Open source has always allowed businesses to profit from software they did not write. Take nginx, the open-source web server behind so many business websites. An online retailer can use it to help run a profitable shop without paying a licence fee for nginx itself or sharing its earnings with the developers. Its BSD licence permits that commercial use. The software can be essential to a company’s business, yet the company has no obligation to contribute towards its continued development and maintenance.
AI coding assistants have added a new twist to this arrangement. Companies have trained models on publicly available source code and built subscription businesses around the results. The developers behind those projects still have bugs to fix, users to help and security reports to investigate, whether any subscription income reaches them or not. I find it hard to accept that pointing to the licence should end the discussion. If a company can build a profitable service partly from their work, asking it to help fund the maintenance seems reasonable enough.
Thanks for the Code. Now Pay Us.
Microsoft has secured an enviable position. Developers use GitHub to publish software, fix bugs and review each other’s work. Microsoft owns the platform and sells an assistant trained partly on public GitHub code. The community supplies years of accumulated knowledge; Microsoft gets another subscription product. Building that product takes considerable engineering, but so did building the software it learned from.
GitHub offers free Copilot Pro access to eligible maintainers of popular open-source projects. Useful, certainly. As an answer to the funding problem, it is almost comically inadequate. A project needing a security audit cannot pay the auditor with a free Copilot account. Access to the product is a perk. Supporting the work that helped make the product possible requires rather more commitment.
Transparency Is Apparently for Other People
Is it unreasonable to expect projects making substantial use of generative AI to disclose it publicly? A developer cannot simply ask users to trust that everything is fine. I see no reason to extend that courtesy to the companies supplying the models. “Trained on publicly available code” leaves unanswered which licences were accepted, how they were checked and what happened when the licensing was unclear.
BigCode’s original Stack dataset provided information about its sources and a mechanism for requesting exclusion. That approach has limitations, including the inability of a later exclusion to undo earlier training, but it gives developers something to examine. Companies should explain their procedures clearly enough for maintainers to challenge them. Expecting openness from the people supplying the code while offering vague assurances about its use is a remarkably convenient standard.
Somebody Else Gets the Extra Work
curl shows what happens when producing a report becomes easier than investigating it. Daniel Stenberg described AI-generated security submissions that consumed hours of his team’s time. Later, he reported much better submissions, with AI-assisted analysis finding genuine problems. The workload still grew: somebody had to investigate, fix, test and release the software.
Those discoveries are valuable. They also expose the missing person in the productivity sales pitch: the maintainer receiving the output. A user can generate a patch or report quickly, then hand the expensive checking to somebody else. Count only the time saved by the person using the assistant and almost any tool can look productive. The hours spent dealing with its output belong in the calculation too.
Put It in the Budget
AI companies could pay maintainers, fund security reviews and support neglected dependencies. They could help check generated contributions before encouraging users to submit them. There is no need to calculate a royalty for every function: talk to projects, identify useful work and pay for it. Publish the contributions so people can judge whether the support amounts to much.
I am tired of maintenance being treated as a charitable cause while the products built from shared software are treated as serious businesses. If a company can budget for GPUs, research and sales staff, it can budget for upstream development. The people keeping those projects alive should not have to pass round a donation link while being invited to admire the next breakthrough in developer productivity.
If AI companies can make billions from open-source code, why are the people maintaining it still expected to work for free?
Please read our Comment Policy before commenting.