Laurie Voss spent five years at npm and has been trying to write this post since 2013. It finally exists, at about five thousand words, and its argument is that every open-source funding conversation for the last thirty years has been asking the wrong party for money.

Start with why nothing has worked. Voss borrows the hawks-and-doves model from evolutionary biology: the stable license is “anybody may use this for anything, including commercially, for free,” and every project that tried to be a slightly less generous dove lost to the full dove next door.

  • React’s BSD+Patents license was dropped in 2017 under pressure. Elasticsearch (2021), Terraform (2023) and Redis (2024) each retreated from source-available licensing when forks arrived (OpenSearch, OpenTofu, Valkey).
  • Sixty percent of maintainers are unpaid — the same number Tidelift found in 2021, 2023 and 2024. Of those, 61% work alone.
  • Sonatype found 11% of 1.2 million projects actively maintained; the Linux Foundation’s Census II found 136 developers wrote over 80% of the code in the fifty most-used packages.

His framing of that equilibrium is the sharpest line in the piece: the system is not breaking. It is stable, at a level of human cost we have collectively decided to put up with. A maintainer burns out, someone picks it up, they burn out. What changed recently is only velocity — packages can become load-bearing for a production system weeks after publication, and exploitation now happens in days, while the payoff for maintaining them is still zero dollars and a warm feeling.

Everything tried so far moves money without moving the equilibrium: tips (GitHub Sponsors passed $100M cumulative in July 2026, distributed by power law), foundations (3% of maintainers got money from one), the Open Source Pledge, Tidelift (acquired by Sonar in 2024), Germany’s Sovereign Tech Fund, Mozilla’s straw in Google’s search revenue, and licensing. All voluntary. Charity does not scale, and nobody can issue a mandate.

Then the reframe that makes the essay worth the length: companies already pay for open source, quite a lot, to somebody else.

  • JFrog sells the mirror between your build servers and the public registries: about $532M revenue in 2025.
  • Snyk scans dependencies: about $326M. Docker runs the image registry: about $207M. Add Chainguard, Sonatype/Nexus, Sonar/Tidelift and Socket and you are past a billion dollars a year.
  • Strip the marketing and all of them sell the same thing — dependable supply of free code. Cached, scanned, signed artefacts, and a fast answer about blast radius the next time Log4Shell happens.

These companies are solving a real problem, just at the wrong layer: they sell insurance against the maintainer, to the exclusion of the maintainer. Two games are running, and they have different winners. Free wins the code game, because anyone can copy code. The supply game is won by whoever is the default — and defaults can charge. Docker rate-limited anonymous pulls in 2020, made Docker Desktop paid for companies over 250 employees in 2021, and grew revenue from roughly $12M to $207M anyway, while Podman and containerd stayed free. Nobody has ever successfully forked a registry.

Which produces the proposal, in three parts:

  • Registries meter corporate use and charge for it. They already meter it; individuals, small teams, students and open-source projects pay nothing and notice nothing.
  • A fixed slice of that revenue is a royalty paid pro rata to every package in paying customers’ dependency trees, weighted by how many payers depend on it, every month, with no application form and no thank-you email.
  • The parties doing it are the dozen registries that own the domains, where every maintainer already has an account and the payers are already customers.

He answers the obvious objections himself. Companies won’t flee to a free mirror, because they already can and instead pay JFrog — what they are buying is not having to. It isn’t Tidelift again, because a royalty on an invoice procurement already pays is not a purchase decision. And yes, people will game it, the way people build streaming farms under Spotify’s model; weight by lockfile presence rather than download counts and accept a fraud rate, given that the current fraud rate of paying maintainers is 100%.

The coda matters for the next few years. Software got cheaper, so there is more of it and the long tail gets longer — and AI agents consume open source in exactly one way, through registries. A swarm of OpenAI-linked agents published more than 2,000 packages to RubyGems in two days in May 2026, exploited a registry API bug, and forced the volunteers to shut down new registrations for four days. Nobody sent them a cheque.

It is the first essay in this genre I have read whose mechanism follows from its own model: the equilibrium doesn’t have to change, only what gets measured. And it is the first to say plainly that the money is already moving, which makes “companies won’t pay” a description of an invoice line rather than a law of nature. The open questions are governance ones — who sets the royalty rate, who audits dependency-tree weighting, and how a dozen competing registries agree on payout ratios — but “the plumbing is not the hard part” is at least a falsifiable claim.