Open-source software presents an apparent paradox. Companies invest heavily in writing code, then publish it under licences that let anyone use, modify and redistribute it without payment. Some of those companies are worth billions. The paradox dissolves once you see that the free artefact is not the product; it is the distribution channel, and the revenue comes from whatever remains scarce once the code is abundant.
Four things that stay scarce
The first is operational responsibility. A database is free to download and expensive to run correctly at scale with backups, failover, upgrades and security patching. Managed hosting converts a free product into a recurring service, and it is now the dominant commercial model in the category.
Read moreWhat Reusable Rockets Changed About Space
The second is assurance. Regulated enterprises need someone contractually accountable for security response, long-term support of old versions and indemnification against intellectual property claims. Subscription support businesses sell precisely that accountability, and the code itself remains free for anyone willing to carry the risk internally.
The third is proprietary extension. Under an open-core model the base project is genuinely open while enterprise requirements — fine-grained access control, audit logging, compliance reporting, cross-region replication — sit in a commercial edition. The tension is obvious: every feature moved behind the paywall reduces the openness that built the community in the first place.
The fourth is attention. Widely adopted projects give their maintainers privileged access to the developers who make purchasing recommendations, which is why enormous amounts of engineering are funded by companies with no intention of selling the software at all.
Read moreHow Public Companies Actually Set Their Prices
Licences are strategy documents
The choice of licence determines who can compete with you using your own work. Permissive licences maximise adoption and permit a cloud provider to offer a managed version without contributing back. Copyleft licences require derivative works to be shared, which deters some commercial use and protects against pure extraction. The full catalogue of approved licences and their conditions is maintained by the Open Source Initiative.
Several prominent projects have relicensed away from open-source terms after concluding that hyperscale providers were capturing most of the commercial value. The resulting licences restrict offering the software as a service, and while defensible commercially, they forfeit the open-source designation and, frequently, a portion of the contributor community.
The maintenance problem
Modern software is assembled rather than written, and a typical application draws on hundreds of transitive dependencies, many maintained by unpaid volunteers. That structure is efficient and fragile in a way that became impossible to ignore after several high-profile vulnerabilities in widely embedded libraries. Guidance on securing the software supply chain, including software bills of materials, is published by the Cybersecurity and Infrastructure Security Agency, and standards for provenance and integrity increasingly appear in procurement requirements.
Read moreWhat the Yield Curve Does and Does Not Predict
Funding has begun to follow the risk. Corporate foundations, government programmes and dedicated funds now pay maintainers of critical infrastructure projects directly, and research into dependency concentration published through bodies including the National Institute of Standards and Technology has helped identify which projects genuinely qualify as critical.
For a company evaluating an open-source component, the useful questions are not about licence purity. They are about who pays the maintainers, how quickly security patches have historically shipped, and whether the project would survive its most prolific contributor changing jobs.
Who pays, and why they keep paying
The commercial puzzle of open source is that the software is free while the obligations around it are not. Enterprises do not buy code; they buy indemnification, a support contract with a response time, a supported upgrade path, security patches for versions their auditors still care about, and someone to call at two in the morning. That bundle is what converts a project into a business, and it explains why the strongest open-source companies sell operational certainty rather than features. Surveys published by the Linux Foundation consistently find that the deciding factor in commercial adoption is maintenance confidence rather than licence cost.
It also explains the durability of the model in infrastructure and its weakness in applications. The more mission-critical and the more deeply embedded a component is, the more a buyer will pay to reduce the risk of it failing. Software that sits at the edge of the stack, easily replaced and rarely load-bearing, generates far less willingness to pay no matter how many stars the repository has.
The sustainability problem underneath
The uncomfortable structural fact is that a large share of critical infrastructure is maintained by very small numbers of people, often unpaid, and the incentives to fund that work arrive only after a failure. Dependency graphs concentrate risk in components that no commercial entity owns, and the recent wave of corporate funding programmes and foundation-hosted stipends is best understood as an attempt to price a risk that was previously being carried for free. Whether that funding is durable through a downturn is genuinely unknown, because it is discretionary spending justified by a tail risk, and discretionary spending justified by tail risks is historically the first thing cut.
