Monetize OSS

Maintenance Is the Last Moat

2026-10-14T00:00:00+00:00

Every abandoned project now gets ten eager clones within a week.</p>

None of those clones will be patched either. The people who generated them were solving for “exists”, not “stays alive”. And that gap — between generated and maintained — is where the entire economics of open source now lives.</p>

The xkcd problem, amplified</h2>
You know the comic: a critical piece of infrastructure everyone depends on, maintained by one unpaid person in Nebraska. AI made that problem worse, not better. Agents make it trivial to start</em> projects. They do nothing to make it easier to sustain</em> them. Sustaining is issue triage, security response, the exploding volume of AI-generated spam issues, dependency upgrades nobody notices until they break, and the slow accumulation of trust.</p>
That work doesn’t show up in a README. It shows up in a maintenance history — commit cadence through holidays, response time to security reports, whether the project survived its maintainer’s new job.</p>

Verifiable maintenance as an asset</h2>
Here is the shift: maintenance used to be a cost center you mentioned apologetically in your README. Now it is the closest thing to a moat you can actually build.</p>
When a clone of your project exists — and one will — buyers and adopters will pick between you and the clone on exactly one question: which one will still be here in three years?</em> A public, verifiable maintenance history answers that. A feature list does not.</p>
This is the question my open source scorecards</a> project tries to measure: not stars, not hype, but whether the project shows the signs of life that predict survival.</p>
What this means if you maintain something</h2>
Stop asking what feature you can charge for. Features are clonable in days. Start building the record that proves you are the one who stays: respond to security reports fast and publicly, publish your roadmap misses along with your hits, keep the changelog honest for years.</p>
Then monetize the position, not the code: support, hosting, enterprise governance, sponsorships. Every one of those converts better the longer your maintenance record gets.</p>
The clone has your code. It will never have your Tuesday — or your three-year changelog.</p>

The 8 Ways to Make Money from Open Source (Ranked by How Long They'll Survive AI)

2026-10-13T00:00:00+00:00

There are exactly eight ways people make money from open source. Some of them are about to get much harder. Some were never about the code to begin with — and those are the ones that will outlive the current shift.</p>
Here is the full landscape, ranked by how well each model survives a world where any competent developer with an agent can rebuild your product in a weekend.</p>
1. Selling support and operations</h2>
The Red Hat model. Nobody ever paid Red Hat for Linux — Linux was free. They paid for accountability: someone to call, someone to escalate to, someone the auditors can put on a slide.</p>
Agents can generate code. They cannot be on the hook at 3am when your deployment eats itself. Survives AI untouched.</strong></p>
2. Hosting and managed services</h2>
Uptime is a track record, not a feature. An agent can generate a Supabase clone in a weekend. It cannot generate five years of 99.99% uptime history, a SOC2 report, or a security team that has handled a real breach.</p>
Survives AI — arguably gets stronger.</strong></p>
3. Sponsorships</h2>
Sponsors fund humans and track records, not repos. Nobody sponsors a codebase. The donation button on a maintainer profile converts because of years of visible, verifiable work.</p>
Survives AI untouched.</strong></p>
4. Selling the whole product to enterprises (governance, not features)</h2>
The quiet winner. SSO, audit logs, RBAC — companies pay for these not because the code is hard, but because their compliance regime requires someone accountable to provide them. “My agent built our own SSO” does not survive a SOC2 audit.</p>
Survives AI — the compliance surface is the product.</strong></p>
5. Grants and foundations</h2>
NLnet, Sovereign Tech Fund, Open Collective fiscal hosting. Grant bodies fund public goods and stewardship — a category agents cannot fabricate.</p>
Survives AI.</strong></p>
6. Paid work and bounties</h2>
Algora-style issue bounties. Works, but watch the new failure mode: agent-generated low-effort bounty claims flooding your queue. Viable with screening.</p>
Survives AI with friction.</strong></p>
7. Open core with feature gates</h2>
The paid tier exists because the features took months to build. But a clone doesn’t care about your months. Feature-gating weakens badly when generation is free — gate on operations and governance instead, or lose the tier.</p>
Weakened by AI.</strong></p>
8. Dual licensing and license fees</h2>
The “pay or we get copied” threat only worked when copying was expensive. It isn’t anymore. Selling legal certainty still works for compliance-driven corporates — but as a threat, it’s hollow.</p>
Most weakened by AI.</strong></p>
The pattern</h2>
Every model that survives is selling something that is not the code</em>: accountability, uptime, a track record, a compliance surface, stewardship. Every model that dies is selling the code itself.</p>
That is not a coincidence. It is the whole thesis of this blog: code is free now. Someone who will still be fixing it in three years is not — and that asymmetry is the business model.</p>
Before you pick a model, check how projects already running it score on maintenance health over at the open source scorecards</a>. The winners of the AI era will be the projects that are still alive in three years.</p>

Why Nobody Will Pay for Code Anymore

2026-10-10T00:00:00+00:00

A few weeks ago I watched an agent rebuild a closed-source SaaS tool as an open-source clone. Over a weekend. Not because anyone asked it to — someone on the internet complained about the pricing, an agent session spun up, and by Monday there was a working alternative with a README, CI, and a MIT license.</p>
I have been writing software for 25+ years. I have sold software. And that weekend broke something in my head that I don’t think gets repaired.</p>
Here is the thing: we priced software on scarcity that no longer exists. Code was expensive because writing it took senior humans a long time. That input cost is collapsing, and with it the output price. When any competent developer with an agent can rebuild your product in a weekend, “buy my code” stops being a pitch. It becomes a museum exhibit.</p>
What dies</h2>
Feature-gated open core is the first casualty. The paid tier exists because the features took months to build — but a clone doesn’t care about your months. Dual licensing weakens next: the “pay or we get copied” threat only worked when copying was expensive. And source-available licenses built to stop cloud providers wrapping your repo? The cloud provider doesn’t need your repo anymore. It can rebuild you from screenshots.</p>
None of this is a licensing problem. The license was never the moat — it was a fence painted around a moat that used to be there.</p>
What hardens</h2>
Look at what people actually paid for in the last decade of open source, and notice it was almost never the code.</p>
Sponsorships. Red Hat didn’t get to $1B selling Linux — you can download Linux for free, and always could. They sold accountability: someone to call, someone to escalate to, someone your auditors can put on a slide. Sponsors fund maintainers, not repos. Nobody sponsors a codebase.</p>
Hosting. Uptime is a track record, not a feature. Your agent can generate a Supabase clone in a weekend — it cannot generate five years of 99.99% uptime history, a SOC2 report, or a security team that has actually handled a breach at 3am.</p>
And the quiet one: maintenance itself. Generation is a one-shot event. Survival is a grind measured in years. Every abandoned project now gets ten eager clones within a week — and none of those clones will be patched either, because the people who generated them were solving for “exists”, not “stays alive”.</p>
The uncomfortable summary</h2>
Code is free. Someone who will still be fixing it in three years is not.</p>
That asymmetry is the entire business model now. If you maintain open source, your money is not in the code — it is in being the person who is still there. Verifiable maintenance history, the thing my scorecards project</a> tries to measure, is the closest thing left to a moat you can actually build.</p>
So if you are sitting on an open source project wondering how to monetize it: stop asking what feature you can charge for. Ask who would miss you if you stopped showing up. That answer is your product.</p>
The clone has your code. It will never have your Tuesday.</p>

Monetize OSS

Maintenance Is the Last Moat

The 8 Ways to Make Money from Open Source (Ranked by How Long They'll Survive AI)

Why Nobody Will Pay for Code Anymore

The uncomfortable summary</h2> Code is free. Someone who will still be fixing it in three years is not.</p>