That free beer has a brewer

Last week two serious PHP flaws sent a lot of people scrambling to patch their servers, if you haven't heard¹. They're two unauthenticated remote code execution bugs in the PHP core itself, CVE-2026-109618 and CVE-2026-109619, both rather severe.

The same day, Elizabeth Barron, who runs the PHP Foundation, told Reuters that the foundation has one full-time employee: her. Everyone else is a part-time contractor, fourteen of them. The foundation's own 2024 report puts its income for the year at about $684,000. That is the budget supporting the runtime under something like seven of every ten websites².

Barron followed up on LinkedIn with a line that resonates: the code you use might be free, she wrote, but the labor to sustain it is not, and somebody had to brew, bottle, store, and serve that free beer. It exposes a phrase we all use without meaning anything by it.

What "information economy" doesn't mean

We say "information economy" and we usually mean an economy in which information is the product. Then we treat it like any other product: priced, consumed, used up. Every part of that is wrong, and wrong in a way that explains Barron's one employee.

Information is non-rival. My having it does not reduce your having it, and a thousand people reading the same information costs nothing. It's just there now. Nothing about information is scarce unless somebody makes it scarce. An economy is a system of exchange, and in a system of exchange built on a non-rival good, manufactured scarcity shrinks the thing. The economy grows when information moves and contracts when it is held still.

So an information economy is not an economy of scarce information. It is an economy that works best when information is shared, which is the opposite of how we tend to behave in it.

Why we hoard anyway

Kenneth Arrow worked this out in 1962, in something called Arrow's information paradox, something I'd never heard of until very recently. It goes something like this: a buyer cannot know what a piece of information is worth until they have seen it; once they've seen it, they have it, and they no longer need to buy it. The market for information fails at the point of sale, every time, by construction.

That is the experience most of us have had with a discovery. You find something new and useful. You share it openly, because that is what the economy wants³. The response is "great, I'll use that." The response is almost never "fantastic, what do I owe you?" Sharing gets punished, and the punishment is that the sharer sees nothing back. Hoarding is the rational reply to a market that has no mechanism for reward.

Intellectual property is the same reply at institutional scale: a legal fiction of scarcity, built so that a reward can exist where the market would otherwise provide none. I don't think IP is illegitimate and I don't think discoverers should go unrewarded - at all. But neither hoarding nor IP is the economy. They are what people do when the economy fails to clear.

Where the failure shows

Open source is where the information economy runs without the fiction. The code is shared, the scarcity is gone, and ... so is the reward mechanism. What is left is the free beer: consumption at zero price, and labor that somebody still gets to perform. For a long time the labor was cheap enough, or the people doing it were motivated enough, that the arrangement held.

Two things have changed. Consumption got much cheaper. A dependency is one line in a build file, and nobody reads the file - or the dependency. And the consumption started generating work. Barron told Reuters that PHP is receiving nearly twice as many proposed code changes as it did a year ago, mostly generated with AI tools, while the number of people able to review them has not doubled. The consumers now manufacture demand on the maintainers at potentially massive scale, with tools built by the companies best positioned to pay and least inclined to.

The JVM is an exception⁴. OpenJDK is Oracle's payroll, with Red Hat, Amazon, Microsoft, Azul, and SAP lending salaried engineers. The core runtime is one of the best-funded open source projects there is. One layer down, the picture is PHP's. Log4Shell was a handful of volunteers at Apache holding up half of enterprise Java. Jackson is still, to a first approximation, one person. The same build file that pulls in a runtime with hundreds of paid engineers pulls in forty libraries with none.

Ouch.

What clearing looks like

Money is the obvious coin, and it is the best one, because it is measurable and a "thank you" does not put food on the table⁵. The mechanisms exist: GitHub Sponsors, Open Collective, Tidelift, Patreon, Ko-fi. Add them up for any project you depend on, and you'll find numbers that barely cover Starbucks, much less a single engineer's salary. That's a measurable that says "this is what the market thinks the labor is worth," but without that labor the entire market falls apart. The market's not just wrong, it's catastrophically wrong.

But money is not the only coin, and most of us do not have much of it to spend. I run ByteCode.News on my own time. Nobody pays me for the issues I file or the branches I read, and so the pool I can share from is smaller than I would like. What I have is attention, and attention turns out to be convertible.

Think of it as a ladder.

The bottom rung is nothing: you use the thing and move on. Most of us live here, including me: I use a lot of software libraries.

But above that is thanks: a star, a note, a line in a README.

Above that is thanks with an observation: here is what I did, what I saw, what I expected, and what I did to get unblocked.

At the top is money.

Each rung costs the giver more than the one below and is worth more to the receiver, and most people don't even bother to climb to the second rung, much less the third or fourth rungs.

I know that because of how maintainers react when somebody does try to climb that ladder. A few weeks ago I asked a question of a library I use. The maintainer answered the next day, and in the course of answering mentioned that his download numbers were high and his user feedback was nearly nonexistent.

I sent back a version-by-version comparison of what I'd observed and what I expected. He shipped a branch addressing it the same day. I read the branch and sent notes. That is what clearing looks like at the scale of two people: I "paid" in a report⁶, he paid in a fix, and both of us came out ahead, which is what an economy is for.

My template, for what it is worth, has four parts and a coda. What I did, what I observed, what I expected, and what I did to work around it, if anything. And then, in whatever words fit the thread: I accept that it is not my project, and if what I am doing does not fit the project's vision, so be it.

That last sentence costs nothing and pays the maintainer first, because the thing most reports carry, unstated, is "you owe me." A report that cancels the debt before it is read feels a lot more like a gift, and gifts are how this economy actually runs.

The brewer

I'm generally pretty amiable, but this bothers me a lot: the people who understand this economy best are the ones with the least money in it.

The long tail of open source pays itself in the only coin it has, attention and care and the occasional careful bug report, while the companies that could pay in dollars mostly pay in nothing⁷. When they do pay, the money goes where their own dependencies are, which helps but not enough; those dependencies have dependencies.

So the phrase is real after all. We do live in an information economy. We just mostly participate as passive consumers only, and when we do we don't pay in money, and anyone who only counts the money will conclude that open source is free and be surprised when it breaks.

The next time something free saves you a day, pay something back. Thanks is better than nothing. Thanks with an observation is better than that. Money, if you have it. The beer had a brewer, and with no brewer, there's no beer.