A little while ago, one of the most important pieces of software on the internet — a compression library sitting quietly inside millions of servers — was nearly handed to an attacker. Not through a brilliant hack, but through patience: someone spent two years being helpful in a volunteer project until its exhausted, unpaid maintainer trusted them with the keys. We caught it by luck. Everyone gasped, patched, and moved on. Almost nothing changed.
That near-miss wasn’t really a security story. It was an economics story wearing a security costume — and the bill just got a lot bigger.
The plumbing nobody owns
Open your app’s dependency tree and actually look at it. A modern product — a bank’s, a hospital’s, a startup’s — rests on hundreds of open-source packages. Trace them down far enough and you keep landing in the same place: some critical brick in the foundation is maintained by one or two people, for free, in the hours after their day job, with no contract and no one to call when they burn out. There’s a famous cartoon of the entire digital economy balanced on a tiny block some random person in Nebraska has been thanklessly maintaining since 2003. It’s funny because it’s the actual architecture.
This is a commons: shared infrastructure everyone draws from and almost no one pays into. And commons have a well-known failure mode. Everyone has an incentive to use the resource and none to maintain it, so it quietly degrades until the day it doesn’t hold — and then it fails for everyone at once.
Why this stopped being ignorable
For years this was a slow-motion problem we could look past. AI made it acute. The models now writing a fast-growing share of the world’s code were trained on this exact volunteer-maintained commons — billions of lines of open source, absorbed and resold as autocomplete, with nothing flowing back to the people who wrote and still maintain it. And the agents everyone is racing to deploy lean on that same plumbing harder than any human team ever could: more calls, more dependencies, more load on libraries whose maintainers are, somehow, still volunteers.
We’re extracting from the commons at machine speed while funding it at hobby speed. That gap is the whole story.
The free-rider math
A trillion-dollar industry runs on infrastructure maintained by people earning nothing for it. As long as it holds, every company standing on it is collecting a subsidy — paid in the unpaid nights and weekends of strangers. That subsidy isn’t free. It’s deferred, and it gets collected all at once, on the worst possible day.
Where we sit — and how the math could change
We build on this stack every day at Rebel Studios, which means we carry its risk into everything we ship. When we choose a dependency, the real question isn’t “does it work?” — it’s “who is holding this up, and what happens to us the day they stop?” That’s the second-order habit: your software is only as durable as the least-funded thing it quietly depends on.
Here’s the part that might actually help, and it’s closer than it looks. The same machine-payment rails that let an AI agent pay a few cents for an API call could, in principle, let it pay the maintainers of the libraries it’s built on — value flowing back down the dependency tree automatically, per use, with no foundation and no fundraising drive. We spend our days building for a web where software pays software. The maintainers holding that web up are the most obvious people who should get paid first.
The question underneath
The internet’s most critical software is, functionally, a charity most of us quietly stopped donating to — and then asked to work twice as hard. That isn’t sustainable, everyone building on it knows it, and almost no one is fixing it.
So the question isn’t whether a piece of the plumbing eventually gives out under the weight. It’s who’s standing under it when it does — and whether we built anything that lets value flow back before then. What’s actually holding up your stack, and would you even notice if the person maintaining it walked away?
We build software with a clear eye on what it truly depends on — and toward a web where value can flow back down to the plumbing. That’s what we do at Rebel Studios.