Last year, I participated in a Birds of a Feather panel discussion at Devoxx. During this panel discussion, David Blevins explained:We have this fairytale idea that open source is an infinite resource, but it's not, Blevins said. An approach that was suggested is for developers to approach their organization's CTO and say to them: Let's outsource all our software development to people we don't know and then, when the CTO looks surprised and annoyed at the suggestion, say: That's what we're doing already, shouldn't we get to know the organizations behind the software we're using?Source: Devoxx blog by Geertjan WielengaThe panel discussion was inspired by the Heartbleed disaster, where the person who introduced the bug accidentally had to defend himself against the allegation that he introduced the bug intenionally. As it turned out, the piece of code that caused the problem was submitted on New Year's Eve. Another problem related to Heartbleed, was that the OpenSSL developers didn't make sufficient money to support their product:this team has a reported budget for all of their work of less than a million dollars, and through the course of this week which you'd think would be a fairly important week for them they have received $841 of donations. Which is sad. There's a section on the site here that says, if you give more than, I think, it's $20,000, we'll put your logo on our home page. There are no logos. No-one is giving these guys money.Source: http://www.zdnet.com/article/heartbleed-soul-search-regulation-proposed-for-critical-crypto-code/Neither did they get sufficient support in general:Unfortunately, despite very wide distribution and use by millions of users, OpenSSL does not have adequate support. In spite of its many users, there are very few who actively participate in the project.Source: Bloody nose for open-source bleeding heartsThe OpenSSL had to take all kinds of jobs and the software suffered from their lack of time, leading to... Heartbleed.The response from the community was strange: large corporations suddenly started giving money (a fraction of the money they made by using OpenSSL), but... what about all the other open source projects they were using? I'm pretty sure there are other projects and developers that experience the same problem the OpenSSL developers had and that deserve financial support, but nobody cares about them.This brings me to the question: isn't there a risk that every one will end up being an open source user and nobody will continue producing open source of companies do not pay for their use of open source software?
Is the capacity of open source developers an infinite resource?
philosophy
You're not really saying open source is a finite resource (something I wouldn't agree with) but that open source developers are a finite resource. And yes, obviously the community can only do that much. It's pretty obvious that paid developers can do much more than people doing stuff in their spare time. A paid developer can work 8 hours a day, five days a week on a project. An unpaid developer has a few hours a day (if even an hour at all) and cannot find time for the project every day of the week. Besides this being a lot less time, the time is partitioned with other tasks (filling the refrigerator, making meals, calling insurance or mechanics, getting the kid from school, ...) and the focus is a lot worse than in an work environment. So yes, we can't expect volunteers to outdo commercial development in every aspect.I think there are two possible solutions here:As you suggest companies should pay more developers to work on open source or even better fund open source.The communities take tasks they can handle and reduce the workload by concentrating on the important. That includes we shouldn't expect everything from open source software, but only clearly focused core features.Both points can be combined for better results.By the way, the dilemma you describe is called the tragedy of the commons. The commons in this case are the developers willing to work in their spare time. Luckily the tragedy of the commons in classic sense does not completely apply, as the developers in question are humans that can decide which tasks to do, and which not.