Terminal window in the blog cover style with the title "Open Source: Who Profits?"

Open Source: Who Profits?

von

🇬🇧 This article is in English. Eine deutsche Fassung gibt es als separaten Beitrag.

Last month, Oracle released yet another Critical Patch Update. For most people that is a side note. For me it means: spending my evenings updating the MySQL ports in the FreeBSD tree, chasing the changes through the build process, writing advisories for the security database, and testing all of it before it gets committed. With the next nginx release, the game starts all over again.

I have been doing this since 2017. As a volunteer. And I would like to write down what that actually means, with real numbers.

What I do

I am a FreeBSD ports maintainer and developer. My two biggest areas are NGINX and MySQL, plus FreeIPA, code-server, BunkerWeb, Zoraxy and a few smaller ports. A port is, simply put, the recipe used to build and package a piece of software on FreeBSD. When you type pkg install nginx on a FreeBSD server, there is work from people like me inside.

This work never stops. Every upstream release wants to be merged, every CVE needs an update and an entry in the security database, every new compiler breaks a build somewhere. On top of that come bug reports from users, reviews, and the work in the Ports Security Team. To be able to test properly, I run my own servers at Hetzner with test VMs. I pay for them myself. The bottom line: my hobby costs me money, while the software I maintain earns billions for others. More on that in a moment.

The big picture first

In 2024, researchers from Harvard Business School and the University of Toronto tried to calculate what open source software is actually worth (Hoffmann, Nagle, Zhou: “The Value of Open Source Software”, HBS Working Paper 24-038). Their result: if all companies had to develop the open source software they use themselves, you would end up at 8.8 trillion US dollars. Companies would have to shoulder 3.5 times their current software spending if open source did not exist.

The most interesting number in the study, however, is in the fine print: 96 percent of that value comes from just 5 percent of the developers. A small group carries almost everything.

And how is that group doing? Tidelift has been surveying open source maintainers for years (State of the Open Source Maintainer Report 2024, over 400 respondents). The key numbers:

Metric (Tidelift 2024)Value
Maintainers who work unpaid60 %
Maintainers who can make a living from maintaining13 %
Unpaid maintainers who would like to be paid~73 %
Feel unappreciated~48 %
Have considered quitting or have quit60 %
More frequent implementation of critical security practices by paid maintainers+55 %
Source: Tidelift, The 2024 State of the Open Source Maintainer Report

The last row is the most important one, especially from a business perspective: supporting maintainers measurably buys security for your own software supply chain. The xz backdoor of 2024 (CVE-2024-3094, CVSS 10.0) showed what is at stake: an attacker spent almost two years building trust with the overworked, unpaid maintainer of the xz utils until he was granted maintainer rights himself, and then smuggled an SSH backdoor into a library that sits on almost every Linux system. That the compromised versions only made it into the testing branches of Debian and Fedora before Andres Freund discovered the backdoor more or less by accident was sheer luck.

So who profits from my work?

Take my two big areas. According to W3Techs, NGINX is now the most widely used web server in the world; roughly a third of all websites with a known web server run on it. The product has belonged to F5 Networks since 2019; back then they let nginx cost them around 670 million US dollars, and today they sell commercial licenses with NGINX Plus. MySQL belongs to Oracle and is marketed commercially there with MySQL Enterprise and the HeatWave cloud offering.

That this software runs on FreeBSD, stays current there, and gets its security holes closed in a timely manner is not something any of these corporations take care of. I do that, after work, on my own infrastructure. And FreeBSD is no niche: Netflix runs its entire CDN Open Connect on FreeBSD, by its own account thousands of servers delivering a substantial share of the world’s internet traffic. Sony’s Orbis OS on the PlayStation 4 is a FreeBSD fork, and the PS5 continues that OS line. Netgate’s pfSense firewalls are built on FreeBSD as well.

This is not meant as an indictment of individual companies. It is a structural problem: open source is a public good. Everyone can use it, nobody has to pay for it, so almost nobody does. Economists call this a free-rider problem, and the Tidelift numbers show that even after Log4j and xz, nothing about that has changed.

What would my work be worth on the market?

That can be roughly calculated. According to the public FreeBSD committer statistics, I have brought exactly 2,289 commits into the ports tree since May 2017. They vary a lot in effort, of course; I honestly split them into three categories. As the hourly rate I use the median for IT freelancers in Germany, which is 95 euros according to the Freelancer-Kompass 2026. DevOps and infrastructure specialists tend to be more in the 100 to 150 euro range, so I am deliberately calculating conservatively.

CategoryShareCommitsAvg. effortHoursMarket value (€95/h)
Simple (version bumps, small fixes)60 %~1,3700.5 h~690~€65,000
Medium (patches, advisories, build fixes)30 %~6904 h~2,750~€260,000
Complex (new ports, porting work)10 %~23025 h~5,700~€545,000
Total100 %2,289~9,150~€870,000
My own estimate of the effort distribution; every assumption is up for debate. Even cut in half, it is still almost half a million.
Bar chart: market value of my ports work by category, 2017 to 2026. Simple commits 65,000 euros, medium 260,000 euros, complex 545,000 euros. Chart labels in German.

In total: a good 9,000 hours with a market value of around 870,000 euros over ten years. That is the equivalent of five to six full-time years. Not included: bug report support, reviews, the security team work, and my Hetzner bills.

What I have earned from all this: nothing. I have paid extra.

Comparison: market value of the work around 870,000 euros, actual compensation over 10 years 0 euros. Chart labels in German.

I am not doing this math to complain. I am doing it because this calculation is missing in almost every company that builds on open source. The value is real; it just never shows up in any balance sheet.

An example of how this problem reaches into the future

All of this is not just a look back. It very concretely influences which work will happen in the future, or will not happen. An example from my own head:

For a while now I have been thinking about getting into FreeBSD base system development alongside the ports work. What specifically attracts me is bhyve, the FreeBSD hypervisor, and there above all the topic of live migration: moving running VMs between hosts without interruption. Technically a fascinating field; I would learn an enormous amount.

And yet I hesitate. Because if I am honest: as a private person, I get almost nothing out of live migration. If I want to move a VM to another host at home, I shut it down, migrate it, and start it again. Two minutes of downtime that bother nobody. The real value would go to companies that want to run bhyve at enterprise level and for whom every second of downtime costs money.

So there I sit, doing the math: invest months of evenings and weekends in kernel and hypervisor code so that, in the end, companies get a feature they would happily pay good money for with VMware or Proxmox support contracts. With FreeBSD they would get it as a gift, from someone who once again sees nothing for it except his own electricity bill.

What keeps me on the topic is curiosity and the learning value. What slows me down is exactly the calculation from this article. And I suspect that the same trade-off is happening in many heads right now, for many features that will therefore never get built. That is the invisible price of the free-rider problem: you do not see it in broken services, you see it in software that never came to exist.

So if a company is reading this that would like to have bhyve with live migration: projects like this are exactly the point where sponsoring makes the difference between “an appealing idea that one person alone cannot shoulder” and “gets built”.

The one exception

With all of this, there is one exception in my case, and it means a lot to me: my single loyal sponsor. For years he has been providing me with a build machine on which I can build and test my ports. And when we see each other, there is the occasional meal or drink as a thank-you.

That may sound unspectacular, but this is exactly what support looks like when it actually enables maintainer work. No marketing campaign, no logo on a website, but concrete infrastructure and honest appreciation over many years. Thank you for that. You know who you are.

What I wish for

I enjoy doing this work. FreeBSD is my project, my community, in some ways a piece of home. But I want it to become visible how all of this works economically, or rather does not work.

If your company uses open source (according to the OSSRA report by Synopsys, 96 percent of all audited commercial codebases contain open source, and 77 percent of the scanned code is open source code), then ask yourselves: who actually maintains the packages our business runs on? What happens if that person stops tomorrow? And what would it cost us, in comparison, to support them?

Support does not have to be complicated at all. A build machine. A server. A sponsorship via GitHub Sponsors or Open Collective. Paid working time for employees who contribute to open source. Sometimes an honest thank-you and a dinner are enough.

Sources:

Schreibe einen Kommentar