On September 23, 2025, several open-source organizations published the open letter »Open Infrastructure is Not Free: A Joint Statement on Sustainable Stewardship«. The message is that public software infrastructure is fundamental to the digital economy, but it is not free.
What’s at stake
Public package registries like Maven Central, PyPI, crates.io, or Packagist underpin the software supply chains Running them requires people, hosting, and security — costs that have so far often been borne by a few organizations or volunteers Expectations are rising, for example around availability, signing, compliance, and protection against abuse What’s being called for are models where large users contribute more, without restricting openness I can empathize with the pain described and at the same time see the dilemma. Those who invest time or money take on responsibility, but by doing so also put themselves at a competitive disadvantage compared with those who use everything for free. That’s manageable for large companies, but barely feasible for small firms in fierce competition. Still, it remains indisputable that the infrastructure — and the ecosystem — will not be sustainable in the long run without contributions.
...