By Matt Busel, who built the apps, crates and game he writes about · every number links to its source and every dataset is downloadable (methods) · corrections · featured in Kirino, gamebiz, This Week in Rust, New Mobile Life, By-Press
Open source is an unpaid utility, and the EU just sent the bill
On this page · 9 sections
Short answer: Companies get an estimated $8.8 trillion of value from open source software that would cost $4.15 billion to build once, and the people who write it are mostly not paid for it. Europe's Cyber Resilience Act does not change that. It adds a compliance layer with fines up to EUR 15 million on top, and our bet is that the cost rolls downhill onto the maintainers it claims to protect.
TL;DR: Ten Rust crates on crates.io have more than 18 billion downloads between them, and four of the top six list a single owner entry. Germany, the country most serious about paying for this layer, budgeted about EUR 22 million for it in its best year, against an $8.8 trillion dependency. The fix is not another security law; it is buyers paying for what they run, and every builder can start this week.
Key numbers
| What | Number | Source, checked Oct 26 2026 |
|---|---|---|
| Demand-side value of widely used open source | $8.8 trillion | Hoffmann, Nagle, Zhou, HBS |
| Cost to write that same software once | $4.15 billion | HBS Working Paper 24-038 |
| Share of value created by 5% of developers | 96% | HBS Working Paper 24-038 |
| syn all-time downloads (one owner entry) | 2.79 billion | crates.io |
| hashbrown downloads, last 90 days | 799 million | crates.io |
| Germany Sovereign Tech budget, 2023 | about EUR 22 million | Wikipedia |
| Cyber Resilience Act max fine | EUR 15M or 2.5% of turnover | Wikipedia |
| xz backdoor severity score | 10.0 of 10 | NVD, CVE-2024-3094 |
The economy runs on a utility nobody bills for
A Harvard Business School team (Manuel Hoffmann, Frank Nagle and Yanuo Zhou) priced open source two ways. Writing the widely used code once: $4.15 billion. Replacing it inside every firm that uses it: $8.8 trillion.
Their other finding is the one that matters. Firms would spend 3.5 times more on software if open source vanished, and 96% of that value comes from just 5% of the developers.
That is a utility. Power, water and roads are billed. This one is mostly a gift, and the gift is concentrated in very few hands.
Billions of installs, a handful of names
We pulled the crates.io API for ten of the most downloaded Rust crates on Oct 26. Together they have more than 18 billion all-time downloads.
syn, the parser almost every Rust macro depends on, has 2.79 billion downloads and one owner entry: David Tolnay. serde, the default way Rust reads and writes data, adds 1.59 billion, with Tolnay plus a publishing team. memchr has 1.62 billion downloads and one owner, Andrew Gallant (BurntSushi), who also co-owns regex.
To be fair to the data: an "owner entry" on crates.io can be a team, and hashbrown and libc are owned by the Rust project's own account, not one person. Contributors are more than owners. But the people who can ship a release, and who get the 3 AM bug report, are a short list.
Seven hundred and seventy-four million downloads of syn in 90 days. If a company paid a tenth of a cent per thousand installs, that is a salary. Almost nobody does.
The xz warning everybody read wrong
In March 2024 a backdoor was found in xz Utils, a compression library inside most Linux systems. NVD scored it 10.0, the maximum.
The record is clear on how it got there. A user called "Jia Tan" spent over two years, starting in 2021, earning trust, while sock-puppet accounts pressured the burned-out original maintainer, Lasse Collin, until Jia Tan got release rights.
The establishment lesson was "supply chain security": more scanning, more paperwork, more rules. The actual lesson is simpler. One unpaid person was holding up half the internet, and the attackers were the only ones who showed up to help.
Follow the money: who wins, who loses
The European Union's Cyber Resilience Act entered into force on Nov 12 2024 and applies from Dec 11 2027. It sets security rules for any "product with digital elements" sold in the EU, with fines up to EUR 15 million or 2.5% of worldwide turnover.
Here is the steelman, and it is a real one. The law says fines do not apply to non-commercial open source developers. It even invented a lighter category, the "open source steward", for foundations. Unmaintained code really is a security hole, and somebody should be accountable for shipping it.
Now follow where the cost lands. The manufacturer carries the liability, so the manufacturer's lawyers send it downhill: questionnaires, SBOM demands, vulnerability-response deadlines, "please confirm your project is CRA compliant." That pattern is our reading, not a measured fact yet. But the target of those emails is the same short list of maintainers in the chart above, and the law pays none of them.
Who wins? The big vendors with compliance departments. Compliance is a fixed cost, and a fixed cost is a moat. A EUR 15 million fine terrifies a ten-person startup and barely registers at a trillion-dollar company. Every security regime that taxes paperwork instead of paying builders ends up protecting incumbents.
The only government that pays is a rounding error
Germany is the honest exception. Its Sovereign Tech fund, now the Sovereign Tech Agency, actually writes checks to maintainers: about EUR 13 million in 2022, roughly EUR 22 million in 2023, and up to EUR 16 million expected for 2024.
Real money went to real projects: EUR 195,500 to cURL, EUR 157,580 to FFmpeg, EUR 1 million to GNOME. Good. Now set EUR 22 million against an $8.8 trillion dependency. The best public program on Earth for this problem is a rounding error.
So the score in Europe reads like this: the fine ceiling for one company is close to Germany's entire yearly budget for paying the people who write the code. One side of the ledger has teeth. The other has a grant form.
The twist: the safest supply chain is a paid one
Regulators frame open source as a risk to be managed. Builders should frame it as infrastructure to be bought.
A maintainer with a salary answers the security report, has time to review the stranger's pull request, and does not hand release keys to a friendly account that showed up when they were exhausted. Paying for what you depend on is the cheapest insurance in software, and nobody else will sell it to you.
Our bet: within a few years, the serious companies will budget for their dependency tree the way they budget for cloud bills, because a paid maintainer is a faster compliance answer than any audit. The ones that keep free-riding will meet the next Jia Tan first.
This is the bigger point. Knowledge that runs the world should not depend on charity and burnout. Pay the people who build it and the whole stack gets faster, safer and freer. Read more of our takes on the opinion page, the Rust desk and our crates hub, plus our earlier piece on who really writes the AI sandbox walls.
What this means for you
Run cargo tree (or npm ls, or pip list) and find the five packages your product could not ship without. Sponsor the people behind them this week, even at $10 a month, and put it in the budget as insurance, not charity. If you sell into Europe, start your CRA list now: December 2027 is closer than your next rewrite.
And if a dependency breaks your build today, do not wait on an unpaid volunteer. Our paid fixes take your Rust or AI API error and fix it within 24 hours, or you get a full refund.
Sources
- Hoffmann, Nagle, Zhou, "The Value of Open Source Software", HBS Working Paper 24-038, checked Oct 26 2026
- crates.io API, crate and owner endpoints for 10 crates, pulled Oct 26 2026
- NIST NVD, CVE-2024-3094, checked Oct 26 2026
- Wikipedia, XZ Utils backdoor, checked Oct 26 2026
- Wikipedia, Cyber Resilience Act, checked Oct 26 2026
- Wikipedia, Sovereign Tech Agency, checked Oct 26 2026
First published here on tensorust.com on Oct 26, 2026. Related: Opinion, Crates hub, Rust.
Up next
More on OpinionVPN bans: the age check was never the point. Encryption wasUK age checks sent VPN interest up 2.4x in four days. Michigan now wants ISPs to block VPNs. The age check was the opener; encryption is the target.Read it next →Cite this
Free to cite and reuse under CC BY 4.0 with a link back. How it was collected: methods. Spotted an error? Corrections.
Did this answer your question?
Get the next one by email.
What my AI agents tried this week, with the real numbers: what worked, what flopped, what made money. One email when there is something worth reading.
No spam, never sold. Every email has a one-click unsubscribe.
What are people saying about this? Read and post on The Floor →
More: the author, related reading, share this, a free game
Try it yourself · Rust dev?
Check a crate before you depend on it
Release health, reverse deps, real downloads and the alternatives for 1000 crates.
In The Manual: on this topic
Explainers answer one question, short answer first. Guides walk you through it step by step.
- Explainer · Money and the economyWhat is an at-the-market offering, and why is Meta planning a $60 billion one?
- Guide · Rust and cratesHow to check your Cargo.lock for vulnerabilities with cargo audit
- Guide · Rust and cratesHow to vendor Rust dependencies with cargo vendor for offline builds
- Explainer · AI, LLMs and agentsClaude Code vs Cursor: what each costs now that SpaceX owns Cursor
Read next
- Economics · Oct 26, 2026 · 5 min readAI data center water panic: US home leaks waste 53x more
- Economics · Oct 26, 2026 · 7 min readRealtor commission: NAR's lobby money says AI agents are the threat
- AI · Oct 26, 2026 · 7 min readVPN bans: the age check was never the point. Encryption was
.jpg){kind=link}