Outlier.Systems Reading 04 · The open-source commons · Oct 2026

Semble Sense · Reading 04

The attention nobody pays for.

The libraries the world's software runs on are worth about $8.8 trillion to the firms that use them and would cost about $4.15 billion to write again. They are held by people who are mostly not paid to hold them. Three in five maintainers earn nothing for the work, the money arrives after the incident, years late, and the stock that runs out is attention, not code. This is how that system holds, and where it is pushed in the wrong direction.

R1, the proof: a library in use earns trust, and trust earns use. B1, the limit: use brings asks, asks divide one person's attention, and attention lost costs trust after months. B2, the late payment: attention lost breeds incidents after years, incidents bring money, and money buys attention back, after the fact. Money also funds the security work that keeps incidents down. The lever sits where the money enters.

Altitude one · The structure

Three stocks, and the one that runs out.

Three stocks hold the system. Libraries in use: a 2024 Harvard Business School study put the value of widely used open-source software at $8.8 trillion on the demand side, what the firms using it would otherwise have to spend, against $4.15 billion on the supply side, what it would cost to write once. Five percent of the developers produce 96 percent of that value. Trust in a library: it compounds with adoption, because adoption is the proof, and it collapses in a day. Attention per ask: the one stock that cannot be minted. A library with more users has more issues, more pull requests and more pressure, and the same number of people reading them.

The fourth stock is money, and it is small. Tidelift's 2024 survey of maintainers found 60 percent unpaid for the work: 44 percent would like to be paid, 16 percent would not. Among the paid, the money comes from donations, from employers who count the maintenance as part of the job, and from Tidelift itself, in roughly equal shares. Public money exists and is young: Germany's Sovereign Tech Fund has put €24.6 million into more than sixty projects since 2022, at a minimum of €50,000 each, and its 2025 budget is about €19 million. In Bitcoin, where a bug is a loss of money, Brink pays for the work of Bitcoin Core's six maintainers and eight full-time engineers, on donations.

Trillions in use, millions in funding, and the people in between. The ratio is the system.

Altitude two · One maintainer

Six hundred milliseconds.

xz is a compression library inside most Linux systems, and for years one person held it. In 2022 that person wrote on the project's list that his resources were too limited and that something had to change in the long term. A new contributor had appeared the year before with patches and patience. Other accounts arrived to press for faster merges and a second maintainer. By early 2023 the new contributor was a co-maintainer, and by March the project's fuzzing account answered to his address.

In February 2024 he shipped a backdoor in two releases. It was found on 29 March by an engineer at Microsoft who was not looking for it: his SSH logins had slowed by about half a second and the daemon was using more processor than it should. He pulled the thread, and the distributions rolled the releases back within days.

Nothing in that story is a failure of code. A tired person asked for help, help arrived, and the only signal that something was wrong was a delay small enough that one engineer noticed it. Log4Shell, in December 2021, was the same shape at a larger scale: a logging library in a great part of the world's Java, a flaw scored at the maximum, and a handful of volunteers at the centre of it when the world turned to look.

The trap

Counting the code and calling it the commons.

The usual story is Hardin's tragedy: a shared pasture, overgrazed because nobody owns it. The story misreads its own example. The English commons were bounded and governed, and Ostrom spent a career showing that shared resources survive when they have boundaries, costs in proportion to use, monitoring and graduated sanctions. Open access is not a commons; it is the absence of one.

The trap follows from the misread. If the commons is the code, the fix is to protect the code: scanners, badges, lists of critical projects. If the commons is attention, the fix is to pay for attention, and the scanners only add asks. The second trap is the fix that works: an incident brings money, the money is real, and it arrives years after the attention it replaces was gone. A system whose only feedback is the incident learns to wait for incidents.

Where to push

Rung five: pay in proportion to use, before it breaks.

On Meadows' ladder the strongest push here is a rule, rung five, and the rule is Ostrom's second principle: those who draw most from a commons pay most to sustain it. The money should enter where the use is, not where the incident was. The two working models already exist. A public fund that pays maintainers directly, in grants large enough to be a salary, with the state as the proportional user it is. And a field fund that pays a library's keepers because the field cannot afford the loss: Brink is the clearest case, and it is small enough to copy.

Two rungs higher sits the goal move: fund attention, not features. A grant that buys a roadmap buys more asks for the same person. A grant that buys a second maintainer buys the thing the system is short of.

ASENSE, in the map below, ranks the push one rung higher than we do: rung four, let the maintainers form a commons of their own that sets the proportional rule and the sanctions, Ostrom's collective choice. We stay at five. A rule a funder can adopt this quarter is worth more than a commons that has first to form, and the first pays for the second.

What happens second

The paid maintainer gets more asks.

Money is visible. A funded project draws contributors, users and requests, and within a year the attention per ask has fallen back to where it was, with more at stake. The second push is the one the first was for: succession. A fund that pays one person should be paying for the second person at the same time, and the sign that it is working is a maintainer who can take a month off.

The other second-order effect is in the attackers' loop. xz was not an exploit of software; it was an exploit of a person's exhaustion, and the campaign ran for two years. Pay the attention and the campaign has nothing to press on.

For a builder

What your dependencies are part of.

This is a systems reading, not a purchasing guide. A builder is not outside this system; every import is a draw on someone's attention, and every product built on a library is one more reason that library is trusted. The things to watch, and what we expect:

What we would be wrong about

We drew money as attention. It may be asks.

We drew the money stock as the thing that buys attention back. It may buy asks instead: funding announces a project, and a project that is announced is a project that is asked more of. If that is the larger effect, the lever moves one body to the left, from the funder to the rule about who may ask, and the second maintainer matters more than the first grant. The ratio we opened with, trillions to millions, is a modelled estimate from one working paper, and the reading does not depend on its size, only on its sign.

The facts we used

Everything else in this reading is structure, and the structure is ours to be wrong about.

If a fact here is wrong, tell us which one and where you read otherwise. A correction goes in with the date.

The system, drawn by the engine

Seven bodies, five loops, one lever.

The same system as the figure, drawn by ASENSE through her passes and by the engine that draws One System: the bodies on a shape, the stocks they fill with their levels, every flow with its signal, the loops marked R or B, the lever where she ranked it. Tap any part to open it; drag it to move it; pick another shape and the parts glide; press World and the map runs as a world with a clock, the stocks moving and the lever in your hand.

Reading 04 · the system

Read with ASENSE. She researched the frame, drew the system and ran it through her passes, a second pass re-read every figure against its source, and a human argued with both. If a loop like this runs through your build, your fund or your library, the first hour is $40.

Where we stand: we build on open-source libraries every day, we maintain a few, and we are paid for almost none of that maintenance. This reading is about us too.

Every reading is here. · Reading 03, the masternode economy · Reading 02, the treasury