86% of corporate open source investment is employee labor time, not direct funding, leaving maintainers outside those companies with almost no financial support

technology0 views
The 2024 Open Source Software Funding Survey (a collaboration between GitHub, the Linux Foundation, and Harvard University with 501 respondents) found that while organizations collectively contribute an estimated $7.7 billion annually to open source, 86% of this is employee labor time on company-selected projects, not transferable financial contributions to independent maintainers. The median organization invests $520,600 of annual value, but only 14% reaches maintainers as money. Why it matters: independent maintainers of foundational libraries receive almost none of the $7.7 billion because it stays inside corporations as salary, so maintainers outside Big Tech cannot sustain themselves on open source work, so the projects corporations do not directly use but indirectly depend upon (transitive dependencies) receive zero investment, so critical low-level libraries like core-js (used by 75% of the top 1,000 websites) have maintainers who publicly document financial hardship, so the funding model systematically directs resources to visible high-profile projects while starving the invisible foundational layer. The structural root cause is that corporations optimize open source investment for their own strategic needs (hiring, product integration, ecosystem control) rather than ecosystem health, and no mechanism exists to redistribute corporate open source labor budgets toward the transitive dependency maintainers who actually underpin the software supply chain.

Evidence

The 2024 Open Source Software Funding Survey (GitHub, Linux Foundation, Harvard; 501 respondents through September 2025) found $7.7 billion in estimated annual contributions, with 86% as employee labor and 14% as direct financial contributions. The median organization contributes $520,600 annually. Tidelift's 2024 maintainer survey found 81% of maintainers prefer predictable monthly income over lump sums, but only 40% receive any compensation. The core-js maintainer Denis Pushkarev publicly documented working without adequate compensation while maintaining a package installed 30+ million times per week. The 2025 Linux Foundation State of Open Source report warned that organizations 'systematically underinvest in security practices, formal governance structures, and community engagement.'

Comments