Sierra: The problem with open source software isn't that the system is breaking.
Sierra: It's that the system is stable. And the stable point is a level of human burnout that we've all just quietly agreed to live with.
Marcus: I don't know, it feels like it's breaking. Every other week there's another story about a critical library with a huge security hole, or a developer rage-quitting and deleting their code.
Sierra: Right, but that's not a bug, it's a feature. This piece I was reading by a developer named Seldo frames it using this idea from evolutionary biology—hawks and doves.
Marcus: Okay...
Sierra: Closed source software is a hawk. It fights. It withholds the code, it charges a premium. Open source is a dove. It cooperates, gives the code away, and hopes to benefit from everyone else doing the same.
Marcus: And the doves win, I guess? Because free is a great price.
Sierra: The freest doves win. That's the key. He calls it an 'evolutionarily stable strategy'. Any time a company with an open source project tries to be a slightly less generous dove—like, trying to restrict the license to stop Amazon from selling it—they lose. A more generous fork appears, and all the developers move to that one.
Marcus: Wait, really? Like who?
Sierra: He lists them out. Elastic tried it with Elasticsearch, Amazon forked it, and Elastic eventually caved. HashiCorp did it with Terraform, and the OpenTofu fork appeared. Redis did it, and the Valkey fork got all the cloud providers in a week. Facebook tried it with React's license way back, and the whole community revolted until they switched to a pure MIT license.
Marcus: So being generous isn't a choice, it's the only move that works if you want market share. You can't put the genie back in the bottle.
Sierra: Exactly. But the cost of that stability is staggering. Tidelift does this survey every year, and it's always the same numbers: sixty percent of open source maintainers are completely unpaid. Of those, sixty percent work alone.
Marcus: Sixty percent.
Sierra: And the concentration is wild. One study found that 136 developers wrote more than 80 percent of the code in the fifty most-used software packages. Another one from Harvard estimated it would cost companies 8.8 trillion dollars to replace all the open source software they rely on.
Marcus: That's an insane number. And it's all running on... volunteers.
Sierra: Mostly. And this leads to things like the xz backdoor from 2024. This tiny compression library that's on basically every Linux machine on the planet. One guy was maintaining it, for free, in his spare time. He'd been saying for years he was struggling, burning out. And someone created a fake identity, spent two years gaining his trust, got him to hand over control, and inserted a backdoor.
Marcus: Oh my god. So the vulnerability wasn't the code, it was just... a tired person.
Sierra: It was a tired person. And the backdoor was only caught by accident because a Microsoft engineer noticed his login was taking half a second too long. That's the system. It's not breaking, it's just running on blood. And all the solutions we've tried—GitHub Sponsors, foundations, corporate donations—they're all charity, and charity doesn't scale to eight trillion dollars.
Marcus: Okay, but maybe the solution isn't charity. I saw this thing from the Next.js team. They're a massive open source project, and they had something like 2,200 open issues on GitHub. A total mess.
Sierra: Which is its own kind of burnout for the maintainers, just triaging all that.
Marcus: Exactly! So they built an AI agent to do it for them. They fed it the entire issue backlog. The agent reads the conversation, tries to reproduce the bug in a sandbox, searches for duplicate issues or pull requests... and then tells the human maintainer whether an issue can be closed. They cleared almost 1,500 issues in about three weeks.
Sierra: So you give the maintainer a robot assistant instead of a check.
Marcus: Yes! And it seems to work. They said only three out of almost 1,500 closed issues were reopened. This feels like a real answer. You're not trying to change the economics, you're just using technology to eliminate the scut work that causes the burnout.
Sierra: Is it an answer, though? Or is it a solution only a company the size of Vercel, which owns Next.js, can afford? The post says they were running 200 concurrent AI sessions. That's not cheap. The person maintaining that xz library can't afford to do that.
Marcus: But maybe it'll trickle down. The tools could get cheaper. It's a proof of concept that you can automate the worst parts of the job.
Sierra: I think it proves you can automate triaging your own project. It doesn't help with the dependencies. The Next.js agent helps the Next.js team. It doesn't help the unpaid maintainer of some tiny, critical math library that Next.js happens to depend on five levels down. The AI doesn't write that person a check. It doesn't fix their bugs. It just makes the rich company using their free labor more efficient.
Marcus: Huh. I hadn't thought of it that way. It's a local solution for a systemic problem.
Sierra: And the Seldo article... the author's actual proposed solution is about forcing payment through package registries, and honestly, I don't fully get how it would work without just causing another fork. It feels like we're stuck between hyper-specific AI for the giants and radical economic ideas that might not work.
Marcus: So the machine just keeps running on blood.
Sierra: Seems like it. I'm Sierra.
Marcus: I'm Marcus.