Riding for Free: The Quiet Billion-Dollar Business of Taking From Open Source

The Foundation Nobody Billed For

There's a particular kind of business genius in building a skyscraper on land you didn't buy. You get all the height, all the views, all the revenue — and someone else quietly holds up the ground beneath your feet. That's not a metaphor. That's the operating model for some of the most valuable technology companies in the United States right now.

Open source software powers an estimated 96% of the world's codebases. It runs your bank's app, your hospital's records system, your favorite streaming service. And most of it was written by developers who donated their time, expertise, and nights and weekends to a shared commons they believed in. What a lot of those developers didn't fully anticipate was how efficiently a certain class of corporation would learn to monetize that commons without ever putting anything back in.

This is the extraction economy of open source. It's not illegal. It's barely even controversial in most boardrooms. But it's reshaping who gets to build technology, who profits from it, and whether the infrastructure holding everything up will still be there in ten years.

How the Pattern Actually Works

The mechanics aren't complicated once you see them. A company — let's say a major cloud provider — takes an open source database project, wraps it in a managed service, and charges customers a premium for the convenience of not having to run it themselves. The original maintainers get nothing. The community contributors get nothing. The cloud provider gets a recurring revenue stream that scales to billions.

Amazon Web Services and the Elasticsearch situation is probably the clearest recent example most US developers can point to. Elastic, the company behind the Elasticsearch search engine, spent years building and maintaining the project. AWS spun up a competing managed service using that code, called it Amazon Elasticsearch Service, and undercut Elastic on price by leveraging infrastructure advantages Elastic could never match. Elastic eventually responded by changing its license to restrict commercial use — a decision that sparked enormous controversy in the open source world and still hasn't fully settled.

MongoDB did something similar. So did Redis Labs. The pattern is consistent: a community builds something genuinely useful, a platform with massive distribution advantages picks it up, and the original builders are left choosing between watching their work get commercialized without them or making licensing changes that fracture their own communities.

And that's when the original builders even have a company behind them. Most open source projects don't. Most are maintained by individuals or small volunteer groups who have no legal or financial mechanism to push back at all.

The Power Imbalance Nobody Talks About Enough

What makes this dynamic so persistent is the structural gap between who builds and who distributes. A developer in Ohio who maintains a widely-used JavaScript library in their spare time has essentially zero leverage against a corporation with a market cap north of a trillion dollars. The license says the code is free to use. The corporation has a legal team. The developer has a GitHub repo and a day job.

There's also a cultural dimension worth naming. Open source has always been animated by a kind of idealism — the belief that shared knowledge makes everyone better off, that code should be free the way ideas are free. That's a genuinely beautiful principle. It's also one that certain business models have learned to weaponize. The same ethos that makes developers want to contribute freely is the one that makes them feel uncomfortable demanding compensation or recognition.

Some in the community call it the "volunteer tax" — the invisible cost that falls entirely on the people who care most, while the people who profit most pay nothing.

What Regulation Could Look Like

There's growing pressure, at least in policy circles, to think harder about platform obligations to the open source ecosystem. The European Union's Cyber Resilience Act has sparked real debate about whether commercial entities that profit from open source should bear some responsibility for its security and maintenance. In the US, the conversation is less advanced, but it's happening.

Some advocates are pushing for models where large platforms that generate significant revenue from open source dependencies would be required — or at least strongly incentivized — to contribute back. That could mean direct funding, developer time, security audits, or infrastructure support. The Open Source Security Foundation, backed by major tech companies, represents one voluntary version of this. Critics argue it's too little, too unevenly distributed, and still fundamentally dependent on the goodwill of the same corporations that created the problem.

Licensing innovation is another front. The Business Source License, the Commons Clause, and various "source-available" models are all attempts to give builders more control over who profits from their work. None of them are perfect. All of them involve tradeoffs that can alienate the open source purists who made the project valuable in the first place.

Cultural Shifts Are Already Underway

Regulation moves slowly. Culture sometimes moves faster. And there are real signs that the open source community is getting less patient with extraction.

Platforms like GitHub Sponsors, Open Collective, and Thanks.dev have made it easier for individual developers and companies to financially support the maintainers they depend on. Some larger companies — notably Google, Microsoft, and Salesforce — have made meaningful investments in open source foundations and maintainer stipends. It's not enough to close the gap, but it signals that the norm is shifting.

There's also a growing movement around "open source sustainability" as a legitimate engineering concern, not just a feel-good side issue. When a critical library goes unmaintained because its author burned out or couldn't afford to keep working on it, that's not just sad — it's a security risk and an infrastructure failure. Framing it that way gets it taken more seriously in boardrooms.

The Equation Needs Rebalancing

None of this means open source was a mistake. The collaborative model has produced some of the most important technology in human history, and it's done it faster and more openly than any proprietary alternative could have. The problem isn't the commons. The problem is the asymmetry — the gap between who builds the commons and who profits from it.

At NetBux, we think the answer isn't to make open source less open. It's to make the extraction less consequence-free. That means smarter licensing, stronger community norms, more meaningful corporate accountability, and yes, eventually, regulatory frameworks that reflect the economic reality of how software actually gets built and monetized.

The developers holding up those skyscrapers deserve better than invisible credit and a polite thank-you in a changelog nobody reads. The infrastructure they built is real. The value it generates is real. It's time the compensation got real too.