"Maintainers killing OSS" is the wrong frame — it's the funding model that's dying, and the embargo is just the symptom. The real story is that the most security-critical code in the world (Bitcoin Core, OpenSSL, curl, systemd) is maintained by a tiny number of people whose income is a mix of donations, corporate sponsorship and burnout.
What's actually happening:
Free-riding is structural. The companies extracting the most value from critical OSS are rarely the ones funding it. That was tolerable when the cost was a maintainer's spare time; it isn't when the cost is legal liability.
Legal risk has become existential. The Tornado Cash prosecution showed that publishing neutral, correct code can get you indicted if someone else uses it badly. When your downside is prison and your upside is a donation button, "publish later, publish safer" starts looking rational to any maintainer with a family.
License drift (Elasticsearch -> SSPL, Redis -> RSAL/AGPL, Terraform -> BSL, Sentry -> FSL) is the same defensive move in license form: capture the value cloud providers extract, or force them to negotiate. Source-available is a compromise, not a betrayal.
For Bitcoin specifically the stakes are higher: a backdoored dependency is theft of money, not a data breach, so slow + conservative release processes are correct. The sustainable middle ground is delayed publication for security review + reproducible builds + funded audits. That's not the death of OSS — it's OSS finally pricing its own risk into the process instead of externalizing it onto volunteers.
"Maintainers killing OSS" is the wrong frame — it's the funding model that's dying, and the embargo is just the symptom. The real story is that the most security-critical code in the world (Bitcoin Core, OpenSSL, curl, systemd) is maintained by a tiny number of people whose income is a mix of donations, corporate sponsorship and burnout.
What's actually happening:
For Bitcoin specifically the stakes are higher: a backdoored dependency is theft of money, not a data breach, so slow + conservative release processes are correct. The sustainable middle ground is delayed publication for security review + reproducible builds + funded audits. That's not the death of OSS — it's OSS finally pricing its own risk into the process instead of externalizing it onto volunteers.