Who maintains open source, and why for free?

My first contribution to an open project was a typo in a documentation page. Three words. It took me forty minutes, mostly spent working out the process and being nervous about it, and it was accepted the same evening by somebody who thanked me. I remember being surprised that anybody bothered to say thank you for three words.

That transaction is worth examining, because the economics of it make no sense under any model of why people work, and yet it is the transaction on which most of the world's digital infrastructure rests.

The numbers that should not work

Consider the shape of it. A language used by an enormous share of the world's programmers, taught in schools, underpinning entire industries, developed substantially by volunteers. A compression library inside virtually every server on earth, maintained for years by one person. A logging component in a vast proportion of business software, maintained by a handful of people in their own time until a flaw in it caused a global emergency and everybody discovered who had been holding it up.

Some of these people are now employed to do the work, which is an improvement and a fairly recent one. Many are not. The overall picture is of critical infrastructure maintained on a volunteer basis by people whose names appear nowhere in the products built on top of them.

Why people actually do it

I have asked, and the answers are less noble and more convincing than the ones people expect.

The most common one, by a distance: they needed the thing to work. Somebody had a problem, fixed it for themselves, and sending the fix upstream was cheaper than maintaining it privately forever. That is not altruism, it is the maintenance arithmetic that governs corporate contribution, applied at individual scale. The majority of contributions to most projects start exactly here.

The second is professional and entirely rational: a public record of your judgement is worth more than a curriculum vitae. I have hired on the strength of somebody's contributions, and I have been assessed that way myself. Work that anyone can read is a credential that does not require anybody to take your word for anything.

The third is the one I understand best and find hardest to explain to people outside this work. Fixing something properly, where the fix is permanent and visible and helps people you will never meet, is satisfying in a way that finishing a task at work frequently is not. I spend my professional life solving problems that will be solved again differently in two years. A patch in a library is still there.

The part that is genuinely broken

I do not want to romanticise this, because the arrangement has a real cost and it is paid by specific people.

Maintainer burnout is common and well documented. The work that attracts volunteers is building things; the work that keeps a project alive is answering the same question for the ninth time, reviewing contributions that are not quite right, saying no politely, and being publicly criticised by people who have paid nothing. That is not enjoyable, it does not stop, and a person who steps away leaves a component with no owner.

And that vacancy is a security problem, not merely a sad one. The most serious supply-chain attack in recent memory succeeded by targeting exactly this: an exhausted solo maintainer under pressure was offered help by someone patient and apparently competent, and handed over trust. The attack worked on the human structure because the human structure was the weak part. It always was.

What I do about it, being honest about the scale

My business is built on this work. Every machine I sell runs software I did not write and did not pay for, and the margin I make is possible because that software costs nothing. Saying that plainly seems like the minimum.

What I actually do is small and I am not presenting it as a solution. I report bugs properly, with enough detail that somebody can act on them, which takes half an hour and saves a maintainer several. I contribute fixes when I am capable of it. I send money to the projects I depend on commercially, which is a smaller amount than it should be. And I write documentation in Polish where there is none, because a language barrier is a genuine obstacle for the people I work with and it is the contribution I am best placed to make.

If you use any of this — and if you own a phone, you do — the useful version of gratitude is not a donation. It is a good bug report. A maintainer receiving a clear description of a problem, with the steps to reproduce it, has been given something genuinely valuable by somebody who was not obliged to give it. That is the transaction I was surprised by with my three-word typo, and I have been on both sides of it since.