I think the burnout is kind of related to money, but more about expectations - and demands - of your users as it grows.

Once a free or OSS project becomes really popular, you suddenly start getting a lot more people asking suppor questions, asking for new features, calling your project crap because it doesn't do X, etc.

I think that's the point where burnout starts to be an issue, because you have to spend so much time to satisfy your users, and because you invariably have to put up with crap from very rude users. At this point, you might start to think about monetising your project - after all, you're spending a lot of time on it. And of course, it's extremely likely you will fail here.

> the purest intent of doing it for sheer joy or scratching your own itch...

...is great for as long as the joy or itch lasts. But the same problem still occurs, at some point a single maintainer is going to lose enthusiasm or have other itches they want to scratch. This becomes especially true when maintenance starts to feel more like a chore.

And in open source projects it can get even worse. Github users can be especially demanding and there are often those who express their demands in very "confrontational" ways. Faced with that it can be difficult to remain invested.

I dunno. I think I'd start maintaining again several of my popular-but-not-maintained projects even if they paid only $1/month each. There's something about being rewarded, materially, for your work that's personally motivating.

I'd love to be able to say "people appreciated all the work I did the past year, so they paid me $12 for this awesome annual meal"

From [1], which is a fascinating piece:

Serge quickly discovered, to his surprise, that Goldman had a one-way relationship with open source. They took huge amounts of free software off the Web, but they did not return it after he had modified it, even when his modifications were very slight and of general rather than financial use. “Once I took some open-source components, repackaged them to come up with a component that was not even used at Goldman Sachs,” he says. “It was basically a way to make two computers look like one, so if one went down the other could jump in and perform the task.” He described the pleasure of his innovation this way: “It created something out of chaos. When you create something out of chaos, essentially, you reduce the entropy in the world.” He went to his boss, a fellow named Adam Schlesinger, and asked if he could release it back into open source, as was his inclination. “He said it was now Goldman’s property,” recalls Serge. “He was quite tense. When I mentioned it, it was very close to bonus time. And he didn’t want any disturbances.”

Open source was an idea that depended on collaboration and sharing, and Serge had a long history of contributing to it. He didn’t fully understand how Goldman could think it was O.K. to benefit so greatly from the work of others and then behave so selfishly toward them. “You don’t create intellectual property,” he said. “You create a program that does something.” But from then on, on instructions from Schlesinger, he treated everything on Goldman Sachs’s servers, even if it had just been transferred there from open source, as Goldman Sachs’s property.

(At Serge’s trial Kevin Marino, his lawyer, flashed two pages of computer code: the original, with its open-source license on top, and a replica, with the open-source license stripped off and replaced by the Goldman Sachs license.)

[1] https://www.vanityfair.com/news/2013/09/michael-lewis-goldma...

Indeed. In very deed.

I'd say it's a subset of a much more general situation. I don't know how best to analyze that situation. But some things seem clear: What we live in is far from a meritocracy. The current system does not incentivise moral behaviour. The current system does not incentivise productive behaviour. A lot of people will try their best to act morally and be productive anyway.

The leaks are trivial to compile, and the tech is very basic, anyone with enough scripting skills and alcohol can do it in under a month. The real value of HIBP is the owner's credibility in the security industry when it comes to offering a service that 'sounds like' it requires some trust (it really doesn't because you can use the service with data anonymization features).

The problem is he has been a complete failure on the business side. If he marketed it as 'you can fire 50% of your customer support if you stop account cracking using our service', charge per requests, and provided a bunch of code integrations there's no reason this couldn't be used by thousands of businesses, including top companies which have serious account cracking problems.

Chrome's password manager, doesn't use HIBP. Neither does Apple's implementation.

The barrier to collecting leaked dumps and compiling a database from them is not that high. Many of the security outfits and large tech vendors are doing it already.