jenny Shen. To name a few. These people are “the maintainers” too. We’ve (I’m a volunteer, came on in October 2025) brought on a number of in-kind engineers as well (companies donating engineer hours via letting employees work on company time).

I reached out to everyone unnamed that lost GitHub access. Of them, one asked for admin back (granted). None were active in operations.

Seldo’s overall point: about the fragility of all of this still stands. But I also believe the details and the nuance matter. I reached out to Laurie on bsky when this was first published but didn’t hear back.

23m agoHN ↗

Cannot edit to add: I left off Martin accidentally. Not intentionally. I don't actually know how involved he was with operations recently (he was a former acting OSS director for a short period a long while ago).

One of the easiest ways to get paid for something is to to offer commercial support once something shifts to 'end of life' for community support. Can't get off of an old busted version - write a check for continued support! This sort of thing is reasonably easy to get through the accounting process.

Leaving a tip, paying for something free, trying to send money to a group that our infrastructure absolutely relies on - stupid hard. Commercial support, on the other hand, is very understandable to the bean counters.

Great proposal Laurie! It'd be great if YC would set up an Open Source endowment also, with say 0.5% of their companies' stock (voluntarily) endowed to open source software.

I think it's a great idea and I hope someone inside the teams of popular registries sees this and they actually give it a go. I imagine the shitstorm of reactions that it's gonna cause from people who aren't even included in the "required to pay" group and I wish the registry maintainers strength to get through this

FOSS == Free Open Source Software, fyi.

Honestly, the privilege and entitlement of some people. You made a thing, you did a lot of work, you gave it away for free. Nobody stole it from you. Nobody even asked you to make it. You created this situation yourself. And now you're upset that nobody paid you for the thing you make for free?

"But but but... companies are making money... off the thing... that I gave them for free!! How dare they!! There is no way I could have seen this coming!!" - Either you were ignorant and didn't realize people would sell the thing you gave away, or you knew about it and are now pretending to be outraged at the thing you knew was going to happen.

"But but but... they should pay me anyway, because they're profiting off my labor! It's what's fair!!" - What's fair is for someone to take you at your (and your software license's) word, to do exactly what you told them they could do (profit off it). What's not fair is to turn around after they're hooked on your free thing, and try to force them to pay you for it, after the fact.

The point of open source is only to open up the source code, allow people to contribute, collaborate, and share. If you want to get paid for it too, don't put an open source license on it. It's that simple. Add whatever terms you want. But don't make FOSS and then later say it's unfair for people to do exactly what your license said they could do.

Why would you write such an important article with AI? I can't share this with people I know because they will lose trust if I send them AI articles. It's really, very easy to tell because it's filled with AI rhetoric and you don't sound like this in your writing from 2020 and before

Nobody pays for free (& open source) software?

He confuses developer adoption with cloud infrastructure maintenance, and he fundamentally misreads what software maintainers actually want.

The forking tax is great, and it requires a permissible checkpoint in the repo, which might not be available at all if you start correctly. Then the forks they use are quite literally "theirs", people don't trust hyperscalers.

Companies like redhat, jfrog, etc. have a model that is different to what one would want. They are built not on excellence but rather on taking the indemnity clauses on themselves. Hiring people to have 24/7 rotations and support, and all this Jazz and overhead that has nothing to do with being an expert at your thing.

Registry cron job paying thing...

Highly flawed and lacks fundamental understanding of the world, business, economics, and, more importantly, the actual drivers of the behaviour of the hyperscalers and business models of high-tech companies.

They conveniently forget that they were the very first ones to do MIT, then they build a community, just to later rug-pull everybody with non-permissive licenses. Plenty of examples of companies thriving by doing proper licensing from the very get-go. And these very people lacking in ethics then go on to complain THE LOUDEST that hyperscalers are forking them. I can't fathom the heights of entitlement and incompetence.

I don't understand why anyone takes this person seriously. He fell ass-backwards into a prominent company, got demoted after proving incapable of being the CTO, and then seemingly got promptly off-boarded after the acquisition and now just has a developer relations job. Not to denigrate that role, but it doesn't exactly confer authority for this to be the trajectory of your career.