Open source package repositories face sustainability crisis

"Fox revealed that last year, major repositories handled 10 trillion downloads. That's double Google's annual search queries if you're counting from home and they're doing it on a shoestring. Fox described this as a "tragedy of the commons," where the assumption of "free and infinite" resources leads to structural waste amplified by CI/CD pipelines, security scanners, and AI-driven code generation."

"So Maven and other open source repositories are considering introducing a tiered payment system. Lone developers and small groups will still be able to download the code for free, but the hogs will have to pay for every download. In other words, open source software is still free as in speech, but you can forget about being "free as in beer" going forward."

"Fox shared data showing 82 percent of Maven Central's consumption comes from less than 1 percent of worldwide IPs, with 80 percent of traffic from the big three hyperscalers. Making it even more troublesome, "IP addresses don't represent people. They're not even organiza""

Apache Maven and other open source repositories are experiencing overwhelming demand, with 82 percent of traffic originating from less than 1 percent of IP addresses. Major repositories handled 10 trillion downloads annually, straining infrastructure designed for individual developers. Companies are exploiting repositories as content delivery networks, downloading identical code hundreds of thousands of times daily. This represents a tragedy of the commons where assumptions of free and infinite resources create structural waste amplified by CI/CD pipelines, security scanners, and AI-driven code generation. To address sustainability, repositories are considering tiered payment models where individual developers and small groups maintain free access while heavy commercial users pay per download, shifting from free-as-in-beer to free-as-in-speech models.

Read at Theregister