Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Why would this be implemented, though?
The author talks about how companies don't pay OSS maintainers because they don't have to. But they often pay registry maintainers because they do have to (or they have to run their own, which they don't want to, so they pay).
But why would the registry set up a system to pay maintainers? They don't have to, so why give up a part of their revenue stream? Either the registry's aims are profit, and they wouldn't want to do that, or their goal is to charge for operating costs to keep the lights on, and they wouldn't have the spare revenue to pay maintainers.
The bottom line is the same: if someone has to pay for something, and there are no alternatives (or the alternatives are costly in other ways), then they will pay. If they don't have to pay, then they won't.
If registries get developers to upload their code without paying them to do so, why would they voluntarily pay them?
by kelnos - Glossing over that too long article, the main proposition seems to be :
> The registries should charge companies, and pay maintainers
They already centralize packages, centralizing money flows is bound to cause more issues. By the way, npm is owned by GitHub, and GitHub is owned by Microsoft. "Your payment for your leftpad package has been transferred to your Microsoft Wallet". No thanks.
I just think there's a fundamental disconnect between the goals here. If I write free software, I don't write it to get paid, I write it to benefit others. If someone takes my work without also contributing back, I will get upset. The solution is not to give me money, that's not the spirit. We should not force people to pay for OSS but we should force them to give back to the community.
That's why copyleft licences like GPL are superior. People licence their work under BSD-style licences that are the equivalent of putting a box of stuff on the side of the road with a "free, help yourself" sign and then get upset when people do. BSD-style licences take away as many rights from users and authors as they can. GPL-style licences give as many rights to the users as they can. That's basically completely opposite philosophies. Use the right licence folks.
by ajnin - Some pedantic points:
> Ruby Central, whose dependence on one big sponsor then produced the 2025 takeover
Ruby Central had two major sponsors at the time: Alpha Omega and Shopify. Also the events had much more to do with interpersonal conflicts than sponsors.
My report: https://rubycentral.org/news/rubygems-fracture-incident-repo...
That is the GitHub only portion, but the AWS root happened immediately after/during and has its own timeline https://rubycentral.org/news/rubygems-org-aws-root-access-ev...
> a depleted team
The named people we lost from the report: Sam was already way out the door. Andre was most of the way. Ellen wasn't doing that operational work. Deivid was only working on bundler and not the registry. Josef is the main operational loss, he removed himself. I'm unsure of which attack exactly Is being referenced, but Colby was promoted to full time (was planned before, just waiting on paperwork).
Other prior maintainers and security researchers did NOT leave. Maciej Mensfeld Was especially crucial. Jenny Shen. To name a few. These people are “the maintainers” too. We’ve (I’m a volunteer, came on in October 2025) brought on a number of in-kind engineers as well (companies donating engineer hours via letting employees work on company time).
I reached out to everyone unnamed that lost GitHub access. Of them, one asked for admin back (granted). None were active in operations.
Seldo’s overall point: about the fragility of all of this still stands. But I also believe the details and the nuance matter. I reached out to Laurie on bsky when this was first published but didn’t hear back.
by schneems - I feel like the main issue with projects switching between a permissive and less permissive license and back is that starting out as fully permissive in the first place was the main error.
If everybody would just agree to start their open source code as something like source-available or OpenRAIL -requiring companies with more than $5M in annual revenue to pay for the work - we wouldn't be in this situation.
by mentalgear - (Speaking only for myself.)
Having open indices charge money is the “easy” part, relatively speaking. The author is correct that most companies will grumble a bit and then fork over the nominal amount of money needed to preserve their existing assumptions.
I think the rest of this don’t really work in practice though: it’s actually incredibly hard to distribute money to open source maintainers across hundreds of jurisdictions, and it’s not immediately obvious how a service like PyPI (which is barely funded to maintain and sustain itself) would shoulder such a burden without diverting a very large fraction of that money for things that would make people upset (read: lawyers and tax professionals).
(NPM would appear to be the exception to this since it has - at least on paper - the legal resources of Microsoft behind it. But I think it’s largely a quirk of history that the JavaScript packaging ecosystem ended up with a single corporate owner, and no ecosystem I’ve worked with seems eager to pursue a similar relationship.)
by woodruffw - > Now, finally, I have an idea. It's gonna take 5000 words to get there, though, so if you don't have that kind of time, skip to the part about registries.
This article is full of LLMisms, which is to be expected but maybe it wouldn't be 5000 words and wouldn't need this disclaimer if they wrote it themselves
by dwedge - I'm not sure it fits the free and/or libre software philosophy but I'm a big fan of releasing otherwise free and open source software as a paid version and with some exclusive QoL features in proprietary store fronts.
For example Krita. https://krita.org/en/download/ FOSS but you can buy it on Steam, Microsoft Store, Epic Store, and Apple Store. You get one exclusive feature, automatic updates (and more recently Steam Cloud sync support), and you also support the developers (on the other hand Valve, MS, Epic, and Apple also gets a cut too).
If you read for example the Steam reviews everyone points out that it's a free software but buying on Steam is also a good and very importantly straightforward way to support the devs + the platform itself has such a pull ("buying games you never play") that people buy it just for the case of having it in their library
by haunter - If you want people to pay you for your software, stop writing it for free. Conversely, if you write it for free, don't expect people to pay you for it. Otherwise you are no better than someone at an intersection with a bottle of Windex and a squeegee who, unsolicited, cleans a windshield and then demands the driver to pay for it.
The original authors of Free Software and open source were career academics and others who were paid to do other things, or were sponsored by scientific and defense research grants. I don't know how anyone got the nutty idea that you could make money on FOSS itself. Practically every time someone has tried to make money on FOSS it has failed.
(Edit: this comment previously ended with "...from Netscape on down.")
by otterley