Last year, I participated in a Birds of a Feather panel discussion at Devoxx. During this panel discussion, David Blevins explained:
"We have this fairytale idea that open source is an infinite resource, but it's not," Blevins said. An approach that was suggested is for developers to approach their organization's CTO and say to them: "Let's outsource all our software development to people we don't know" and then, when the CTO looks surprised and annoyed at the suggestion, say: "That's what we're doing already, shouldn't we get to know the organizations behind the software we're using?"
Source: Devoxx blog by Geertjan Wielenga
The panel discussion was inspired by the Heartbleed disaster, where the person who introduced the bug accidentally had to defend himself against the allegation that he introduced the bug intenionally. As it turned out, the piece of code that caused the problem was submitted on New Year's Eve. Another problem related to Heartbleed, was that the OpenSSL developers didn't make sufficient money to support their product:
"this team has a reported budget for all of their work of less than a million dollars, and through the course of this week —which you'd think would be a fairly important week for them— they have received $841 of donations. Which is sad. There's a section on the site here that says, if you give more than, I think, it's $20,000, we'll put your logo on our home page. There are no logos. No-one is giving these guys money."
Neither did they get sufficient support in general:
Unfortunately, despite very wide distribution and use by millions of users, OpenSSL does not have adequate support. In spite of its many users, there are very few who actively participate in the project.
The OpenSSL had to take all kinds of jobs and the software suffered from their lack of time, leading to... Heartbleed.
The response from the community was strange: large corporations suddenly started giving money (a fraction of the money they made by using OpenSSL), but... what about all the other open source projects they were using? I'm pretty sure there are other projects and developers that experience the same problem the OpenSSL developers had and that deserve financial support, but nobody cares about them.
This brings me to the question: isn't there a risk that every one will end up being an open source user and nobody will continue producing open source of companies do not pay for their use of open source software?