I've completed the research. Here is the full deliverable.

---

# The History of Open Source and Its Major Success Stories
**Research pack for `open-source.sgit.ai` — compiled 24 August 2026**

**Method note:** everything below was gathered with WebSearch and WebFetch only, as instructed. No other fetching method was used. Where a fetch failed or a host blocked me, I say so. Where sources disagree, I give both. Anything I could not verify is marked **[UNVERIFIED]**.

**Fetch failures encountered (reported, not worked around):**
- `redis.io/blog/agplv3-open-source-license/` → 404. Used antirez.com (primary, same author) instead.
- `stats.wikimedia.org` → "domain is cache-only and cannot be fetched."
- `openstreetmap.org/stats/data_stats.html` → blocked by robots.txt. Used the OSM wiki instead.
- `fsf.org/news/...machine-learning...` → robots.txt fetch timed out. Used LWN's account of the FSF position instead.
- `curl.se/docs/frequently-asked-questions.html` → 404; `curl.se/docs/faq.html` worked.
- `top500.org/statistics/details/osfam/1/` and `/statistics/list/` → navigation shells only, no data table returned. **I could not verify the "all 500 run Linux" figure directly.** See Myth #1.
- `en.wikipedia.org/wiki/Wikipedia:Statistics` returned a badly stale cache (5.5M articles, c. 2017). Used the `Wikipedia` article instead, which returned current figures.

---

## PART 1 — THE TIMELINE

### 1.1 Before free software: the sharing default (1955–1983)

| Date | Event | What it changed | Source |
|---|---|---|---|
| 17 Oct 1955 | **SHARE**, the IBM mainframe user group, makes its first documented software distribution | Establishes the *default* of the era: software is a by-product of hardware, exchanged freely between customers because none of them competes on it. Every later "open source" argument about non-differentiating infrastructure is a rediscovery of this. | [History of FOSS](https://en.wikipedia.org/wiki/History_of_free_and_open-source_software) |
| 1956 | **AT&T consent decree** settles the DoJ antitrust case. Bell Labs is barred from any business other than "common carrier communications services" and must license its patents on request | The single most consequential accident in software history. It made it *illegal* for AT&T to sell Unix as a product — so Unix shipped for the cost of media and postage. Open distribution here was a regulatory artefact, not an ideology. | [History of Unix](https://en.wikipedia.org/wiki/History_of_Unix) |
| 1961 | **DECUS** (Digital Equipment Computer Users' Society) founded; DECUS tapes become a worldwide free-software distribution system for DEC users | Extends the SHARE model to minicomputers and to universities, seeding a generation of programmers on shared source. **[UNVERIFIED — the 1961 founding date is widely cited but I did not confirm it from a primary source. Wikipedia's FOSS history mentions DECUS tapes in the early 1980s without a founding date.]** | [History of FOSS](https://en.wikipedia.org/wiki/History_of_free_and_open-source_software) |
| 1969 | **Unix** begun by Ken Thompson at Bell Labs on a PDP-7, with Dennis Ritchie, Doug McIlroy and Joe Ossanna | Creates the artefact that the consent decree would then force into open circulation. | [History of Unix](https://en.wikipedia.org/wiki/History_of_Unix) |
| 1969–1971 | ARPANET and the **RFC** series | Establishes rough-consensus-and-running-code, public specification drafts, and the norm that infrastructure standards are documented in the open. The governance grammar of open source is inherited from here, not from Berkeley. **[UNVERIFIED at date-level — I did not fetch a primary RFC-history source this session.]** | — |
| 1973 | Unix V5 licensed to educational institutions | Universities get source *with* the right to teach from it. | [History of Unix](https://en.wikipedia.org/wiki/History_of_Unix) |
| 1975 | Unix V6 licensed to companies for the first time; commercial licences reportedly ~US$20,000 | The price wall means Unix's real user base stays academic — which is why the culture stayed a sharing culture. | [History of Unix](https://en.wikipedia.org/wiki/History_of_Unix) |
| late 1970s | **Lions' Commentary on UNIX 6th Edition, with Source Code** circulates widely (officially suppressed, photocopied everywhere) | The first mass-distributed "read the source" artefact. Made Unix an educational example, and made source-reading a professional norm. | [History of Unix](https://en.wikipedia.org/wiki/History_of_Unix) |
| late 1970s–1980s | **BSD** at UC Berkeley; 4.2BSD/4.3BSD; Net/1 and Net/2 releases | BSD's network code "is the ancestor of much TCP/IP network code in use today" — the internet's plumbing came out of a university's free redistribution of a licensed codebase. Berkeley built BSD as an alternative precisely *because* commercial System III/V licensing was hostile to academic use. | [History of Unix](https://en.wikipedia.org/wiki/History_of_Unix) |
| 1982 settlement / 1983–84 | The second DoJ antitrust case ends the Bell System; AT&T is **relieved of the 1956 decree** and immediately commercialises **Unix System V** | The moment the sharing default dies. Unix becomes a product, licences tighten, and the vacuum this creates is exactly what GNU and later Linux fill. **Sources disagree on the year:** Wikipedia's *History of Unix* says the DoJ "settled its second antitrust case in 1983"; the settlement (Modification of Final Judgment) is more commonly dated to 1982 with divestiture effective 1 January 1984. Treat as "1982–84". | [History of Unix](https://en.wikipedia.org/wiki/History_of_Unix) |

### 1.2 Free software: the ideology arrives (1983–1991)

| Date | Event | What it changed | Source |
|---|---|---|---|
| Sept 1983 | Richard Stallman announces the **GNU Project** | Converts a disappearing norm into a stated ethical position. GNU's goal was a complete free Unix-compatible system — the "operating system" framing is why GNU produced compilers, shells and libraries that Linux would later need. **[Exact date 27 Sept 1983 is widely cited; I verified only the year.]** | [History of FOSS](https://en.wikipedia.org/wiki/History_of_free_and_open-source_software) |
| 1985 | The **GNU Manifesto** published | The first serious argument that software freedom is a user-rights question, not a development-methodology question. This is the fault line that 1998 splits along. **[Year verified; the March 1985 *Dr. Dobb's* publication is widely cited but I did not confirm it.]** | — |
| 1985 | **Free Software Foundation** founded | Gives the ethics an institution, a legal entity to hold copyrights, and eventually an enforcement arm. | [History of FOSS](https://en.wikipedia.org/wiki/History_of_free_and_open-source_software) |
| 1985–1988 | **Copyleft** invented, program-by-program, in the Emacs General Public License, and equivalents for GDB and GCC | The genuine intellectual invention of the era: use copyright law *against itself*, conditioning the right to distribute on passing the same freedoms downstream. Before this, "free" meant "abandoned to the commons and therefore capturable." | [GNU GPL](https://en.wikipedia.org/wiki/GNU_General_Public_License) |
| **25 Feb 1989** | **GPL version 1** published | Unifies the per-program copyleft licences into one reusable instrument. This is what makes copyleft *scalable* — a licence anyone can adopt without a lawyer. | [GNU GPL](https://en.wikipedia.org/wiki/GNU_General_Public_License) |
| **June 1991** | **GPLv2** and **LGPLv2** published | GPLv2 adds the "Liberty or Death" clause (if you can't satisfy the licence and other obligations simultaneously, you may not distribute at all) and becomes, for the next 20 years, the most important licence in software. LGPL creates the library carve-out that made glibc usable by proprietary software. | [GNU GPL](https://en.wikipedia.org/wiki/GNU_General_Public_License) |
| 1991 | **Linux** released as freely modifiable source by Linus Torvalds; relicensed under the **GPL** at version 0.12, **February 1992** | The GPL choice is the hinge of the entire story — see below. | [History of FOSS](https://en.wikipedia.org/wiki/History_of_free_and_open-source_software) |

**Why the GPL choice mattered.** Torvalds' original licence forbade commercial distribution. Switching to GPLv2 in Feb 1992 did three things simultaneously: (1) it made Linux legally safe for companies to sell and ship, which no "non-commercial" licence does; (2) it guaranteed that a well-resourced vendor could not take the kernel private and out-develop the community — every improvement had to come back, so IBM, Intel, Red Hat, Google and AMD were structurally forced into *cooperation* rather than differentiation; and (3) it made Linux legally compatible with the GNU userland that already existed. The counterfactual is visible in the same period: BSD, technically ahead, permissively licensed, and *simultaneously* mired in litigation (below) — vendors forked it privately (SunOS, BSD/OS) and the shared codebase fragmented.

### 1.3 The Unix wars and the BSD near-death (1992–1994)

| Date | Event | What it changed | Source |
|---|---|---|---|
| April 1992 | **USL v. BSDi** filed in New Jersey. Unix System Laboratories (AT&T) sues Berkeley Software Design Inc. and the Regents of the University of California over the Net/2 release — copyright, trade secret, trademark dilution | Puts a legal cloud over free Unix for roughly two years, precisely the two years Linux needed to establish itself. | [USL v. BSDi](https://en.wikipedia.org/wiki/UNIX_System_Laboratories,_Inc._v._Berkeley_Software_Design,_Inc.) |
| 1993 | Judge Dickinson R. Debevoise **denies** USL's preliminary injunction. AT&T had shipped UNIX/32V in 1978 without copyright notices on thousands of copies and did not register the copyright until 1992 — blowing the statutory deadlines | A procedural failure by AT&T, not a principled ruling, saved free Unix. Days later UC counterclaimed that USL had failed to credit Berkeley code inside System V. | [USL v. BSDi](https://en.wikipedia.org/wiki/UNIX_System_Laboratories,_Inc._v._Berkeley_Software_Design,_Inc.) |
| **Feb 1994** | **Settlement.** Of ~18,000 files in the Berkeley distribution, **3 were removed** and **70 had USL copyright notices added**. USL agreed not to sue users or distributors of 4.4BSD-Lite | The claim was almost entirely hollow — but the *uncertainty* had already done its work. This is the canonical case study in how legal risk, not legal merit, redirects an ecosystem. | [USL v. BSDi](https://en.wikipedia.org/wiki/UNIX_System_Laboratories,_Inc._v._Berkeley_Software_Design,_Inc.) |

### 1.4 The 1998 inflection

| Date | Event | What it changed | Source |
|---|---|---|---|
| 1995 | **Apache HTTP Server** first released, assembled from patches to the stalled NCSA httpd ("a patchy server") | Proves that a leaderless, company-neutral group can maintain critical infrastructure better than its original institutional owner. | [Apache HTTP Server](https://en.wikipedia.org/wiki/Apache_HTTP_Server) |
| 1997 | Debian adopts the **Debian Free Software Guidelines**, drafted by **Bruce Perens** | The DFSG is the actual intellectual source of the Open Source Definition — a distribution's practical admission criteria, not a philosophical treatise. | [OSI History](https://opensource.org/history) |
| 1997 | Eric Raymond presents **"The Cathedral and the Bazaar"** (book edition 1999) | See §1.5. | [Linus's law](https://en.wikipedia.org/wiki/Linus%27s_law) |
| **22 Jan 1998** | **Netscape announces** it will release the Communicator source code | The first time a public company bet a flagship product on the model. Note: Wikipedia's *Mozilla* article dates the announcement 23 January; Mozilla's own 20th-anniversary post says 22 January. | [Mozilla Turns Twenty](https://blog.mozilla.org/en/mozilla/mozilla-turns-twenty/) |
| **Feb 1998** | Strategy session in Palo Alto adopts the term **"open source"**, originally suggested by **Christine Peterson** of the Foresight Institute | **Sources disagree on the exact date.** OSI's own history says the term was adopted at a strategy meeting on **3 February 1998**. Peterson's first-person account describes Raymond visiting on 2 February and the pivotal VA Research meeting (Raymond, Todd Anderson, Larry Augustin, Sam Ockman, Jon "maddog" Hall by phone) on **5 February**. Peterson deliberately did *not* propose it herself — Anderson, who had community credibility, dropped it into discussion so it could spread "memetically". | [OSI History](https://opensource.org/history); [Peterson's account](https://opensource.com/article/18/2/coining-term-open-source-software) |
| late Feb 1998 | **Open Source Initiative** founded by Eric Raymond (president) and Bruce Perens (VP). Initial board included Brian Behlendorf, Ian Murdock, Russ Nelson, Chip Salzenberg. The **Open Source Definition** is created by taking Perens' DFSG and stripping the Debian-specific references | A deliberate, explicit rebranding exercise aimed at corporate adoption. The OSD is a *derivative work of a distribution's packaging policy* — which is why it is a checklist, not a manifesto. | [OSI History](https://opensource.org/history) |
| **31 Mar 1998** | Netscape source released under the **Netscape Public License**; the Mozilla Project formally launches. Known inside Netscape as "three thirty-one" | Two months of work went into stripping proprietary code and writing the licence first. The release itself was a partial failure — see Failure #3. | [Mozilla Turns Twenty](https://blog.mozilla.org/en/mozilla/mozilla-turns-twenty/) |
| April 1998 | The **"Freeware Summit"** convened by Tim O'Reilly is renamed the **"Open Source Summit"** within days | The moment the label stuck. By late February both O'Reilly and Netscape had adopted it. | [Peterson's account](https://opensource.com/article/18/2/coining-term-open-source-software) |
| Oct/Nov 1998 | **Halloween documents** leaked. Microsoft internal memos by program manager **Vinod Valloppillil** and **Josh Cohen**, annotated and published by Eric Raymond; Microsoft later confirmed authenticity | Documented that Microsoft privately assessed Linux as "long-term credible", technologically competitive, and *not* defeatable by FUD alone — while publicly dismissing it. Named the "embrace, extend, extinguish" strategy. Documents I and II were later entered as evidence in *Comes v. Microsoft* (2007). | [Halloween documents](https://en.wikipedia.org/wiki/Halloween_documents) |
| 1999 | **Apache Software Foundation** incorporated | Invents the vendor-neutral foundation as an institutional form: a legal shield for volunteers, a home for trademarks, and a governance model ("community over code", meritocratic committership) that CNCF, Eclipse and the LF all copy. | [apache.org/foundation](https://www.apache.org/foundation/) |
| Oct 1999 | OSI publishes its first formal list of approved licences | Creates the canonical list that governments and procurement bodies still reference — the reason "OSI-approved" is a term of art in policy. | [OSI History](https://opensource.org/history) |

### 1.5 *The Cathedral and the Bazaar* — the argument and its critics

**Raymond's argument (1997/1999):** two development styles exist. The *cathedral* — Emacs, GCC, commercial software — releases carefully, with source visible only between releases, developed by a closed group. The *bazaar* — Linux — releases early and often, delegates everything delegable, and treats users as co-developers. The mechanism Raymond claims makes the bazaar work is **"Linus's law": "given enough eyeballs, all bugs are shallow."** Raymond's deeper claim is a *debugging* claim, not a design claim: parallel debugging scales, parallel design does not.

**Its actual effect** was less as a theory than as a *permission slip*. Netscape executives read it before deciding to open Mozilla; it gave managers a business-legible vocabulary for something that had previously read as hobbyism.

**The critiques, fairly stated:**
- **Robert Glass (2003, *Facts and Fallacies about Software Engineering*)** called Linus's law a fallacy on evidentiary grounds: inspection research indicates a small maximum of useful reviewers, roughly **two to four**, with sharp diminishing returns beyond that. Eyeballs don't scale linearly. ([Linus's law](https://en.wikipedia.org/wiki/Linus%27s_law))
- **Heartbleed (2014)** is the standing empirical counterexample — a catastrophic bug in the most-reviewed-in-principle crypto library, live for two years. Larry Seltzer argued availability of source may *reduce* testing rigour relative to closed-source, because everyone assumes someone else looked. Jim Zemlin (Linux Foundation, 2015): "In these cases, the eyeballs weren't really looking." ([Linus's law](https://en.wikipedia.org/wiki/Linus%27s_law))
- **xz (2024)** is the sharper counterexample: not just unnoticed, but *deliberately engineered* to survive review by a hostile maintainer-of-record.
- **Partial empirical support** does exist: Amit and Feitelson (2020) found higher bug-fix rates in more popular GitHub projects. The law survives as a weak correlation, not a mechanism. ([Linus's law](https://en.wikipedia.org/wiki/Linus%27s_law))
- Separately, Nikolai Bezroukov's long-running critique argues Raymond's Linux/cathedral dichotomy misdescribes both, and that Linux is in fact strongly hierarchical. **[UNVERIFIED this session — I did not fetch Bezroukov directly.]**

**The honest summary for publication:** Raymond correctly identified that low-friction, high-frequency, publicly-visible iteration is a real productivity mechanism. He incorrectly generalised it into a security guarantee. The last twelve years have been a sustained institutional response to that specific overclaim.

### 1.6 Free software vs open source — what the disagreement actually is

This is not a licensing disagreement. In practice the FSF's Free Software Definition and the OSI's Open Source Definition approve almost the same set of licences. The disagreement is about **what the movement is for**, and both positions are internally coherent.

**The free software case (FSF, Stallman).** Software freedom is a *user's civil right*, comparable to freedom of the press. Proprietary software is an injustice regardless of whether it is well-engineered, because it puts the user under the developer's power. On this view, "open source" is a deliberate depoliticisation that discards the reason to care: if you sell openness on the grounds that it produces better code, then the moment proprietary code is better, you have conceded the argument. The FSF's position is that the practical benefits are a *consequence* of the ethics, and that promoting the consequence while suppressing the cause is how you end up with an industry that ships Linux inside locked-down devices.

**The open source case (OSI, Raymond, O'Reilly, Perens).** The ethical framing was empirically failing. "Free" was misread as "zero-cost" in every commercial conversation; the FSF's rhetoric read to corporate counsel as anti-business; adoption was the bottleneck. The pragmatic reframing worked — measurably and quickly: Netscape, IBM, Sun and eventually Microsoft came in. On this view, freedom that nobody deploys protects nobody, and the OSD's checklist form is a *feature*, because a checklist can be written into a procurement policy and a manifesto cannot.

**Why both persist.** They serve different institutions. "Open source" is the term that functions in procurement, regulation and enterprise governance — the CRA, the EU strategy, and every corporate OSPO speak it. "Free software" remains the term that functions when the question is *user power* rather than *supply-chain economics*: the AGPL, the anti-tivoisation clauses in GPLv3, the "Public Money? Public Code!" campaign, and the current fight over open-weight AI models are all arguments that only make sense in the free-software register. "FOSS"/"FLOSS" exist because most working practitioners need to refer to the set without picking a side. Notably, the two camps have re-converged in 2024–26: both the FSF and OSI ended up on the *restrictive* side of the AI definition argument, just with different vocabularies (§1.11).

### 1.7 Institutions, tooling and the permissive turn (1999–2010)

| Date | Event | What it changed | Source |
|---|---|---|---|
| 1999 | **SourceForge** launches | First centralised forge: hosting, issue trackers, downloads, release counts. Made project *discovery* possible and gave the movement its first numbers. **[UNVERIFIED — I did not fetch a primary source for the launch year.]** | — |
| July 2000 | Sun open-sources StarOffice as **OpenOffice.org** | First attempt at open source as a strategic weapon against a specific competitor (Microsoft Office). See Failure #2. | [Apache OpenOffice](https://en.wikipedia.org/wiki/Apache_OpenOffice) |
| Jan 2004 | **Apache License 2.0** first shipped (httpd 1.3.31 and 2.0.49); replaces ALv1.1, which had already removed the BSD advertising clause | ALv2 is the licence that made permissive licensing *enterprise-grade*: an explicit patent grant with a defensive termination clause, a clear contribution definition, and no advertising clause. That is why Kubernetes, Android's userspace, Hadoop, Kafka, Swift, Rust (dual), Terraform (pre-2023) and most of CNCF chose it. It solved the one problem MIT/BSD don't: patent ambush. | [Apache HTTP Server](https://en.wikipedia.org/wiki/Apache_HTTP_Server) |
| Nov 2004 | **Firefox 1.0** | The Mozilla bet finally pays off, six years after "three thirty-one". **[Date widely cited as 9 Nov 2004; verified only to 2004.]** | — |
| Jan / June 2005 | **OpenSolaris**: DTrace released 25 Jan 2005, bulk of Solaris code 14 June 2005, under the **CDDL** (OSI-approved 2005) | Sun chose an MPL-1.1-derived, file-level copyleft licence *specifically* so files could be combined with other licences — which had the side effect (widely read as intentional) of being GPL-incompatible, permanently walling ZFS and DTrace off from Linux. See Failure #1. | [OpenSolaris](https://en.wikipedia.org/wiki/OpenSolaris) |
| **3 Apr 2005** | **Git**: development begins after BitKeeper's free licence is withdrawn (following the claim that Andrew Tridgell had reverse-engineered its protocols). Announced 6 April; **self-hosting on 7 April**; first multi-branch merge 18 April; 6.7 patches/second by 29 April; manages the Linux 2.6.12 release on 16 June; Torvalds hands maintainership to **Junio Hamano** on 26 July; **v1.0 on 21 Dec 2005** | Distributed version control removed the *permission* step from contribution. Under CVS/SVN, forking meant a schism; under Git, forking is the normal unit of work and merging is cheap. Every social property of the modern open source workflow — pull requests, drive-by contributions, fork-first governance disputes, "just fork it" as a credible threat against a bad steward — is downstream of this. Mercurial was created in the same dispute. | [Git](https://en.wikipedia.org/wiki/Git) |
| 2006–2016 | **Google Code** Project Hosting operates and closes | The middle term between SourceForge and GitHub. Its closure is the clearest signal that centralised forge hosting had consolidated. **[UNVERIFIED dates.]** | — |
| **29 June 2007** | **GPLv3** published | Addresses tivoisation (hardware that refuses to run modified GPL code), patent retaliation and DRM. Also *fractured* the copyleft world: Linux stayed on GPLv2-only, and the GPLv2/GPLv3 incompatibility became a real engineering constraint. | [GNU GPL](https://en.wikipedia.org/wiki/GNU_General_Public_License) |
| **8 Feb 2008** | **GitHub** founded by Tom Preston-Werner, Chris Wanstrath, P.J. Hyett and Scott Chacon; public launch April 2008 | Git made distributed collaboration *possible*; GitHub made it *social*. The pull request, the contribution graph, the public profile-as-CV, and the collapse of the barrier to a first contribution. It also re-centralised a deliberately decentralised technology — which is why the 2018 Microsoft acquisition mattered. | [GitHub](https://en.wikipedia.org/wiki/GitHub) |
| 2009 | Apache becomes the first web server to serve **more than 100 million websites** | High-water mark of the first generation. | [Apache HTTP Server](https://en.wikipedia.org/wiki/Apache_HTTP_Server) |
| June 2018 / 26 Oct 2018 | **Microsoft acquires GitHub for $7.5 billion** (announced June, completed 26 October) | Completes the reversal that began with the Halloween documents 20 years earlier — the company that called open source a cancer now owns its town square. | [GitHub](https://en.wikipedia.org/wiki/GitHub) |

**The permissive turn, with numbers.** The GPL family's share of licensed open source fell from roughly **71% (2008) → 54% (2013) → 39% (2015) → 24% (2018)**; by 2015 GPLv2 had been overtaken by MIT ([GNU GPL](https://en.wikipedia.org/wiki/GNU_General_Public_License)). RedMonk's March 2026 analysis puts permissive licensing at **82% in 2022, ticking down to 73% in 2025** — while cautioning about sampling ([RedMonk, 25 Mar 2026](https://redmonk.com/sogrady/2026/03/25/open-source-licensing-2026/)).

*Why it happened.* Four causes, roughly in order of weight. (1) **Corporate legal risk aversion**: copyleft creates a compliance obligation that has to be assessed per-product; permissive creates almost none, so the path of least resistance inside a large company is always MIT or Apache. (2) **Library-scale software**: the GPL was designed for *programs*; the npm/PyPI/crates era is built from thousands of tiny *components*, and the derivative-work boundary for a 40-line dependency is legally miserable. (3) **The SaaS loophole**: copyleft is triggered by *distribution*, and cloud services don't distribute — so from about 2010 the GPL stopped protecting against the exact competitor that vendors feared. This is the direct cause of §1.9. (4) **Deliberate seeding**: companies that want their format or platform to become the default (Google with Kubernetes and Go, Meta with React and PyTorch) *want* frictionless adoption including by competitors, so they choose Apache-2.0.

### 1.8 The security reckonings

| Date | Event | What it changed institutionally | Source |
|---|---|---|---|
| April 2014 | **Heartbleed** (OpenSSL) | Revealed that a library securing a large fraction of the internet was maintained by a tiny, essentially unfunded team. The first time "critical infrastructure with no owner" became a boardroom-legible concept. | [Core Infrastructure Initiative](https://en.wikipedia.org/wiki/Core_Infrastructure_Initiative) |
| **24 Apr 2014** | **Core Infrastructure Initiative** founded at the Linux Foundation. Thirteen companies (AWS, Cisco, Dell, Facebook, Fujitsu, Google, IBM, Intel, Microsoft, NetApp, Rackspace, Qualcomm, VMware) pledge **$100,000/year each for three years ≈ $4M**; later joined by Adobe, Bloomberg, HP, Huawei, Salesforce. Funded **two full-time OpenSSL core developers**, plus ~$95,000 for an OpenSSL audit, ~$120,000 for developer security education and ~$120,000 for project analysis | The first pooled industry fund for open source *maintenance* rather than features. Its scale (single-digit millions against trillions of dependent value) is itself the finding. Later superseded by OpenSSF. | [Core Infrastructure Initiative](https://en.wikipedia.org/wiki/Core_Infrastructure_Initiative) |
| **26 Nov 2018** | **event-stream / flatmap-stream**. npm discovers malicious code. The attacker had been made a maintainer of `event-stream` by social engineering and added `flatmap-stream@0.1.1` as a dependency on **9 Sept 2018**. Payload read AES-encrypted data from a file disguised as a test fixture, decrypted and executed in memory, and targeted **Copay** (BitPay) wallets holding >100 BTC or >1,000 BCH. Copay 5.0.2–5.1.0 shipped it | Reframed the threat from *bugs* to *people*. The attack surface is the maintainer's inbox and the transitive dependency graph, not the code. Directly motivated 2FA mandates, provenance/attestation work, and the whole "trusted publishing" agenda. | [npm blog](https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident) |
| Aug 2020 | **OpenSSF** founded at the Linux Foundation, succeeding the CII | Consolidates the response: Sigstore, Scorecard, SLSA, best-practices badge, Alpha-Omega. | [OpenSSF](https://en.wikipedia.org/wiki/Open_Source_Security_Foundation) |
| **Nov–Dec 2021** | **Log4Shell / CVE-2021-44228.** Reported to the ASF by an Alibaba engineer **24 Nov 2021**; fix committed 5–6 Dec; public disclosure begins via WeChat 9 Dec; patch 2.15.0, CVE assigned, CISA statement **10 Dec 2021** | The **Cyber Safety Review Board** (report published **11 July 2022**) called Log4j an **"endemic vulnerability"** and assessed that vulnerable instances "will remain in systems for many years to come, perhaps a decade or longer." Its Recommendation 13 was explicit: *increase investments in open source software security*; Recommendation 14 proposed piloting **open source maintenance support for critical services**. This is the document that put open source funding into US federal policy language. | [CSRB report (PDF)](https://www.cisa.gov/sites/default/files/publications/CSRB-Report-on-Log4-July-11-2022_508.pdf) |
| Feb 2022 | **Alpha-Omega** launched at OpenSSF, funded by AWS, Google and Microsoft | Direct grants to the organisations that maintain critical projects, mostly to *hire security staff* rather than fund features. | [Alpha-Omega 2024 report (PDF)](https://alpha-omega.dev/wp-content/uploads/sites/22/2025/01/Alpha-Omega-Annual-Report-2024_012925.pdf) |
| May 2022 | OpenSSF security summit produces a **10-point Open Source Software Security Mobilization Plan** with **$30M in pledges** | | [OpenSSF](https://en.wikipedia.org/wiki/Open_Source_Security_Foundation) |
| 2021 → Mar 2024 | **xz / liblzma backdoor, CVE-2024-3094, CVSS 10.0.** "Jia Tan" first appears around **2021**; a multi-year pressure campaign using sock puppets ("Jigar Kumar", "krygorin4545", "misoeater91") pushes the exhausted original maintainer into granting commit rights; backdoor injected **February 2024** into versions **5.6.0 and 5.6.1**; enabled remote code execution over OpenSSH to the holder of a specific Ed448 private key. Discovered **29 March 2024** by **Andres Freund** (Microsoft, PostgreSQL developer) while investigating unexplained SSH CPU usage and Valgrind errors in a Debian test build. Reported to the Openwall oss-security list. Red Hat, SUSE and Debian rolled back; Canonical delayed the Ubuntu 24.04 LTS beta by a week to rebuild every binary package. Fixed in **5.6.2, 29 May 2024**. In **August 2025** researchers found Debian Docker images on Docker Hub still carrying the backdoor; Debian declined removal, designating them historical artefacts | The most important single event in modern supply-chain security. It changed the threat model from "a compromised account" to "a patient adversary who becomes the legitimate maintainer." It also destroyed the last of Linus's law as a security argument: no amount of review catches a hostile committer who controls the release tarball. Institutionally it drove maintainer-burnout policy (the pressure campaign *worked because the maintainer was alone and tired*), release-artefact reproducibility, and the CRA's steward provisions. Tidelift's Sept 2024 survey found **66% of maintainers reported reduced trust in non-maintainer contributions** after xz | [XZ Utils backdoor](https://en.wikipedia.org/wiki/XZ_Utils_backdoor); [Tidelift 2024 (PDF)](https://assets-eu-01.kc-usercontent.com/ef593040-b591-0198-9506-ed88b30bc023/d325a56f-05be-4379-bfd1-ee4776fcad41/2024-tidelift-state-of-the-open-source-maintainer-report-.pdf) |

### 1.9 The relicensing wave — and what has happened since

| Date | Event | Outcome as of Aug 2026 | Source |
|---|---|---|---|
| **Oct 2018** | **MongoDB** relicenses to the **SSPL**, which it wrote. Section 13 requires anyone offering the software as a service to release the source of "the entirety of the service" — management software, UIs, APIs, and everything needed to run an instance. Submitted to the OSI | **Withdrawn from OSI review in 2019** rather than face rejection. **Debian, Fedora and RHEL dropped MongoDB.** Amazon shipped proprietary DocumentDB instead. MongoDB remains SSPL. | [SSPL](https://en.wikipedia.org/wiki/Server_Side_Public_License); [Packt](https://www.packtpub.com/en-us/learning/how-to-tutorials/mongodb-withdraws-controversial-server-side-public-license-from-the-open-source-initiatives-approval-process/) |
| Nov 2020 | **Graylog** 4.0 → SSPL | | [SSPL](https://en.wikipedia.org/wiki/Server_Side_Public_License) |
| **Jan 2021** | **Elastic** moves Elasticsearch and Kibana to dual SSPL / Elastic License v2 | **AWS forked OpenSearch** (with Red Hat, Logz.io, CrateDB, Aiven). **Reversed:** Elastic added **AGPLv3** as an option, announced **August 2024** — Shay Banon's reasoning: "We had issues with AWS and the market confusion their offering was causing… 3 years later, Amazon is fully invested in their fork… our partnership with AWS is stronger than ever." | [Elastic blog](https://www.elastic.co/blog/elasticsearch-is-open-source-again); [SSPL](https://en.wikipedia.org/wiki/Server_Side_Public_License) |
| **Aug 2023** | **HashiCorp** moves Terraform, Vault, Consul, Nomad etc. to the **BUSL 1.1** | **OpenTofu** forked from the last MPL-licensed Terraform in **August 2023**, joined the **Linux Foundation**. HashiCorp issued a **cease-and-desist in April 2024** alleging misuse of BUSL code; OpenTofu maintained the disputed code originated from MPL-licensed Terraform. **IBM completed its $6.4bn acquisition of HashiCorp on 27 Feb 2025.** Terraform remains BUSL as of Aug 2026 — **this is the one relicensing that has *not* reversed.** OpenTofu continues under the LF (1.11.1 released 10 Dec 2025). **I could not find an authoritative adoption figure for OpenTofu vs Terraform; the numbers circulating in 2026 come from vendor blogs, and I would not publish any of them.** | [OpenTofu](https://en.wikipedia.org/wiki/OpenTofu); [TechCrunch](https://techcrunch.com/2025/02/27/ibm-closes-6-4b-hashicorp-acquisition/) |
| **Mar 2024** | **Redis** moves from BSD to dual **SSPL / RSALv2** | **Valkey** forked from the last BSD Redis under the **Linux Foundation**, within days, with AWS, Google, Oracle, Ericsson and Snap. **Reversed: Redis 8 shipped under AGPLv3 on ~1 May 2025.** Salvatore Sanfilippo (antirez), back at Redis, wrote that "the SSPL, in practical terms, failed to be accepted by the community" — neither OSI nor the wider community regarded it as open — and that he wanted his new Vector Sets work released under an open licence. | [antirez](https://antirez.com/news/151); [The Register, 1 May 2025](https://www.theregister.com/software/2025/05/01/redis_returns_to_open_source_with_agpl_license/757582); [SSPL](https://en.wikipedia.org/wiki/Server_Side_Public_License) |
| **Sept 2024** | **OpenSearch Software Foundation** formed under the Linux Foundation; AWS hands over the fork | At its one-year mark (**25 Aug 2025**): **over 1 billion cumulative downloads, +78% YoY**, 8,800+ contributions, 16 member organisations, 400+ actively contributing organisations, 15-member TSC, releases 3.0/3.1/3.2. | [Linux Foundation, 25 Aug 2025](https://www.linuxfoundation.org/press/opensearch-software-foundation-marks-1-year-anniversary-with-community-growth-agentic-ai-and-hybrid-search-enhancements) |

**The pattern, stated precisely.** Of the four canonical relicensings: **Elastic reversed (2024), Redis reversed (2025), MongoDB has not, HashiCorp has not** (and is now inside IBM). In three of four cases a credible fork existed within weeks, and in two of those the fork acquired a neutral foundation home. The lesson the market appears to have drawn is that **the fork is now the enforcement mechanism** — the licence change buys you a competitor with your own codebase, foundation governance, and hyperscaler funding. Both reversals landed on the **AGPL**, which is the interesting outcome: the industry's answer to the SaaS loophole turned out to be an FSF licence written in 2007, not a new vendor-drafted one.

### 1.10 Funding and sustainability

| Date | Item | Detail | Source |
|---|---|---|---|
| 2014 | **CII** | ~$4M over three years, 18 companies | [CII](https://en.wikipedia.org/wiki/Core_Infrastructure_Initiative) |
| 2019 | **GitHub Sponsors** | Direct developer sponsorship inside the forge. **[UNVERIFIED date/figures.]** | — |
| 2015 / 2016 | **Open Collective**, **Tidelift** | Fiscal hosting for unincorporated projects; paid maintainer contracts sold as a subscription. **[UNVERIFIED founding dates.]** | — |
| May 2022 → | **Sovereign Tech Fund / Agency** (Germany), a subsidiary of the federal agency SPRIND. Bundestag allocation **May 2022**. **€13M (2022), ~€22M (2023), ~€16M (2024)**; **over €24.6M across ~60 projects since 2022**. Grants include PyPI (€1,056,672), Prossimo/Rustls (€1,436,729), GNOME (€1,000,000), OpenJS Foundation (€874,940), coreutils (€99,060). Four programmes: Fund, Resilience, Fellowship, Challenge | The first *state* funding of global digital infrastructure as infrastructure. Its per-project grant sizes are the best available public benchmark for what "funding a critical dependency properly" costs: roughly €100k–€1.4M. | [Sovereign Tech Agency](https://en.wikipedia.org/wiki/Sovereign_Tech_Agency); [EU-STF](https://en.wikipedia.org/wiki/EU_Sovereign_Tech_Fund) |
| Feb 2022 → | **Alpha-Omega**: **~$4.5M in 2024**, **~$8.6M cumulative since Feb 2022**; 20 grants to 15 organisations in 2024, average grant **$227,445**. Split: security staffing 63% ($2.86M), packaging repositories 15% ($662,400), audits and remediation 14% ($626,500), innovation 9% ($400,000). Recipients include the PSF, Rust Foundation, Node.js/OpenJS, Eclipse, the Linux kernel, RubyGems/Ruby Central, FreeBSD Foundation, Jenkins, Homebrew, Apache Airflow. Claimed outcomes: security teams established at ten major OSS organisations, Trusted Publishing adoption across package managers, 100% attestation coverage for Homebrew | The most transparent funder in the space, and the one whose reports are actually usable as evidence. Note the ratio: $8.6M cumulative against the HBS demand-side estimate of $8.8 *trillion*. | [Alpha-Omega 2024 report (PDF)](https://alpha-omega.dev/wp-content/uploads/sites/22/2025/01/Alpha-Omega-Annual-Report-2024_012925.pdf) |
| **10–11 Dec 2024** | **EU Cyber Resilience Act** (Regulation (EU) 2024/2847) enters into force. **Reporting obligations begin 11 Sept 2026. Full application 11 Dec 2027.** Introduces the category of **"open source software steward"** — code-hosting foundations and organisations that support open source but do not monetise the particular software they steward. Individuals who merely contribute, or who do not monetise, are **not directly in scope**, though they will feel indirect pressure through raised expectations | The first regulation to place duties on open source *institutions* rather than only on commercial vendors. The steward category was won by lobbying (Eclipse, OpenSSF, OFE, the ORC WG) after the original draft would have exposed foundations to full manufacturer obligations. **Sources give 10 December (OpenSSF) and 11 December (ORC WG) 2024 for entry into force — a one-day discrepancy, likely rounding from the Official Journal date. I could not resolve it from the regulation text this session, and did not fetch article/recital numbers.** | [OpenSSF CRA page](https://openssf.org/public-policy/eu-cyber-resilience-act/); [ORC WG](https://orcwg.org/cra/) |
| 2025 | **EU Sovereign Tech Fund (EU-STF)** proposed. Feasibility study commissioned by GitHub, published by OpenForum Europe, Fraunhofer ISI and the European University Institute. Recommends a minimum **€350M** from the 2028–2035 MFF. Backed by GitHub, Mercedes-Benz, SAP, Nextcloud, MEPs. **Not yet established or funded as of Aug 2026** | | [EU-STF](https://en.wikipedia.org/wiki/EU_Sovereign_Tech_Fund) |
| **3 June 2026** | **EU Technological Sovereignty Package** and a new **EU Open Source Strategy**. A **Cloud and AI Development Act (CADA)** introducing a "Free Software first principle" for public cloud and AI procurement. **€2 billion over seven years** for open source measures including critical-infrastructure maintenance. Target of **30 million active users of free software collaboration tools by 2030**. Priority areas: RISC-V (already ~€500M via the Chips Joint Undertaking), cloud stacks, AI frameworks, mobile OS. Context figure: the EU spends **€264 billion a year** on largely proprietary IT | The largest state commitment to open source ever made. **FSFE's assessment**: welcome recognition of "Public Money? Public Code!" after nine years of campaigning, but the strategy is **non-binding**, and success needs "binding rules, long-term funding, and meaningful civil society involvement." TechPolicy.Press adds four gaps: the open source/open standards linkage is undefined; open hardware is underweighted despite the RISC-V spend; €2bn is small against €264bn; and the skills framework targets *users* rather than *contributors*. | [FSFE, 3 June 2026](https://fsfe.org/news/2026/news-20260603-01.en.html); [TechPolicy.Press](https://www.techpolicy.press/how-the-eus-tech-sovereignty-package-finally-puts-open-source-to-the-test/) |
| **17 Mar 2026** | **AWS, Anthropic, Google, Microsoft and OpenAI commit $12.5M** with the Linux Foundation to help open source projects handle AI-enhanced and AI-generated vulnerability reports — tooling to validate and remediate real findings while filtering low-quality submissions. AWS's share is $2.5M | The first industry money aimed at a problem *created by* AI rather than solved by it. It is a direct institutional response to the curl and FFmpeg episodes below. | [AWS Open Source Blog](https://aws.amazon.com/blogs/opensource/aws-and-others-invest-12-5m-to-defend-the-open-source-ecosystem-from-ai-threats/) |

### 1.11 The AI era and the "open source AI" definition fight

| Date | Event | Source |
|---|---|---|
| Sept 2016 | **PyTorch** released by Meta AI (Chanan, Chintala, Gross, Paszke), **BSD-3** | [PyTorch](https://en.wikipedia.org/wiki/PyTorch) |
| Sept 2022 | **PyTorch Foundation** created as a Linux Foundation subsidiary; Meta hands over governance | [PyTorch](https://en.wikipedia.org/wiki/PyTorch) |
| **28 Oct 2024** | **OSI publishes the Open Source AI Definition (OSAID) v1.0** at All Things Open. Four freedoms — use, study, modify, share — plus a precondition of access to "the preferred form to make modifications to the system." Crucially, it requires **"data information"** (sufficiently detailed information about training data) rather than the training data itself | [OSI AI](https://opensource.org/ai); [TechCrunch](https://techcrunch.com/2024/10/28/we-finally-have-an-official-definition-for-open-source-ai/) |
| Oct 2024 → | **The criticism.** *Julia Ferraioli*: without the data, "the only things that the OSAID guarantees are the ability to use and distribute" — you can fine-tune but you cannot meaningfully study or rebuild. *Tom Callaway*: "If we let the Open Source AI definition contain a loophole that makes data optional, we devalue the meaning of 'open source' in all other contexts." *Giacomo Tesio*: without training data, undetectable backdoors can be planted. The **FSF** announced it would not call an ML application free "unless all its training data… respect all users, following the four freedoms." The **Software Freedom Conservancy** issued an aspirational statement requiring all components be available as F/OSS. **OSI's defence** (Stefano Maffulli, 25 Oct 2024): the definition reflects consensus from a global co-design process spanning AI builders, deployers, content creators, unions, ethicists and lawyers, and model parameters plus architecture *are* the preferred form for making modifications | [LWN](https://lwn.net/Articles/995159/) |
| 2025–26 | OSI maintains **v1.0** as the stable version; a board committee was created to own maintenance and revision rules. The OSAID page carries a published date of 28 May 2025 with modifications through 22 July 2026, but **no v1.1 or v2.0 has been issued** and the OSI process page gives no revision timeline. **[I could not find a published OSI revision schedule — flag this as an open question rather than asserting one exists.]** | [OSI AI](https://opensource.org/ai); [OSI AI Process](https://opensource.org/ai/process) |
| **12 Aug 2026** | OSI's current position, *"The AI Era Arcs Toward Openness"*: **over 5 million AI-related projects on GitHub** (up from 1 million in 2020); **2 million models on Hugging Face**; open-model usage up **over 90% month-over-month in June 2026**; the performance gap on some tasks (e.g. coding) narrowed to **~3%**; inference costs for open models down **six- to fiftyfold over three years**. But: **open models account for ~20% of token usage and only ~4% of revenue.** Of the ten highest-usage models in the Mozilla report cited, **half are under an OSI-approved licence — which OSI is careful to say is *not* the same as meeting the OSAID** | [OSI, 12 Aug 2026](https://opensource.org/blog/the-ai-era-arcs-toward-openness) |

**State of the argument in 2026 — my read of the evidence.** The definition fight has not been resolved; it has been *routed around*. Three things happened. First, the industry standardised on the term **"open weights"** for the actual practice, which quietly concedes the critics' point without adopting their standard. Second, the licensing centre of gravity moved to Chinese labs, which are markedly *more* permissive: among 178 Chinese model releases above 20B parameters, **59% are Apache-2.0 and 22% MIT**, versus US releases at **29% Apache/MIT, 41% custom terms, 30% no declared licence** ([Hugging Face, *State of Open Models: Summer 2026*](https://huggingface.co/blog/state-of-open-models-summer-2026)). Third, OSI itself has shifted its public argument from *definition-policing* toward *openness-advocacy*, citing usage and cost data rather than compliance counts. The unresolved substance remains exactly where it was in October 2024: if you cannot obtain the training data, you cannot exercise the freedom to study or to rebuild, and no amount of "data information" changes that. Anyone publishing on this should say so plainly and then note that the OSI's counter-argument — that demanding data would define open source AI out of existence, given that essentially no frontier model could comply — is also true.

---

## PART 2 — THE SUCCESS STORIES

### 1. Linux
- **What:** A Unix-like operating system kernel; with GNU userland, the substrate of servers, cloud, Android, embedded systems and supercomputing.
- **Started:** 1991. **By:** Linus Torvalds, then a student in Helsinki. Freely modifiable source in 1991; **relicensed under GPLv2 at version 0.12, February 1992**.
- **Licence:** GPL-2.0-only (deliberately not "or later").
- **Scale:**
  - Kernel 6.18 (released **30 Nov 2025**): **2,134 developers — the highest in the kernel's history — 333 of them first-time contributors, 13,710 commits.** Top corporate contributors by changeset: **Intel 10.4%, Google 7.9%, Red Hat 6.3%, AMD 5.0%, Linaro 3.9%.** 53.6% of commits carried Reviewed-by tags ([LWN, 6.18 statistics](https://lwn.net/Articles/1046966/)).
  - **Android: 68.36% of worldwide mobile OS share, July 2026** ([StatCounter](https://gs.statcounter.com/os-market-share/mobile/worldwide)) — Android's kernel is Linux.
  - Supercomputing: on the **June 2026 TOP500**, the top five systems run LineShine/Kylin OS (China, 2,198 PFlop/s, first Chinese #1 since 2017, 13M+ cores), El Capitan/TOSS, Frontier/HPE Cray OS, Aurora, JUPITER Booster/RHEL — **all Linux-derived**. I **could not fetch TOP500's OS-family statistics table** to confirm the full-500 figure; see Myth #1 ([TOP500 June 2026](https://top500.org/lists/top500/2026/06/)).
  - Desktop: **7.53%, July 2026** (StatCounter) — a noisy figure, see Myth #10.
- **Mechanism:** The GPL turned would-be competitors into co-maintainers. No vendor could privately fork and out-develop the commons, so IBM, Intel, Google, Red Hat and AMD all found it cheaper to upstream. Add Torvalds' maintainer hierarchy (which is a *cathedral* of trusted lieutenants, not a bazaar) and a merge window discipline that has shipped a release roughly every nine to ten weeks for two decades.
- **Non-obvious fact:** Linux's success is partly a *litigation artefact*. During 1992–94, while USL v. BSDi hung over BSD — the technically more mature free Unix — Linux was the only free Unix nobody was suing. When the case settled in Feb 1994, of 18,000 BSD files only **three** had to be removed. The claim was near-empty; the two years of uncertainty were not.

### 2. Git
- **What:** Distributed version control.
- **Started:** **3 April 2005.** **By:** Linus Torvalds, after BitKeeper's free licence was withdrawn following the claim that Andrew Tridgell reverse-engineered its protocols. Maintainership passed to **Junio Hamano on 26 July 2005** — 16 weeks after the first commit.
- **Licence:** GPL-2.0-only; trademark held by the Software Freedom Conservancy.
- **Scale:** **93.9%** primary version control share, Stack Overflow 2022 (up from 69.3% in 2015) ([Git](https://en.wikipedia.org/wiki/Git)). Stack Overflow 2025 did not publish a comparable VCS figure; it reports **GitHub at 81.1%** of collaboration tools among 49,063 respondents ([SO 2025](https://survey.stackoverflow.co/2025/technology)). GitHub alone: **180M+ developers, 630M repositories, 395M public repositories, 1.128 billion contributions in 2025** ([Octoverse 2025](https://github.blog/news-insights/octoverse/octoverse-a-new-developer-joins-github-every-second-as-ai-leads-typescript-to-1/)).
- **Mechanism:** Git made *forking cheap and merging cheaper*. Under CVS/SVN a fork was a political act; under Git it is the default unit of work. Everything social about modern open source — the pull request, the drive-by first contribution, "fork it" as a credible governance threat against a bad steward — is a second-order effect of a data-structure choice.
- **Non-obvious fact:** Git was self-hosting **four days** after development began (7 April 2005) and was managing the Linux 2.6.12 release within ten weeks. It was also written by someone who has repeatedly said he hates version control and built Git specifically so he could stop thinking about it.

### 3. Apache HTTP Server and the Apache Software Foundation
- **What:** The web server that ran the early web; and the foundation model that most of open source now uses.
- **Started:** httpd in **early 1995**, from patches to the stalled NCSA httpd. **ASF incorporated 1999.** **By:** the Apache Group — Brian Behlendorf, Roy Fielding and others.
- **Licence:** Apache License 2.0 (first shipped in httpd 1.3.31 / 2.0.49, **January 2004**).
- **Scale:**
  - httpd: first server to pass **100 million websites (2009)**. Now **22.6% of all websites** — third behind Nginx 31.4% and Cloudflare 29.6%, ahead of LiteSpeed 14.9% and IIS 3.1% ([W3Techs, 23 Aug 2026](https://w3techs.com/technologies/overview/web_server)).
  - ASF **FY2025**: **295 top-level projects**, **32 podlings**, **9,905 committers**, **208 PMCs**, **1,147 members** (824 active, 323 emeritus), **1,310 releases**. Security: **29,000+ reports received → 1,584 real threads → 650 triaged across 136 projects → 239 CVEs published**. Financials: revenue **$2,080,861**, expenses **$2,279,270**, **net −$114,471**; infrastructure alone cost **$1,464,767** ([ASF FY2025 Annual Report, PDF](https://apache.org/foundation/docs/FY2025AnnualReport.pdf)).
- **Mechanism:** Two separate inventions. The *licence*: ALv2's explicit patent grant with defensive termination made permissive licensing safe for large companies — which is why Kubernetes, Kafka, Hadoop, Swift and most of CNCF use it. The *institution*: "community over code", merit-based committership, PMC governance, and a legal shield between volunteers and liability. Every major foundation since has copied the shape.
- **Non-obvious fact:** The ASF steward for **295 projects** on a **$2.1M annual budget** and **ran a deficit in FY2025**. Nearly 70% of that budget is infrastructure. The organisation that hosts a meaningful fraction of the world's enterprise data plumbing operates on less than the salary bill of a mid-sized engineering team.

### 4. Kubernetes and the CNCF
- **What:** Container orchestration; and the foundation that turned it into an industry.
- **Started:** 2014, open-sourced by Google (descended from Borg); CNCF founded 2015 with Kubernetes as its seed project. **[Founding years widely cited; not fetched this session — flag if publishing them as primary.]**
- **Licence:** Apache-2.0.
- **Scale (CNCF Annual Survey 2025, published **20 Jan 2026**):** **82% of container users run Kubernetes in production**, up from 66% in 2023. **98%** of surveyed organisations have adopted cloud-native techniques; 59% say most or nearly all development is cloud-native. **66%** of organisations hosting generative AI models use Kubernetes for some or all inference. CNCF has **nearly 800 member organisations**, including 200+ startups; **OpenTelemetry alone has 24,000+ contributors**. **CNCF did not publish the survey sample size or field dates in the announcement — treat the percentages accordingly** ([CNCF, 20 Jan 2026](https://www.cncf.io/announcements/2026/01/20/kubernetes-established-as-the-de-facto-operating-system-for-ai-as-production-use-hits-82-in-2025-cncf-annual-cloud-native-survey/)).
- **Mechanism:** Google gave away the crown jewels *deliberately*, and immediately gave away control too. By donating to a neutral foundation rather than keeping a BDFL seat, Google made it rational for AWS, Microsoft and every enterprise vendor to standardise on a Google-designed abstraction. Commoditising the layer below your business is the clearest strategic use of open source in the industry's history — and it worked: Kubernetes became the portability layer that made multi-cloud plausible, which sells Google Cloud.
- **Non-obvious fact:** The CNCF survey's own framing for 2025 was that Kubernetes has become "the de facto operating system for AI" — but **44% of organisations still run no AI/ML workloads on Kubernetes at all**. The headline and the base rate point in different directions.

### 5. Python
- **What:** General-purpose language; now the default language of data science, ML and scripting.
- **Started:** 1991, by Guido van Rossum. **[Not verified this session.]**
- **Licence:** Python Software Foundation License (permissive, GPL-compatible). **[Not verified this session.]**
- **Scale:** **57.9% of developers use Python** (Stack Overflow 2025, n=49,063) — a **7-percentage-point jump from 2024**, which SO attributes directly to AI and data science ([SO 2025](https://survey.stackoverflow.co/2025/technology)). On GitHub, Python added contributors faster than anything except TypeScript: **2.75 million contributors, +48% YoY** as of August 2025 ([Octoverse 2025](https://github.blog/news-insights/octoverse/octoverse-a-new-developer-joins-github-every-second-as-ai-leads-typescript-to-1/)). PyPI holds **44.9 TB** of package files, dominated by ML: `tf-nightly` alone is 681.4 GB, PyTorch 271.4 GB ([PyPI stats](https://pypi.org/stats/), cached 24h).
- **Mechanism:** Python won by being the *second-best* language for almost every task and the easiest for scientists who are not software engineers. The compounding step was C interoperability: NumPy, SciPy, pandas, TensorFlow and PyTorch are C/C++/CUDA underneath with Python on top, which meant Python inherited high-performance numerics without having to be fast itself.
- **Non-obvious fact:** The Python Software Foundation's security staffing has been funded in part by **Alpha-Omega grants** from AWS, Google and Microsoft ([Alpha-Omega 2024](https://alpha-omega.dev/wp-content/uploads/sites/22/2025/01/Alpha-Omega-Annual-Report-2024_012925.pdf)), and **PyPI's infrastructure received €1,056,672 from the German government** via the Sovereign Tech Fund ([Sovereign Tech Agency](https://en.wikipedia.org/wiki/Sovereign_Tech_Agency)). The most-used language ecosystem in AI is partly secured by a German federal innovation agency.

### 6. PostgreSQL
- **What:** Relational database.
- **Started:** POSTGRES at UC Berkeley under Michael Stonebraker, 1986; renamed PostgreSQL 1996. **[Not verified this session.]**
- **Licence:** PostgreSQL License (a permissive, BSD/MIT-style licence).
- **Scale:** **55.6% of developers use PostgreSQL** — the most-used database in Stack Overflow 2025, ahead of MySQL 40.5%, SQLite 37.5%, SQL Server 30.1%, Redis 28% ([SO 2025](https://survey.stackoverflow.co/2025/technology)).
- **Mechanism:** No company owns it, so no company can relicense it. PostgreSQL is the *control case* for the entire §1.9 relicensing wave: it is the one major database whose users never had to worry about a licence change, because there is no vendor with the standing to make one. Its extension architecture (PostGIS, TimescaleDB, pgvector) let it absorb every specialist database wave — geospatial, time-series, and now vector search for AI — without forking.
- **Non-obvious fact:** PostgreSQL's rise is measurably *the direct beneficiary* of the relicensing wave. Its permissive licence and vendor-neutral governance are precisely what MongoDB, Elastic and Redis users discovered they wanted after 2018.

### 7. Wikipedia and MediaWiki
- **What:** The encyclopaedia, and the wiki engine underneath it.
- **Started:** **15 January 2001.** **By:** Jimmy Wales and Larry Sanger.
- **Licence:** Content under **CC BY-SA 4.0**; MediaWiki under GPL-2.0-or-later. **[MediaWiki licence not verified this session.]**
- **Scale:** **7,171,504 articles** on English Wikipedia; **67,159,986 articles** across all editions; **345 language editions**; **275,757 active editors** on English Wikipedia (one or more edits in 30 days) ([Wikipedia](https://en.wikipedia.org/wiki/Wikipedia)). Traffic: the article's cited figure — 18 billion page views and ~500 million unique visitors a month — is from a **February 2014** New York Times report citing comScore. **Do not publish that as a current number.** I could not obtain current traffic figures: `stats.wikimedia.org` is cache-only and could not be fetched.
- **Mechanism:** Radical revert-cost asymmetry. Vandalism is cheap to commit and cheaper to undo, so a version-controlled, publicly-logged, anyone-can-edit system converges rather than degrades — the opposite of the intuition. Layer on citation norms, talk-page deliberation and an elected-ish administrative class, and you get a governance system, not just a website.
- **Non-obvious fact:** Wikipedia relicensed from the **GFDL** — a software documentation licence poorly suited to prose — to **CC BY-SA** in 2009, an operation that required the FSF to add a time-limited migration clause to GFDL 1.3 specifically to make it legally possible. It remains one of the largest licence migrations ever executed on a corpus that no single entity owned.

### 8. Let's Encrypt
- **What:** A free, automated, publicly-trusted certificate authority; and the **ACME** protocol that automates issuance.
- **Started:** First publicly-trusted certificate **14 September 2015**. **By:** the Internet Security Research Group (ISRG), backed by EFF, Mozilla, Akamai, Cisco and the University of Michigan. **[Backers not verified this session.]**
- **Licence:** Boulder (the CA software) is MPL-2.0; certbot Apache-2.0; ACME is an IETF standard (RFC 8555). **[Not verified this session.]**
- **Scale (from ISRG's own 10-year post, **9 December 2025**):** **1 million certificates by March 2016; 1 million per day by September 2018; 1 billion cumulative by 2020; ~10 million certificates per day as of late September 2025.** "Closing in on protecting one billion web sites." HTTPS share of page loads: **below 30% globally in 2015 → around 80% globally and close to 95% in the US** ([Let's Encrypt, 10 Years](https://letsencrypt.org/2025/12/09/10-years)). The live stats page confirms it is tracking Firefox HTTPS page-load percentage and daily issuance but **the numeric values did not render in the text-only fetch (page dated 18 Aug 2026)** ([letsencrypt.org/stats](https://letsencrypt.org/stats/)).
- **Mechanism:** They did not compete on price; they removed the *transaction* entirely. Certificates were never mainly expensive — they were *annoying*: a CSR, a purchase, an email verification, a manual install, and an outage a year later when you forgot to renew. ACME made issuance a 90-day automated loop with no human in it. Free was necessary; **automated was sufficient.**
- **Non-obvious fact:** This is the single most measurable civilisational impact in the list. **Global web traffic went from under 30% encrypted to around 80% in ten years**, and one non-profit issuing certificates for free is the primary cause. Note that ISRG deliberately kept certificate *lifetimes short* (90 days, now shorter options) — a design choice that made automation mandatory rather than optional, and that the wider CA/Browser Forum has since followed.

### 9. SQLite
- **What:** An embedded, serverless, single-file SQL database engine.
- **Started:** 2000, by D. Richard Hipp. **[Year not verified this session.]**
- **Licence:** **Public domain.** Not MIT, not BSD — dedicated to the public domain by its authors, with **no licence required at all**.
- **Scale:** SQLite's own estimate: **over 1 trillion SQLite databases in active use**, extrapolated from 4+ billion active smartphones each carrying hundreds of database files. Present in every Android, iOS, macOS and Windows 10/11 device, in Firefox, Chrome and Safari, in PHP and Python, in Skype, iTunes, Dropbox, TurboTax and QuickBooks, and in televisions, set-top boxes and cars. The project claims it is "likely used more than all other database engines combined" and is plausibly the **second most widely deployed software library after zlib** — possibly the first, counting static instances. Independently: **37.5% of developers report using it** (SO 2025) ([sqlite.org/mostdeployed](https://www.sqlite.org/mostdeployed.html); [SO 2025](https://survey.stackoverflow.co/2025/technology)).
- **Mechanism:** Zero configuration, zero dependencies, zero server, one file, and a test suite with famously exhaustive branch coverage. Combined with public-domain status, the *legal* cost of adoption is also zero — no attribution file, no licence audit, no lawyer.
- **Non-obvious fact — and it inverts almost everything else in this document: **SQLite is not an open-contribution project.** It does not accept patches from anyone who has not signed an affidavit dedicating the work to the public domain, no code is copied in from elsewhere, and the **original affidavits are kept in a firesafe at Hwaci's offices**. Hwaci separately *sells* an optional "Warranty of Title" licence for organisations in jurisdictions that don't recognise public domain, and that revenue funds development. The most deployed database on Earth is a cathedral with a fireproof filing cabinet ([sqlite.org/copyright](https://www.sqlite.org/copyright.html)).

### 10. cURL / libcurl
- **What:** Command-line tool and library for transferring data over ~28 protocols.
- **Started:** the name has been in effective use **since 1998**. **By:** Daniel Stenberg, who remains project lead.
- **Licence:** An **MIT-derivative** — "similar but not identical to the MIT license", with its own SPDX identifier, `curl`.
- **Scale:** **"In 2025, we estimate that curl runs in roughly thirty billion installations world wide"** ([curl FAQ](https://curl.se/docs/faq.html)).
- **Mechanism:** One person's thirty-year commitment to backwards compatibility and protocol completeness, at a level no vendor would fund. libcurl is in cars, TVs, printers, games consoles, phones and satellites because it is the only thing that reliably does HTTP everywhere.
- **Non-obvious fact — and the most important open source story of 2025–26:** curl **killed its own bug bounty** because of AI. Stenberg reported in July 2025 that **~20% of all 2025 submissions were AI-generated slop, while only ~5% turned out to be genuine vulnerabilities**; each report engages three or four people for 30 minutes to three hours. Over the programme's life since 2019 it received **81 genuine reports and paid over $90,000**. On **22 January 2026** curl announced the HackerOne bounty would end **31 January 2026**, moving to unpaid GitHub reporting: "The main goal with shutting down the bounty is to remove the incentive for people to submit crap." Thirty billion installations, seven volunteers on the security team, and the funding mechanism was destroyed by an externality nobody was paying for ([Stenberg, 14 July 2025](https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-slops/); [BleepingComputer, 22 Jan 2026](https://www.bleepingcomputer.com/news/security/curl-ending-bug-bounty-program-after-flood-of-ai-slop-reports/)).

### 11. Blender
- **What:** 3D creation suite — modelling, animation, simulation, rendering, compositing, video editing.
- **Started:** launched **2 January 1994** as an in-house tool at the Dutch studio NeoGeo. **By:** Ton Roosendaal.
- **Licence:** **GPL-2.0-or-later.** The Blender Foundation initially reserved dual-licensing rights but **suspended that indefinitely in 2005** and never exercised it.
- **Scale:** Blender Institute employs **26 full-time staff and 12 freelancers**. Development Fund corporate members include Epic Games, Nvidia, Microsoft and Apple. The 2024 Latvian film ***Flow* was made entirely in Blender using the EEVEE renderer and won the Academy Award for Best Animated Feature**. Other credits include *Spider-Man 2* previsualisation ([Blender](https://en.wikipedia.org/wiki/Blender_(software))).
- **Mechanism:** A crowdfunded *liberation*. When NaN went bankrupt in 2002, Roosendaal founded the Blender Foundation in May 2002 and launched the **"Free Blender" campaign on 18 July 2002** to buy the source code back from the creditors for **€100,000 (~US$100,670 at the time)**. It succeeded on **7 September 2002**. Blender is the only major creative application whose community literally purchased its freedom.
- **Non-obvious fact:** An Oscar for Best Animated Feature (March 2025) was won by a film made entirely in a GPL-licensed tool that a community bought out of bankruptcy for €100,000, against competition from studios with per-seat licensing budgets larger than Blender's entire annual funding.

### 12. Visual Studio Code and the Language Server Protocol
- **What:** An editor, and the protocol that decoupled language intelligence from editors.
- **Started:** VS Code 2015; **LSP standardisation announced 27 June 2016**, by Microsoft with **Red Hat and Codenvy**.
- **Licence:** The **`vscode` repository is MIT**; the **shipped Microsoft binary is not** — it is proprietary, adds telemetry, and its marketplace and several extensions (C/C++, remote development) are licensed to permit use only with the Microsoft build. **VSCodium** exists to build the MIT source without those additions. LSP's specification is open and developed on GitHub. **[The exact licence terms of the Microsoft build and marketplace were not fetched this session — verify before publishing specifics.]**
- **Scale:** **75.9% of developers use VS Code** — Stack Overflow 2025, n=49,063 — against Visual Studio 29% and IntelliJ IDEA 27.1% ([SO 2025](https://survey.stackoverflow.co/2025/technology)).
- **Mechanism:** LSP is the interesting half. Before it, supporting *M* languages in *N* editors was an M×N problem, and the practical consequence was that good tooling existed only for languages with a corporate IDE behind them. LSP made it M+N. Neovim, Emacs, Helix, Zed and JetBrains all consume language servers written for VS Code — Microsoft's open protocol subsidised its own competitors, and the ecosystem is strictly better for it.
- **Non-obvious fact:** This is a *complicated* success, and worth saying so. The MIT-licensed core plus proprietary shipped binary plus licence-restricted marketplace is a textbook **open core** structure, executed so smoothly that most of its 75.9% user base does not know it is running proprietary software. LSP's genuine open standard sits inside a strategy that also captured the editor market.

### 13. OpenStreetMap
- **What:** A free, editable map of the world.
- **Started:** 2004, by Steve Coast. **[Not verified this session.]**
- **Licence:** **ODbL 1.0** (Open Database License) — a copyleft *database* licence, since map data is not software. **[Not verified this session.]**
- **Scale:** **10 million registered users (2025-Q2)**; **2.25 million distinct user contributors (2025-Q2)**; **10 billion nodes (12 Aug 2025)**; ~4 million map changes per day (2021-Q4) ([OSM wiki Stats](https://wiki.openstreetmap.org/wiki/Stats)). I could not fetch `openstreetmap.org/stats/data_stats.html` — blocked by robots.txt.
- **Mechanism:** Copyleft on *data*. The ODbL means a commercial user who improves the map must share the improved database back — which is why Apple, Meta, Microsoft, Amazon and TomTom all contribute rather than fork. Combined with the fact that local knowledge cannot be bought at scale: the mapper who knows which alley is one-way lives on that alley.
- **Non-obvious fact:** In humanitarian crises, OSM is often the *only* current map. The Humanitarian OpenStreetMap Team mobilises thousands of remote volunteers to trace buildings and roads from satellite imagery within hours of a disaster — a capability no commercial mapping provider offers, because there is no business model in mapping a place immediately after it has been destroyed. **[HOT detail not verified this session.]**

### 14. Hugging Face and the open-weight model ecosystem
- **What:** A hub for models, datasets and demos, plus the `transformers` library; the distribution layer for open-weight AI.
- **Started:** 2016 as a chatbot company; pivoted to ML tooling. **[Not verified this session.]**
- **Licence:** `transformers` is Apache-2.0; hosted models carry their own, wildly varying, licences. **[transformers licence not verified this session.]**
- **Scale (Hugging Face, *State of Open Models: Summer 2026*, covering Jan–Aug 2026):** **models 2.43M → 2.96M; datasets 711,000 → 1,000,000; Spaces 1.00M → 1.44M.** Concentration is extreme: **85.6% of models have fewer than 200 lifetime downloads, and 1.5% of repositories account for 99.2% of all downloads.** Small models dominate actual use: **sub-1B models are 83% of all-time downloads; >100B models are 1%;** in 2026, models above 70B took just **3% of annual download volume**. Leadership: AMD and NVIDIA each published 200+ new model repos; **Qwen has 151,448 derivatives on the Hub — 2.6× Meta's total footprint — adding roughly 180–210 new derivative repos per day through 2026.** Licence split above 20B parameters: **Chinese releases 59% Apache-2.0 / 22% MIT; US releases 29% Apache or MIT, 41% custom terms, 30% no declared licence** ([HF, Summer 2026](https://huggingface.co/blog/state-of-open-models-summer-2026)).
- **Mechanism:** Hugging Face made model *distribution* a package-manager problem. `from_pretrained()` is the `pip install` of ML, and once weights had a registry with versioning, cards, and a download counter, "open weights" became a competitive lane rather than a research gesture.
- **Non-obvious fact:** The economics are inverted from every other success story here. Open models are **~20% of token usage but only ~4% of revenue** ([OSI, Aug 2026](https://opensource.org/blog/the-ai-era-arcs-toward-openness)), and Hugging Face's own report is blunt that for the labs releasing weights "the return has to come from somewhere else: API and cloud business, hardware and platform positioning, or the ecosystem position itself." Also worth noting: the most permissively licensed frontier-adjacent models in 2026 are Chinese, and the most restrictively licensed are American.

---

### Instructive failures and near-misses

#### Failure 1 — OpenSolaris: open-sourced to death by licence and governance
Sun began planning OpenSolaris in early 2004, ran a pilot from September 2004, and chose the **CDDL** — an MPL-1.1 derivative — submitting it to the OSI on 14 January 2005. DTrace was released 25 January 2005; the bulk of the Solaris code on 14 June 2005. Governance looked serious: a Community Advisory Board from 4 April 2005 including Roy Fielding and Simon Phipps, replaced by an independent **OpenSolaris Governing Board** under a charter Sun approved on 10 February 2006.

Then Oracle acquired Sun in 2010. On **13 August 2010** an internal Oracle email leaked indicating binary distributions would end. The final build, 134b, appeared **12 November 2010**; Oracle Solaris 11 Express, proprietary, on **15 November 2010**. Former developers had already launched **OpenIndiana on 14 September 2010**, with the **illumos Foundation** taking the kernel and userland; illumos-based distributions survive today ([OpenSolaris](https://en.wikipedia.org/wiki/OpenSolaris)).

**Why it failed, precisely.** Three compounding causes. **(1) The licence was chosen to be file-level copyleft that could be mixed with other licences — with the effect, widely read as deliberate, of being GPL-incompatible.** That permanently walled ZFS and DTrace off from Linux, denying OpenSolaris the one integration path that would have given it a mass developer base. **(2) Governance was advisory, not sovereign.** The OGB had a charter Sun approved; it never held the copyrights, the trademark, the build infrastructure or the release process. When ownership changed hands, the community discovered it owned nothing. **(3) The community was never given a reason to exist independently of Sun** — there was no vendor-neutral foundation with assets before the crisis, only after. The general lesson: *a community that does not control the trademark, the copyrights and the infrastructure is a marketing programme, not a project.*

#### Failure 2 — Apache OpenOffice: the fork that took the community, and the licence that made it one-way
StarOffice was acquired by Sun in 1999 and open-sourced as **OpenOffice.org in July 2000**. In **September 2010** the majority of external developers left over Oracle's stewardship, forming **The Document Foundation** and launching **LibreOffice in January 2011**. Oracle discontinued OpenOffice.org development in **April 2011**, terminated the team, and donated trademarks and code to the **ASF in June 2011**.

The ASF relicensed the code to **Apache-2.0**, replacing the previous LGPL. This had a specific, corrosive consequence: **code could flow from Apache OpenOffice into LibreOffice but not back**, because LibreOffice's copyleft could not be absorbed into a permissive project. LibreOffice initially rebased on AOO 3.4, and then the flow stopped: **by 2016 only 11 commits from Apache OpenOffice had been merged into LibreOffice — 0.07% of LibreOffice's commits for the period.**

Downloads peaked at nearly **148,000/day in 2013**, falling to about **50,000/day in 2019–20**; cumulative downloads passed 200 million by November 2016. Retirement was formally raised by the project management committee chair in **September 2016** ([LWN covered it](https://lwn.net/Articles/699047/)). The latest release, **4.1.16, shipped 10 November 2025**, security fixes only. In **July 2025 the Apache Security Team raised OpenOffice's risk status to "red"**, citing unresolved vulnerabilities and inadequate development resources ([Apache OpenOffice](https://en.wikipedia.org/wiki/Apache_OpenOffice)).

**Why it failed, precisely.** The ASF got the *asset* and TDF got the *people*, and the people were the asset. Compounding it, the relicensing to Apache-2.0 — chosen for good foundation-policy reasons — created a one-way valve that guaranteed AOO could never benefit from its fork's development while the fork could freely benefit from its own. Fifteen years later a project with hundreds of millions of installed users is a security liability that its own foundation flags in red. The lesson: **the licence you choose determines which direction code can flow after a fork, and after a fork that direction determines who survives.**

#### Near-miss 3 — Netscape/Mozilla/Firefox: the model nearly failed, then worked, then lost anyway
Netscape announced the source release on **22 January 1998** and shipped on **31 March 1998** under the Netscape Public License, launching the Mozilla Project. This is the event that catalysed the coining of "open source", the OSI, and the whole 1998 inflection — and *on its own terms it failed*. The Communicator codebase was too degraded to build on; the team abandoned it and rewrote from scratch. Netscape 6 did not ship until **November 2000**. Firefox 1.0 did not arrive until **November 2004** — six and a half years after the release, by which time Internet Explorer had won the desktop.

Then it worked: Firefox peaked around **30%** worldwide usage share, forced Microsoft to resume IE development, and drove the standards revival that produced modern web platform governance. And then it lost: Firefox was at **10–11% in late 2015**, and stands at **3.34% in July 2026**, against Chrome 68.22%, Safari 16.47% and Edge 5.37% ([StatCounter](https://gs.statcounter.com/browser-market-share); [Mozilla](https://en.wikipedia.org/wiki/Mozilla)).

**Why this is instructive.** Two reasons. First, **the founding event of the open source movement took six years to produce a shippable product** — the standard narrative that "Netscape open-sourced the browser and the bazaar took over" is simply false, and anyone writing history should say so. Second, the funding structure: Mozilla Foundation and subsidiaries reported **2024 total revenue of $680.4 million, of which $498.2 million was royalty/search revenue**, and the audited financials disclose that **approximately 86% of Mozilla's revenues from customers with contracts were derived from one customer** for the year ended 31 December 2024 ([Mozilla Fdn 2024 audited financials, PDF](https://stateof.mozilla.org/pdf/Mozilla%20Fdn%202024%20-%20AuditedFinancials.pdf)). The principal independent counterweight to Google's browser monopoly derives roughly 86% of its contracted revenue from Google. That is the sustainability problem in its purest form.

---

## PART 3 — THE EVIDENCE TABLE

| Claim | Number | Source | Date | Caveat |
|---|---|---|---|---|
| Demand-side value of OSS (each firm recreates what it uses) | **$8.80 trillion** at global average wages; $2.59tn low-wage; $13.18tn high-wage | [HBS WP 24-038, Hoffmann, Nagle, Zhou (PDF)](https://www.hbs.edu/ris/Publication%20Files/24-038_51f8444f-502c-4139-8bf2-56eb4b65c58a.pdf) | Version dated 1 Jan 2024 | **This is a replacement-cost thought experiment, not observed value.** It is *not* "open source is worth $8.8tn"; it is "if OSS vanished and every firm rebuilt what it uses, at global average developer wages, it would cost $8.8tn." |
| Supply-side value (recreate all widely-used OSS **once**) | **$4.15 billion** global average; $1.22bn low-wage; $6.22bn high-wage | Same | Same | The 2,000× gap between supply and demand side *is the paper's point*: OSS is written once and used by everyone. |
| Firms' software spend without OSS | **3.5× current**, ~$12.2 trillion total | Same | Same | Follows directly from the demand-side approach; inherits all its assumptions. |
| Concentration of value creation | **96% of demand-side value created by 5% of OSS developers** | Same | Same | Bot accounts could not be fully filtered; authors call the developer-level attribution conservative. |
| **Critique** of the above | The paper's alternative "goods market" approach yields **$177 million** — four orders of magnitude lower | [Chad Whitacre, Open Path](https://openpath.quest/2024/questioning-the-value-of-open-source-software/) | 2024 | Whitacre argues the goods-market model (OSS replaced by commercial vendors selling to many buyers) is the realistic counterfactual, not every firm rebuilding independently. Also flags Go's inclusion as outsized and the absence of open data. **Publish the $8.8tn only alongside this.** |
| HBS method | Census II (2.7M observations, 1,840 packages, 2020) + BuiltWith (8.8M websites, 778 JS/OSS packages, 3.4M firm domains) + GHTorrent (60,000 devs, 2.3M commits); COCOMO II; Salary Expert wages across 30 countries | Same | Same | Operating systems — "a substantial omitted category" — are **excluded**. Six languages only: C/C#/C++, Go, Java, JavaScript, Python, TypeScript. |
| Census III scale | **12+ million observations of FOSS libraries in production at 10,000+ companies** | [OpenSSF/LF press release](https://openssf.org/press-release/2024/12/04/open-source-usage-trends-and-security-challenges-revealed-in-new-study/) | 4 Dec 2024 | Data from Black Duck, FOSSA, Snyk and Sonatype — SCA-visible usage only. |
| Census III key findings | "Much of the most widely used FOSS is developed by only a handful of contributors"; individual developer account security is critical; no standardised component naming; legacy software persists (Python 2→3 still migrating) | Same | 4 Dec 2024 | Press release did not include a ranked top-packages list. |
| Codebases containing open source | **98%** of 947 audited codebases across 17 industries | [Black Duck OSSRA 2026 press release](https://news.blackduck.com/2026-02-25-Black-Duck-Research-Shows-Open-Source-Vulnerabilities-Have-Doubled-as-AI-Accelerates-Code-Creation) | 25 Feb 2026 | Audit population is skewed toward M&A due diligence — not a random sample of software. |
| Vulnerability growth | **Mean vulnerabilities per codebase +107% YoY**; component counts +30%; files per codebase +74% | Same | 25 Feb 2026 | Black Duck attributes this to AI-accelerated code creation. Correlation, not demonstrated causation. |
| Licence conflicts | **68%** of audited codebases — up 12 points from **56%**; "the highest rate in OSSRA history" | Same | 25 Feb 2026 | The press release did **not** publish high-risk-vuln or outdated-component percentages this year; I could not extract them. |
| AI code governance gap | 76% check AI-generated code for security; 54% for IP/licence; 56% for quality; **only 24% check all four categories** | Same | 25 Feb 2026 | Survey component; sample not stated in the release. |
| GitHub developer population | **180+ million**; **36.2M new in 2025 (+23%)** — more than one per second | [Octoverse 2025](https://github.blog/news-insights/octoverse/octoverse-a-new-developer-joins-github-every-second-as-ai-leads-typescript-to-1/) | Published 28 Oct 2025, updated 28 Feb 2026 | Accounts, not people. |
| Repositories | **630 million total; 121M new in 2025; 395M public (+19%)**; ~230 new repos/minute | Same | Same | Wikipedia separately records GitHub's "1 billionth repository" milestone in June 2025 and "150 million users" as of May 2025 — **these do not reconcile with Octoverse.** The 1bn figure is cumulative-ever-created; the 150M user figure is inconsistent with 180M+ and should not be used. |
| Contributions | **1.128 billion (+13%)**; **518.7M pull requests merged (+29%)** | Same | Same | — |
| AI share of GitHub | **4.3 million AI-related repositories** (nearly doubled since 2023); **1.13M repos importing LLM SDKs (+178%)**; **693,867 new AI projects in 12 months (+178%)**; ~200,000 monthly contributors to AI projects at peak (Aug 2025) | Same | Same | OSI in Aug 2026 cites **5 million+ AI projects on GitHub** — a later, larger figure; both are directional. |
| Languages | TypeScript reported as #1; Python **2.75M contributors (+48%)**, TypeScript **2.6M (+66%)**, JavaScript 2.15M (+25%) | Same | Aug 2025 snapshot | **The headline and the contributor counts point different ways** — TypeScript is ranked first while Python shows more contributors, so GitHub's #1 ranking is on a different measure. Do not publish "TypeScript has the most contributors." |
| Maintainers unpaid | **60%** unpaid; 36% paid (12% professional, 24% semi-professional) | [Tidelift State of the Open Source Maintainer 2024 (PDF)](https://assets-eu-01.kc-usercontent.com/ef593040-b591-0198-9506-ed88b30bc023/d325a56f-05be-4379-bfd1-ee4776fcad41/2024-tidelift-state-of-the-open-source-maintainer-report-.pdf) | Fielded Jul–Aug 2024, published Sept 2024 | **n = 437.** Self-selected. This is the field's most-cited number and it rests on a small sample — say so. |
| Maintainer attrition | **60%** have quit or considered quitting; 48% feel underappreciated; 50% report insufficient compensation | Same | Same | Same caveat. |
| Solo maintainers | **61% of unpaid** maintainers are solo, vs **26% of paid**; 53% of paid have co-maintainers vs 20% of unpaid | Same | Same | The bus-factor problem is a *funding* problem, quantified. |
| Paid vs unpaid security work | Paid maintainers **55% more likely on average** to implement critical security practices; 2FA 76% vs 68%; static analysis 75% vs 59% | Same | Same | Correlational — paid maintainers may also work on more security-sensitive projects. |
| Post-xz trust | **66%** of maintainers report reduced trust in non-maintainer contributions | Same | Same | Direct measurement of xz's social damage. |
| Kubernetes in production | **82%** of container users, up from 66% in 2023 | [CNCF 2025 Annual Survey](https://www.cncf.io/announcements/2026/01/20/kubernetes-established-as-the-de-facto-operating-system-for-ai-as-production-use-hits-82-in-2025-cncf-annual-cloud-native-survey/) | 20 Jan 2026 | **Sample size and field dates not published in the announcement.** Respondents self-select from a cloud-native audience. |
| GenAI on Kubernetes | **66%** of orgs hosting GenAI models use K8s for some/all inference; **44%** run no AI/ML on K8s at all | Same | 20 Jan 2026 | Both figures are in the same release; the second undercuts the headline. |
| Permissive vs copyleft | Permissive **82% (2022) → 73% (2025)** | [RedMonk, State of Open Source Licensing 2026](https://redmonk.com/sogrady/2026/03/25/open-source-licensing-2026/) | 25 Mar 2026 | RedMonk's own caution: sources are inconsistent (Black Duck defunct, GitHub Archive changed, now deps.dev); **~80%+ of projects have no licence at all**; enterprise code is invisible. "An evaluation of the data that's available rather than a full fidelity representation." |
| GPL family decline | ~**71% (2008) → 54% (2013) → 39% (2015) → 24% (2018)** | [GNU GPL, Wikipedia](https://en.wikipedia.org/wiki/GNU_General_Public_License) | as dated | Underlying surveys differ in method year to year. |
| curl AI slop | **~20%** of 2025 submissions AI slop; **~5%** genuine vulnerabilities; 81 genuine reports and **$90,000+** paid since 2019 | [Stenberg](https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-slops/) | 14 July 2025 | One project's data, reported by its lead. |
| curl bounty ended | HackerOne programme closed **31 Jan 2026**, announced 22 Jan 2026 | [BleepingComputer](https://www.bleepingcomputer.com/news/security/curl-ending-bug-bounty-program-after-flood-of-ai-slop-reports/) | 22 Jan 2026 | — |
| Industry response to AI slop | **$12.5M** from AWS, Anthropic, Google, Microsoft, OpenAI with the Linux Foundation | [AWS Open Source Blog](https://aws.amazon.com/blogs/opensource/aws-and-others-invest-12-5m-to-defend-the-open-source-ecosystem-from-ai-threats/) | 17 Mar 2026 | Cumulative Alpha-Omega totals not disclosed in this post. |
| Alpha-Omega funding | **$4.5M in 2024; ~$8.6M cumulative since Feb 2022**; 20 grants, 15 orgs, average **$227,445**; 63% to security staffing | [Alpha-Omega 2024 Annual Report (PDF)](https://alpha-omega.dev/wp-content/uploads/sites/22/2025/01/Alpha-Omega-Annual-Report-2024_012925.pdf) | 29 Jan 2025 | Funded by AWS, Google, Microsoft only. |
| Sovereign Tech Agency | €13M (2022), ~€22M (2023), ~€16M (2024); **€24.6M across ~60 projects since 2022** | [Sovereign Tech Agency](https://en.wikipedia.org/wiki/Sovereign_Tech_Agency); [EU-STF](https://en.wikipedia.org/wiki/EU_Sovereign_Tech_Fund) | to Apr 2025 | The two Wikipedia pages give slightly different totals (€20M+ vs €24.6M) depending on cut-off. |
| EU open source commitment | **€2 billion over 7 years**; **€264bn/yr** current EU proprietary IT spend; 30M free-software-tool users by 2030 | [FSFE](https://fsfe.org/news/2026/news-20260603-01.en.html); [TechPolicy.Press](https://www.techpolicy.press/how-the-eus-tech-sovereignty-package-finally-puts-open-source-to-the-test/) | 3 June 2026 | **Non-binding strategy.** FSFE: needs "binding rules, long-term funding, and meaningful civil society involvement." |
| HTTPS adoption | **<30% (2015) → ~80% globally, ~95% US** | [Let's Encrypt](https://letsencrypt.org/2025/12/09/10-years) | 9 Dec 2025 | Measured via Firefox telemetry — a browser with 3.34% share, so the sample is not the whole web. |
| Let's Encrypt issuance | **~10 million certificates/day** (late Sept 2025); "closing in on protecting one billion web sites" | Same | Sept/Dec 2025 | ISRG explicitly warns that "certificates issued" ≠ "active certificates". |
| Hugging Face Hub | Models **2.43M → 2.96M**; datasets **711k → 1M**; Spaces **1.00M → 1.44M** (Jan–Aug 2026) | [HF State of Open Models Summer 2026](https://huggingface.co/blog/state-of-open-models-summer-2026) | Aug 2026 | Vendor's own platform data. |
| HF concentration | **85.6%** of models have <200 lifetime downloads; **1.5% of repos = 99.2% of downloads** | Same | Aug 2026 | The strongest available corrective to "millions of open models" rhetoric. |
| Open model economics | **~20% of token usage, ~4% of revenue** | [OSI](https://opensource.org/blog/the-ai-era-arcs-toward-openness) | 12 Aug 2026 | OSI cites a Mozilla report; I did not fetch the underlying source. |
| Linux kernel 6.18 | **2,134 developers (record), 333 first-time, 13,710 commits**; Intel 10.4%, Google 7.9%, Red Hat 6.3%, AMD 5.0%, Linaro 3.9% | [LWN](https://lwn.net/Articles/1046966/) | Released 30 Nov 2025 | Per-cycle, not annual. |
| Web server share | Nginx **31.4%**, Cloudflare **29.6%**, Apache **22.6%**, LiteSpeed 14.9%, Node.js 7.0%, IIS 3.1% | [W3Techs](https://w3techs.com/technologies/overview/web_server) | 23 Aug 2026 | "A website may use more than one web server" — figures sum above 100%. Netcraft's "million busiest sites" measure gives materially different numbers (Apache 17.83%, March 2025). |
| Mobile OS | Android **68.36%**, iOS **31.6%** | [StatCounter](https://gs.statcounter.com/os-market-share/mobile/worldwide) | July 2026 | Page-view-derived from 3bn+ monthly views; not device shipments. Counterpoint/IDC shipment data differs. |
| Browsers | Chrome **68.22%**, Safari 16.47%, Edge 5.37%, **Firefox 3.34%**, Samsung Internet 2.06%, Opera 1.88% | [StatCounter](https://gs.statcounter.com/browser-market-share) | July 2026 | Same methodology caveat. |
| ASF scale | **295 TLPs, 32 podlings, 9,905 committers, 1,147 members, 1,310 releases, 239 CVEs published**; revenue $2.08M, expenses $2.28M, **net −$114,471** | [ASF FY2025 Annual Report (PDF)](https://apache.org/foundation/docs/FY2025AnnualReport.pdf) | FY2025 (2024–25) | — |
| Databases in use | PostgreSQL **55.6%**, MySQL 40.5%, SQLite 37.5%, SQL Server 30.1%, Redis 28% | [SO Developer Survey 2025](https://survey.stackoverflow.co/2025/technology) | 2025, n=49,063 | Self-selected respondents skew toward web/startup work. |
| Editors | VS Code **75.9%**, Visual Studio 29%, IntelliJ 27.1% | Same | Same | Same caveat. |
| Git dominance | **93.9%** primary VCS | [Git, Wikipedia](https://en.wikipedia.org/wiki/Git), citing SO 2022 | 2022 | **The 2025 survey did not publish a comparable VCS figure.** Use the 2022 number with its date, or use GitHub's 81.1% (2025) instead. |
| SQLite deployment | **1 trillion+ databases in active use**; plausibly the 2nd most deployed library after zlib | [sqlite.org](https://www.sqlite.org/mostdeployed.html) | current | **Self-reported extrapolation** (4bn smartphones × hundreds of DBs each), not measurement. Say so. |
| curl deployment | **~30 billion installations** | [curl FAQ](https://curl.se/docs/faq.html) | 2025 estimate | Project's own estimate. |
| OpenStreetMap | **10M registered users, 2.25M distinct contributors (2025-Q2); 10bn nodes (12 Aug 2025)** | [OSM wiki](https://wiki.openstreetmap.org/wiki/Stats) | 2025 | Registered ≠ active; the contributor figure is the meaningful one. |
| Wikipedia | EN **7,171,504 articles**; all editions **67,159,986**; **345 language editions**; **275,757 active EN editors** | [Wikipedia](https://en.wikipedia.org/wiki/Wikipedia) | 2026 figures for editors/languages; article counts as dated on-page | The article's traffic figure (18bn views, 500M uniques) is **from Feb 2014** — do not republish as current. |
| Mozilla funding concentration | 2024 revenue **$680.4M**, royalties **$498.2M**, **~86% of contracted revenue from one customer** | [Mozilla Fdn 2024 audited financials (PDF)](https://stateof.mozilla.org/pdf/Mozilla%20Fdn%202024%20-%20AuditedFinancials.pdf) | FY 31 Dec 2024 | The audit does not name the customer or disclose contract term. |
| xz | CVE-2024-3094, **CVSS 10.0**; campaign from ~2021; backdoor Feb 2024 in 5.6.0/5.6.1; found **29 Mar 2024** by Andres Freund; fixed 5.6.2, 29 May 2024 | [XZ Utils backdoor](https://en.wikipedia.org/wiki/XZ_Utils_backdoor) | 2024 | Wikipedia is the best consolidated account I could reach; **the definitive technical write-ups (Freund's oss-security post, Russ Cox's timeline, Filippo Valsorda's analysis) I did not fetch this session** — get them before publishing technical detail. |
| Log4Shell | Reported to ASF **24 Nov 2021**; disclosed 9–10 Dec 2021; CSRB calls it an **"endemic vulnerability"** persisting "perhaps a decade or longer" | [CSRB report (PDF)](https://www.cisa.gov/sites/default/files/publications/CSRB-Report-on-Log4-July-11-2022_508.pdf) | 11 July 2022 | CSRB gave **no** specific count of affected organisations or downloads, and did **not** state the number of Log4j maintainers. |

### On AI and open source in 2025–26 — the credible evidence

Four independent, load-bearing data points, all fetched:

1. **AI is generating vulnerability reports faster than volunteers can triage them.** curl: ~20% AI slop, ~5% genuine, programme terminated 31 Jan 2026. FFmpeg publicly called Google's Big Sleep output **"CVE slop"** on 31 October 2025 after a report on a LucasArts Smush codec path affecting only early-1990s games — the FFmpeg team's line was "security issues are taken extremely seriously in FFmpeg, but fixes are written by volunteers" ([TechSpot, 12 Nov 2025](https://www.techspot.com/news/110219-ffmpeg-volunteer-maintainers-struggling-keep-pace-ai-generated.html)).
2. **The industry has priced the problem at $12.5M** (AWS/Anthropic/Google/Microsoft/OpenAI + Linux Foundation, 17 Mar 2026) — for tooling to validate and filter AI-generated reports.
3. **Licence compliance is degrading measurably.** OSSRA 2026: licence conflicts at **68%**, up 12 points in one year, "the highest rate in OSSRA history", alongside components +30% and mean vulnerabilities +107% — Black Duck's explanation is AI-accelerated code creation. Governance has not kept up: **only 24% of organisations evaluate AI-generated code across IP, licensing, security *and* quality.**
4. **The contribution mix has shifted.** Octoverse 2025: 4.3M AI repos, 1.13M repos importing LLM SDKs (+178%), 693,867 new AI projects in 12 months, and 36.2M new developers (+23%) — the largest single-year influx ever, arriving with AI assistance as the default.

The synthesis worth publishing: **AI raised the supply of code, of bug reports, and of contributors, without raising the supply of maintainers.** Every 2025–26 crisis in this document is a variant of that one sentence.

---

## PART 4 — THE ARGUMENTS WORTH PUBLISHING

### 1. Free software vs open source — is the ethical framing load-bearing or a distraction?

**Load-bearing.** Without the ethical frame, there is no principled reason to prefer freedom when proprietary is better — and proprietary is frequently better. The framing is what produced the *legal instruments* that actually protected anything: copyleft exists because Stallman was arguing about rights, not efficiency, and GPLv3's anti-tivoisation clauses exist because "the user must be able to run modified code on their own device" is an ethical proposition that no engineering argument generates. Every genuinely *durable* win in this history traces to a copyleft or copyleft-descended instrument: Linux's GPLv2 forced hyperscaler cooperation; the ODbL forces Apple and Meta to give map data back; the reversals of both Elastic (2024) and Redis (2025) landed on the **AGPL**, an FSF licence. And in the 2024–26 AI definition fight, the FSF's position — that you cannot call a system free if its training data doesn't respect users — is the one that has held its shape while OSI's has had to absorb "data information" compromises.

**A distraction.** The ethical frame was *empirically losing* in 1998 and the pragmatic reframe *empirically won* — Netscape, IBM, Sun, and eventually Microsoft, GitHub, Kubernetes, and a $680M-revenue Mozilla. "Free" was misread as "free of charge" in every commercial conversation, and the FSF's rhetorical style read to corporate counsel as hostile, which meant the code did not get deployed, which meant the freedoms protected nobody. The OSD's *checklist* form is the whole point: a checklist can be written into an EU procurement rule and a manifesto cannot. The EU's June 2026 "Free Software first principle" got into a Commission strategy because there is an OSI-approved licence list that a lawyer can point at. Moreover, most of the practical wins in this document are *not* copyleft: Apache-2.0 built Kubernetes and the entire cloud-native stack; MIT built the JavaScript ecosystem; SQLite is public domain and is the most-deployed database on Earth.

**Where I'd land, and say so openly:** the framing is load-bearing *for the licences* and distracting *for the adoption*. The movement needed both, and the fact that the two camps have re-converged on the AI question in 2026 — arriving at the same restrictive conclusion in different vocabularies — is evidence that the split was always tactical rather than substantive.

### 2. Copyleft vs permissive — which produced more freedom in practice?

**Copyleft.** Linux is the largest cooperative engineering project in history and its GPLv2 is why: no vendor could privately fork and out-develop the commons, so Intel, Google, Red Hat and AMD were structurally compelled to upstream (6.18: 2,134 developers, Intel 10.4%, Google 7.9%). Compare BSD, technically ahead in 1992, permissively licensed, and fragmented into SunOS, BSD/OS and proprietary derivatives. Compare OpenOffice: the ASF's relicensing to Apache-2.0 created a one-way valve into LibreOffice and killed the original. Compare OpenStreetMap: the ODbL is why Apple, Meta and Microsoft contribute rather than take. And note the direction of travel in the relicensing wave — the vendors who felt exploited by hyperscalers did not reach for a permissive licence, they reached for the **AGPL**.

**Permissive.** Freedom that isn't deployed protects nobody, and permissive licences got deployed far more. Apache-2.0 — with the patent grant that MIT/BSD lack — is why Kubernetes, Kafka, Hadoop, Swift and effectively all of CNCF exist and why competitors co-develop them. MIT is why the JavaScript and Python package ecosystems exist at the scale they do. Permissive licensing is a market-share strategy that also happens to produce commons: Google gave Kubernetes away *and* gave away control of it, and got a portability standard it designed. And copyleft has a specific, demonstrated failure: **it did not protect against the cloud**, because copyleft triggers on distribution and SaaS does not distribute. Every vendor grievance of 2018–2024 is a GPL failure mode.

**The honest scorecard.** Copyleft produced more *irreversible* freedom in the specific cases where a single codebase had strategic value and the alternative was capture (Linux, OSM, Blender). Permissive produced more *total* deployed freedom by volume, and produced the patent protections that copyleft licences of the 1991 vintage lack. The data show permissive winning on share (82%→73% permissive, RedMonk 2026; GPL family 71%→24%, 2008–2018) — but share of *repositories* is a poor proxy for share of *consequence*, since Linux, Git, Blender and WordPress are all GPL and all count as one repository each.

### 3. Open core — legitimate sustainability model or bait and switch?

**Legitimate.** Someone has to pay for full-time engineering, and the alternatives are worse: 60% of maintainers are unpaid, 60% have quit or considered it, and 61% of the unpaid are solo (Tidelift 2024). Open core at least funds people. GitLab, Grafana, Sentry, Elastic and HashiCorp have collectively employed thousands of full-time open source engineers — vastly more than Alpha-Omega's $8.6M cumulative or the Sovereign Tech Agency's €24.6M could. And the model has a real self-correcting property: **if the core is genuinely open, the community can fork when the vendor overreaches, and in 2023–25 it did so three times in a row** (OpenTofu, Valkey, OpenSearch). VS Code is open core executed so well that 75.9% of developers use it without noticing.

**Bait and switch.** The pattern is now documented, not speculative. A project is released permissively to acquire adoption *because* it is open; adoption creates lock-in; the licence is then changed once switching costs are high enough. MongoDB (2018), Elastic (2021), HashiCorp (2023) and Redis (2024) all followed it, and in each case the community had built businesses, careers and production systems on a promise that was withdrawn. The deeper objection is about the *shape* of the value capture: features get moved above the line over time (SSO, audit logs, RBAC — the "SSO tax"), so the open core hollows out. And the community's contributions, made under one set of expectations, end up inside a product sold under another.

**What the evidence actually shows.** Both. It is legitimate *and* it was used as a bait and switch, and the market has now developed an immune response: the credible fork. **Two of the four canonical relicensings were reversed** (Elastic to AGPL in 2024, Redis to AGPL in 2025), and in both cases the stated reason was that the community had rejected the new licence. The practical test to publish: *does the project have a neutral foundation home, a trademark held outside the vendor, and a CLA that does not assign copyright?* If not, assume the licence can change.

### 4. Do the hyperscalers free-ride, or fund more than they take?

**They fund more than they take.** The numbers are not close to zero. AWS, Google and Microsoft are the entire funding base of **Alpha-Omega** ($8.6M cumulative, 63% of 2024 grants to security *staffing* at the PSF, Rust Foundation, Node.js, Eclipse, the kernel, RubyGems, FreeBSD, Jenkins). They were founding funders of the **CII** in 2014. On the kernel itself, Intel, Google, Red Hat (IBM) and AMD are four of the top five contributors to 6.18. Google *created and gave away* Kubernetes and then handed governance to a neutral foundation. AWS took the OpenSearch fork and donated it to the Linux Foundation in Sept 2024, where it has passed a billion downloads with 400+ contributing organisations. Meta open-sourced PyTorch and moved it to the Linux Foundation in 2022. In March 2026 the five largest AI firms put $12.5M into maintainer triage tooling.

**They free-ride.** Scale matters. Against an $8.8 trillion demand-side estimate (or even the sceptics' far smaller figure), **$8.6 million cumulative** from the three largest cloud companies over four years is a rounding error — Alpha-Omega's *average grant is $227,445*, less than one senior engineer's fully-loaded cost. The funding is also strategically directed: it goes to security (which protects the funders' own supply chain) and to projects that anchor the funders' platforms, not to the boring, load-bearing, unglamorous dependencies that Census III identifies as maintained by "only a handful of contributors". And the behavioural evidence is damning: **Google's automated systems generated enough low-value bug reports to make FFmpeg publicly demand "fund us or stop sending bugs"**, and to contribute to curl ending its bounty programme. That is the free-rider problem in its purest form — externalising triage cost onto volunteers while contributing no triage capacity.

**The sharpest version of the disagreement:** hyperscalers fund open source *security* generously and open source *maintenance* barely at all, because security failures are their risk and maintainer burnout is not. The CSRB spotted this in 2022 (Recommendation 14: pilot open source maintenance support) and the market has still not solved it.

### 5. Should maintainers be paid, and by whom — and what does paying change?

**Yes, obviously.** The evidence that it changes outcomes is the strongest in this whole document. Tidelift 2024: paid maintainers are **55% more likely on average** to implement critical security practices (2FA 76% vs 68%, static analysis 75% vs 59%), and — the more important finding — **only 26% of paid maintainers work alone versus 61% of unpaid**, with 53% of paid projects having co-maintainers versus 20% of unpaid. Payment does not merely buy attention; **it buys a second maintainer**, which is the actual fix for the bus factor. And the counterfactual is documented: the xz attack succeeded through a multi-year pressure campaign against a single, exhausted, unpaid maintainer. A funded project with three maintainers is a materially harder target.

**By whom — the four models, with their failure modes.** *(a) Companies directly* (Tidelift subscriptions, corporate employment): responsive to whoever pays, so unfashionable dependencies stay unfunded. *(b) Pooled industry funds* (Alpha-Omega, OpenSSF): neutral allocation, but total capital is two orders of magnitude too small. *(c) States* (Sovereign Tech Agency; the proposed EU-STF at €350M; the EU's €2bn/7yr): the only source at plausible scale, but introduces sovereignty questions — the STA is a German federal body funding globally-used infrastructure like PyPI, which is either a public good or a soft-power instrument depending on who you ask, and it is subject to budget politics (2022 €13M → 2023 €22M → 2024 €16M is a *declining* trajectory). *(d) Individual sponsorship* (GitHub Sponsors, Open Collective): dignified, and demonstrably insufficient at 60% unpaid.

**What paying changes — including the costs, which are real.** It changes the *relationship*. An unpaid maintainer owes nobody anything and can say no; a paid one acquires obligations, SLAs and stakeholders. It can convert a gift economy into a service economy, and gift economies are why several projects here are good. It introduces allocation politics into communities that previously had none. And it can distort priorities toward whatever the funder measures — the CRA-compliance-shaped work that a grant will pay for, rather than the refactor the maintainer knows is needed. The strongest version of the sceptical case is Daniel Stenberg's own trajectory: curl's problem in 2026 was not that nobody paid, it was that **money attracted the wrong contributors** — the bounty had to be killed *because* it was paid.

### 6. Is "open source AI" coherent without training data?

**No.** The OSD's freedoms are not a mood; they are operational. "Freedom to study" means being able to determine *why* a system behaves as it does, and with weights alone you can observe behaviour but not trace its cause. "Freedom to modify" in any meaningful sense means being able to *rebuild* — and you cannot rebuild without data. Julia Ferraioli's formulation is the cleanest: without data, "the only things that the OSAID guarantees are the ability to use and distribute." Tom Callaway's is the strategic one: a data-optional definition "devalue[s] the meaning of 'open source' in all other contexts" — you cannot maintain a strict definition for code and a loose one for models without the loose one bleeding across. And there is a concrete security argument: Giacomo Tesio's point that undetectable backdoors can be planted via training data is exactly the xz lesson applied to a domain where review is *harder*, not easier. The FSF and the Software Freedom Conservancy both landed here.

**Yes.** A definition that no existing system can satisfy is not a definition, it is a boycott. Essentially no frontier model could release its training corpus — for copyright reasons, licensing reasons, privacy reasons, and sheer scale — so "open source AI requires open data" designates the empty set while the world proceeds to call things open source anyway. That is *worse* for the term than a workable standard. OSI's substantive claim is that **weights plus architecture plus code genuinely are the preferred form for making modifications** to an AI system, which is what the OSD's language actually requires: nobody retrains from scratch, everyone fine-tunes, and fine-tuning needs weights. The "data information" requirement is a real disclosure obligation, not nothing. And OSI reached it through a global co-design process spanning builders, deployers, unions, ethicists and lawyers, not by fiat.

**State of play in 2026, honestly.** Unresolved and increasingly moot. The market settled on **"open weights"** as the operative term, which concedes the critics' semantics while declining their standard. OSI has shifted from definition-policing to openness-advocacy (its 12 Aug 2026 post argues from usage, cost and performance data). And the licensing centre of gravity moved: the most permissively licensed serious models in 2026 are Chinese (59% Apache-2.0, 22% MIT above 20B params), while US releases are 41% custom terms and 30% unlicensed. **None of them release training data.** The definition fight was won on points by the critics and lost on the ground.

### 7. Did the CRA help or harm European open source?

**Helped.** For the first time, a regulator distinguished between commercial manufacturers and the non-commercial commons rather than treating all software identically. The **"open source steward"** category — code-hosting foundations and organisations that support software they do not monetise — carries lighter obligations than manufacturers, and pure contributors and non-monetising developers are **not directly in scope**. That distinction did not exist in the first draft and was won by open source institutions engaging the process. The regulation also forces the thing everyone has been asking for since Heartbleed: **someone must actually be accountable for the security of shipped software**, which shifts cost onto the commercial integrators who have been extracting value from unpaid maintainers. And it arrived with money attached — the CRA is part of the same policy arc that produced the June 2026 Open Source Strategy, CADA's "Free Software first principle", €2bn over seven years and the EU-STF proposal.

**Harmed.** The steward category is defined by a *negative* ("not monetising the particular pieces of software they are stewarding") that maps badly onto how projects actually fund themselves — support contracts, hosted versions, sponsorships and dual licensing all blur it, and a foundation that guesses wrong faces EU market-access risk. The compliance burden (SBOMs, vulnerability handling, coordinated disclosure, reporting from **11 September 2026**, full application **11 December 2027**) is fixed cost that scales badly to volunteer projects — the ASF triaged 650 vulnerability reports and published 239 CVEs in FY2025 on a **$2.08M budget that ran a deficit**, and the CRA adds to that. The predictable failure mode is not that European open source stops; it is that maintainers geo-fence, add "not for EU commercial use" notices, or simply stop responding to European enterprises — which reduces European access to open source rather than improving its security. And even sympathetic observers (ORC WG) note that non-monetising contributors "may experience indirect impact in terms of higher expectations around security" — i.e. the burden lands on them anyway, without the carve-out's protection.

**Too early to score, and say so.** Reporting obligations have not started (11 Sept 2026 is two weeks after this research was compiled). The honest position for publication is: the *legislative* outcome was better than the open source community feared in 2023, the *operational* outcome is unknown, and the first real evidence arrives in late 2026. Anyone claiming to know now is guessing.

---

## PART 5 — COMMONLY REPEATED AND WRONG

1. **"Linux runs 90% of the cloud" / "100% of the TOP500."**
 The cloud figure has **no primary source I could locate**, and every result returned was SEO content citing other SEO content. Do not publish it. The supercomputing figure is *probably* still true — on the June 2026 TOP500 the top five systems run Kylin OS (China), TOSS, HPE Cray OS, an unspecified OS, and RHEL, all Linux-derived — but **I could not fetch TOP500's operating-system-family statistics table** (the pages returned navigation shells only), so I cannot verify "all 500". Say what you can verify: **Android is 68.36% of mobile (StatCounter, July 2026)**; **Linux-derived OSes run the top five supercomputers (TOP500, June 2026)**; **Nginx + Apache + Cloudflare + LiteSpeed — all running predominantly on Linux — are 98.5% of identified web servers (W3Techs, Aug 2026)**.

2. **"Eric Raymond coined 'open source'."**
 No. **Christine Peterson** of the Foresight Institute suggested it, in the first week of February 1998. She deliberately did not propose it herself — Todd Anderson, who had community credibility as a Linux programmer, introduced it into discussion so it would spread "memetically". Raymond, Tim O'Reilly and Bruce Perens championed its adoption. ([Peterson's own account](https://opensource.com/article/18/2/coining-term-open-source-software)) *Bonus correction:* sources disagree on the date — OSI says **3 February 1998**; Peterson's account describes Raymond visiting on 2 February and the VA Research meeting on 5 February.

3. **"Netscape open-sourced the browser and the bazaar took over."**
 The opposite. Announced 22 January 1998, released 31 March 1998, and the codebase was so degraded that the team **threw it away and rewrote from scratch**. Netscape 6 shipped November 2000; **Firefox 1.0 did not arrive until November 2004** — six and a half years after the founding event of the open source movement, by which time IE had won. The model's flagship case study was a six-year near-failure. ([Mozilla](https://blog.mozilla.org/en/mozilla/mozilla-turns-twenty/); [Netscape Communicator](https://en.wikipedia.org/wiki/Netscape_Communicator))

4. **"Given enough eyeballs, all bugs are shallow."**
 Not a security property. Robert Glass called it a fallacy in 2003 on evidence that useful reviewers cap out at **two to four**. Heartbleed survived two years in the most security-critical library on the internet. Jim Zemlin, running the Linux Foundation, said of the 2014 vulnerabilities: "In these cases, the eyeballs weren't really looking." And xz was engineered *by the maintainer* specifically to survive review. The residual truth is weak and correlational (Amit & Feitelson 2020 found higher fix rates in popular projects). ([Linus's law](https://en.wikipedia.org/wiki/Linus%27s_law))

5. **"The xz backdoor was caught by the community's many eyes."**
 It was caught by **one engineer — Andres Freund, a PostgreSQL developer at Microsoft — investigating a performance anomaly**: SSH logins consuming unexpected CPU and throwing Valgrind errors in a Debian test build. He was not doing a security review. He was benchmarking. Had he not been curious about a sub-second latency regression, the backdoor would have shipped into Debian and Ubuntu stable. ([XZ Utils backdoor](https://en.wikipedia.org/wiki/XZ_Utils_backdoor))

6. **"MongoDB / Elastic / Redis / HashiCorp went closed source."**
 Imprecise and now partly obsolete. They went **source-available** — code readable and modifiable, but with use restrictions that fail the OSD. And the picture has changed: **Elastic added AGPLv3 in August 2024. Redis 8 shipped under AGPLv3 around 1 May 2025.** MongoDB remains SSPL. Terraform remains BUSL and HashiCorp is now inside IBM (acquisition closed 27 Feb 2025). Two of four reversed. ([Elastic](https://www.elastic.co/blog/elasticsearch-is-open-source-again); [antirez](https://antirez.com/news/151); [SSPL](https://en.wikipedia.org/wiki/Server_Side_Public_License))

7. **"Open source is worth $8.8 trillion."**
 No. **$8.8 trillion is the *demand-side replacement cost*** — what it would cost if every firm using OSS had to independently recreate it, priced at global average developer wages. The *supply-side* figure (recreate everything once) is **$4.15 billion**. And a substantive critique argues the paper's own alternative "goods market" model — OSS replaced by commercial vendors, which is the realistic counterfactual — yields **$177 million**, four orders of magnitude lower. Publish the $8.8tn only with its definition and this critique attached. ([HBS WP 24-038](https://www.hbs.edu/ris/Publication%20Files/24-038_51f8444f-502c-4139-8bf2-56eb4b65c58a.pdf); [Open Path](https://openpath.quest/2024/questioning-the-value-of-open-source-software/))

8. **"70–90% of a modern codebase is open source."**
 The commonly cited OSSRA number is a different thing: **98% of 947 audited codebases *contain* open source** (OSSRA 2026). That is a presence figure, not a share-of-lines figure. OSSRA's 2026 press release did not publish a share-of-code percentage, and the audit population (heavily M&A due diligence) is not a random sample of software. Use "98% of audited codebases contain open source components (Black Duck OSSRA 2026, n=947)" and stop there.

9. **"SQLite is open source — send them a patch."**
 SQLite is **public domain, not open-source-licensed**, and it is **explicitly not open-contribution**. It refuses patches from anyone who has not signed a public-domain dedication affidavit; **the originals are kept in a firesafe at Hwaci's offices**; and Hwaci sells an optional commercial "Warranty of Title" for jurisdictions that don't recognise public domain. The most-deployed database in the world is one of the most closed development processes in this document. ([sqlite.org/copyright](https://www.sqlite.org/copyright.html))

10. **"Linux desktop share is about 4%."**
 StatCounter puts **Linux at 7.53% of desktop for July 2026**. But treat this metric as unreliable in *both* directions: StatCounter is page-view-derived, it splits macOS into two categories ("OS X" 12.21% and "macOS" 7.61%), ChromeOS is counted separately at 1.47% despite being Linux, and a large "unknown" bucket exists. Quote it with the method attached or not at all. ([StatCounter](https://gs.statcounter.com/os-market-share/desktop/worldwide))

11. **"Wikipedia is GFDL-licensed" / "Wikipedia gets 18 billion views a month."**
 Wikipedia content is **CC BY-SA 4.0**; it migrated off the GFDL in 2009. And the 18bn/500M-uniques figure that circulates is from a **February 2014** New York Times report citing comScore — it is twelve years old. I could not obtain current traffic figures: `stats.wikimedia.org` is cache-only and cannot be fetched. ([Wikipedia](https://en.wikipedia.org/wiki/Wikipedia))

12. **"GitHub has 100 million developers."**
 **180+ million as of Octoverse 2025**, with 36.2M added in 2025 alone. Also note that GitHub's own numbers do not reconcile cleanly: Octoverse reports 630M repositories while GitHub separately announced its "1 billionth repository" in June 2025 (cumulative-ever-created, including deleted and forked), and Wikipedia carries a "150 million users, May 2025" figure that is inconsistent with Octoverse. Cite Octoverse and say which measure you mean. ([Octoverse 2025](https://github.blog/news-insights/octoverse/octoverse-a-new-developer-joins-github-every-second-as-ai-leads-typescript-to-1/); [GitHub](https://en.wikipedia.org/wiki/GitHub))

13. **"Mozilla/Firefox is funded by its community."**
 **86% of Mozilla's revenue from customers with contracts came from a single customer in 2024** ($498.2M of $680.4M total revenue was royalty/search). The main independent check on Google's browser dominance is overwhelmingly funded by Google. ([Mozilla Fdn 2024 audited financials](https://stateof.mozilla.org/pdf/Mozilla%20Fdn%202024%20-%20AuditedFinancials.pdf))

14. **"BSD lost because it was permissively licensed."**
 Partly, but the proximate cause was **litigation risk, not licence choice**. USL v. BSDi (April 1992 – February 1994) put a legal cloud over free Unix during exactly the window Linux needed. The settlement removed **3 files out of 18,000** and added copyright notices to 70. The claim was nearly empty; the *uncertainty* was decisive. ([USL v. BSDi](https://en.wikipedia.org/wiki/UNIX_System_Laboratories,_Inc._v._Berkeley_Software_Design,_Inc.))

15. **"Unix was open because Bell Labs believed in sharing."**
 Unix circulated because the **1956 AT&T consent decree made it illegal for AT&T to sell it** — Bell Labs was barred from any business other than common carrier communications. Unix shipped for the cost of media and postage as a compliance artefact. The moment the decree was lifted (1982 settlement, divestiture effective 1984), AT&T commercialised System V immediately. ([History of Unix](https://en.wikipedia.org/wiki/History_of_Unix))

16. **"Apache is still the most popular web server."**
 **Third**, at 22.6% — behind Nginx (31.4%) and Cloudflare (29.6%), as of 23 August 2026. Note also that Netcraft's "million busiest sites" measure gave Apache 17.83% in March 2025 while W3Techs gave 26.4% across all sites in April 2025 — the two methodologies routinely disagree by 8+ points. ([W3Techs](https://w3techs.com/technologies/overview/web_server); [Apache HTTP Server](https://en.wikipedia.org/wiki/Apache_HTTP_Server))

17. **"There are millions of open source AI models available."**
 Technically true, practically misleading. Of ~2.96M models on Hugging Face (Aug 2026), **85.6% have fewer than 200 lifetime downloads, and 1.5% of repositories account for 99.2% of all downloads.** And almost none meet the OSI's Open Source AI Definition — "open weights" is the accurate term. ([HF Summer 2026](https://huggingface.co/blog/state-of-open-models-summer-2026))

---

## SOURCE LIST

### Fetched in full this session (primary or best-available)
**Primary / official**
- [HBS Working Paper 24-038, *The Value of Open Source Software* (PDF)](https://www.hbs.edu/ris/Publication%20Files/24-038_51f8444f-502c-4139-8bf2-56eb4b65c58a.pdf)
- [ASF FY2025 Annual Report (PDF)](https://apache.org/foundation/docs/FY2025AnnualReport.pdf) · [apache.org/foundation](https://www.apache.org/foundation/)
- [Alpha-Omega 2024 Annual Report (PDF)](https://alpha-omega.dev/wp-content/uploads/sites/22/2025/01/Alpha-Omega-Annual-Report-2024_012925.pdf)
- [CISA Cyber Safety Review Board, Log4j report, 11 July 2022 (PDF)](https://www.cisa.gov/sites/default/files/publications/CSRB-Report-on-Log4-July-11-2022_508.pdf)
- [Mozilla Foundation 2024 audited financials (PDF)](https://stateof.mozilla.org/pdf/Mozilla%20Fdn%202024%20-%20AuditedFinancials.pdf)
- [Tidelift State of the Open Source Maintainer 2024 (PDF)](https://assets-eu-01.kc-usercontent.com/ef593040-b591-0198-9506-ed88b30bc023/d325a56f-05be-4379-bfd1-ee4776fcad41/2024-tidelift-state-of-the-open-source-maintainer-report-.pdf)
- [OSI History](https://opensource.org/history) · [OSI: Open Source AI](https://opensource.org/ai) · [OSI: OSAID process](https://opensource.org/ai/process) · [OSI: The AI Era Arcs Toward Openness, 12 Aug 2026](https://opensource.org/blog/the-ai-era-arcs-toward-openness)
- [Christine Peterson, "How I coined the term 'open source'"](https://opensource.com/article/18/2/coining-term-open-source-software)
- [Mozilla Turns Twenty](https://blog.mozilla.org/en/mozilla/mozilla-turns-twenty/)
- [Let's Encrypt: 10 Years of Certificates, 9 Dec 2025](https://letsencrypt.org/2025/12/09/10-years) · [Let's Encrypt stats](https://letsencrypt.org/stats/)
- [sqlite.org: Most Widely Deployed](https://www.sqlite.org/mostdeployed.html) · [sqlite.org: Copyright](https://www.sqlite.org/copyright.html)
- [curl FAQ](https://curl.se/docs/faq.html) · [Daniel Stenberg, "Death by a thousand slops", 14 July 2025](https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-slops/)
- [antirez, "Redis is open source again"](https://antirez.com/news/151)
- [Elastic, "Elasticsearch is Open Source, Again"](https://www.elastic.co/blog/elasticsearch-is-open-source-again)
- [npm blog: Details about the event-stream incident](https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident)
- [GitHub Octoverse 2025](https://github.blog/news-insights/octoverse/octoverse-a-new-developer-joins-github-every-second-as-ai-leads-typescript-to-1/)
- [Stack Overflow Developer Survey 2025 — Technology](https://survey.stackoverflow.co/2025/technology)
- [CNCF 2025 Annual Cloud Native Survey](https://www.cncf.io/announcements/2026/01/20/kubernetes-established-as-the-de-facto-operating-system-for-ai-as-production-use-hits-82-in-2025-cncf-annual-cloud-native-survey/)
- [Black Duck OSSRA 2026 press release, 25 Feb 2026](https://news.blackduck.com/2026-02-25-Black-Duck-Research-Shows-Open-Source-Vulnerabilities-Have-Doubled-as-AI-Accelerates-Code-Creation)
- [OpenSSF/LF: Census III press release, 4 Dec 2024](https://openssf.org/press-release/2024/12/04/open-source-usage-trends-and-security-challenges-revealed-in-new-study/)
- [OpenSSF: EU Cyber Resilience Act](https://openssf.org/public-policy/eu-cyber-resilience-act/) · [ORC WG: The EU CRA](https://orcwg.org/cra/)
- [Linux Foundation: OpenSearch Software Foundation one year on, 25 Aug 2025](https://www.linuxfoundation.org/press/opensearch-software-foundation-marks-1-year-anniversary-with-community-growth-agentic-ai-and-hybrid-search-enhancements)
- [AWS Open Source Blog: $12.5M against AI threats, 17 Mar 2026](https://aws.amazon.com/blogs/opensource/aws-and-others-invest-12-5m-to-defend-the-open-source-ecosystem-from-ai-threats/)
- [Hugging Face: State of Open Models, Summer 2026](https://huggingface.co/blog/state-of-open-models-summer-2026)
- [FSFE: EU Tech Sovereignty — a milestone for Public Code?, 3 June 2026](https://fsfe.org/news/2026/news-20260603-01.en.html)
- [OWASP: About](https://owasp.org/about/)
- [PyPI Statistics](https://pypi.org/stats/)
- [OpenStreetMap wiki: Stats](https://wiki.openstreetmap.org/wiki/Stats)
- [TOP500, June 2026 list](https://top500.org/lists/top500/2026/06/)

**Measurement services**
- [StatCounter: mobile OS](https://gs.statcounter.com/os-market-share/mobile/worldwide) · [desktop OS](https://gs.statcounter.com/os-market-share/desktop/worldwide) · [browsers](https://gs.statcounter.com/browser-market-share)
- [W3Techs: web server survey](https://w3techs.com/technologies/overview/web_server)

**Analysis and journalism (fetched)**
- [LWN: Some 6.18 development statistics](https://lwn.net/Articles/1046966/) · [LWN: OSI readies controversial Open AI definition](https://lwn.net/Articles/995159/)
- [RedMonk: The State of Open Source Licensing in 2026](https://redmonk.com/sogrady/2026/03/25/open-source-licensing-2026/)
- [Chad Whitacre / Open Path: Questioning "The Value of Open Source Software"](https://openpath.quest/2024/questioning-the-value-of-open-source-software/)
- [TechPolicy.Press: How the EU's Tech Sovereignty Package Puts Open Source to the Test](https://www.techpolicy.press/how-the-eus-tech-sovereignty-package-finally-puts-open-source-to-the-test/)
- [BleepingComputer: curl ending bug bounty, 22 Jan 2026](https://www.bleepingcomputer.com/news/security/curl-ending-bug-bounty-program-after-flood-of-ai-slop-reports/)
- [TechSpot: FFmpeg thanks Google for the bug reporting, now asks where the funding is](https://www.techspot.com/news/110219-ffmpeg-volunteer-maintainers-struggling-keep-pace-ai-generated.html)
- [TechCrunch: IBM closes $6.4B HashiCorp acquisition](https://techcrunch.com/2025/02/27/ibm-closes-6-4b-hashicorp-acquisition/)

**Wikipedia (fetched — used for dated chronology; treat as secondary)**
[History of FOSS](https://en.wikipedia.org/wiki/History_of_free_and_open-source_software) · [History of Unix](https://en.wikipedia.org/wiki/History_of_Unix) · [USL v. BSDi](https://en.wikipedia.org/wiki/UNIX_System_Laboratories,_Inc._v._Berkeley_Software_Design,_Inc.) · [GNU GPL](https://en.wikipedia.org/wiki/GNU_General_Public_License) · [Git](https://en.wikipedia.org/wiki/Git) · [GitHub](https://en.wikipedia.org/wiki/GitHub) · [Halloween documents](https://en.wikipedia.org/wiki/Halloween_documents) · [Linus's law](https://en.wikipedia.org/wiki/Linus%27s_law) · [Apache HTTP Server](https://en.wikipedia.org/wiki/Apache_HTTP_Server) · [XZ Utils backdoor](https://en.wikipedia.org/wiki/XZ_Utils_backdoor) · [Core Infrastructure Initiative](https://en.wikipedia.org/wiki/Core_Infrastructure_Initiative) · [OpenSSF](https://en.wikipedia.org/wiki/Open_Source_Security_Foundation) · [Server Side Public License](https://en.wikipedia.org/wiki/Server_Side_Public_License) · [OpenTofu](https://en.wikipedia.org/wiki/OpenTofu) · [Sovereign Tech Agency](https://en.wikipedia.org/wiki/Sovereign_Tech_Agency) · [EU Sovereign Tech Fund](https://en.wikipedia.org/wiki/EU_Sovereign_Tech_Fund) · [OpenSolaris](https://en.wikipedia.org/wiki/OpenSolaris) · [Apache OpenOffice](https://en.wikipedia.org/wiki/Apache_OpenOffice) · [Blender](https://en.wikipedia.org/wiki/Blender_(software)) · [Wikipedia](https://en.wikipedia.org/wiki/Wikipedia) · [PyTorch](https://en.wikipedia.org/wiki/PyTorch) · [Language Server Protocol](https://en.wikipedia.org/wiki/Language_Server_Protocol) · [Netscape Communicator](https://en.wikipedia.org/wiki/Netscape_Communicator) · [Mozilla](https://en.wikipedia.org/wiki/Mozilla)

### Search-derived only (surfaced but NOT fetched — verify before citing)
[The Register: Redis returns to open source with AGPL, 1 May 2025](https://www.theregister.com/software/2025/05/01/redis_returns_to_open_source_with_agpl_license/757582) · [InfoQ: Redis AGPL](https://www.infoq.com/news/2025/05/redis-agpl-license) · [devclass: AWS hands OpenSearch to Linux Foundation](https://devclass.com/2024/09/16/aws-hands-opensearch-to-linux-foundation-is-this-why-elasticsearch-was-made-open-source-again/) · [TechCrunch: official definition for open source AI, 28 Oct 2024](https://techcrunch.com/2024/10/28/we-finally-have-an-official-definition-for-open-source-ai/) · [LWN: Contemplating the retirement of Apache OpenOffice](https://lwn.net/Articles/699047/) · [Black Duck OSSRA report page](https://www.blackduck.com/resources/analyst-reports/open-source-security-risk-analysis.html) and [full PDF](https://www.blackduck.com/content/dam/black-duck/en-us/reports/rep-ossra.pdf) · [SSRN: The Value of Open Source Software](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4693148) · [HBS AI Institute summary](https://aiinstitute.hbs.edu/revealing-value-the-economic-power-of-open-source-software/) · [FSF: freedom in machine learning applications](https://www.fsf.org/news/fsf-is-working-on-freedom-in-machine-learning-applications) (robots.txt blocked) · [FOSDEM 2025: FSF criteria for free ML applications](https://fosdem.org/2025/schedule/event/fosdem-2025-4818-fsf-s-criteria-for-free-machine-learning-applications/) · [FOSDEM 2026: EU Sovereign Tech Fund case](https://fosdem.org/2026/schedule/event/KES3TH-funding_europes_open_digital_infrastructure_a_detailed_case_for_an_eu_sovereign_/) · [EU-STF campaign site](https://eu-stf.openforumeurope.org/) · [European Commission: Cyber Resilience Act](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act) · [NetBSD archive: USL lawsuit settlement documents](http://cdn.netbsd.org/pub/NetBSD/misc/release/misc/USL-lawsuit) · [Netscape Public License 1.1](https://www.mozilla.org/MPL/NPL/1.1/) · [Raymond, The Cathedral and the Bazaar (PDF)](https://johnpconley.com/wp-content/uploads/2021/01/Raymond-The-Cathedral-and-the-Bazaar.pdf) · [JFrog: XZ backdoor analysis](https://jfrog.com/blog/xz-backdoor-attack-cve-2024-3094-all-you-need-to-know/) · [Snyk: event-stream post-mortem](https://snyk.io/blog/a-post-mortem-of-the-malicious-event-stream-backdoor/) · [Linux Foundation: OpenTofu GA](https://www.linuxfoundation.org/press/opentofu-announces-general-availability) · [MongoDB SSPL FAQ](https://www.mongodb.com/legal/licensing/server-side-public-license/faq) · [OpenSSF: EU CRA resources](https://openssf.org/public-policy/eu-cyber-resilience-act/)

---

## GAPS AND THINGS TO CHASE BEFORE PUBLICATION

1. **TOP500 operating-system statistics.** The pages I tried returned navigation only. Get the OS-family table for the June 2026 list before making any "all 500 run Linux" claim.
2. **The definitive xz account.** Wikipedia was the best consolidated source I could reach. For a security audience — which Dinis Cruz's is — you want Andres Freund's original oss-security post, Russ Cox's `research.swtch.com` timeline, and Filippo Valsorda's analysis. I did not fetch them.
3. **CRA article and recital numbers.** Neither the OpenSSF nor ORC WG pages gave them. The steward provisions and the non-commercial carve-out need citation to Regulation (EU) 2024/2847 directly, and the 10-vs-11 December 2024 entry-into-force discrepancy needs resolving against the Official Journal.
4. **OpenTofu vs Terraform adoption.** Every 2026 figure I found came from IaC vendor blogs with an interest in the answer. I would publish no number here.
5. **Current Wikimedia traffic.** `stats.wikimedia.org` is cache-only and unfetchable from this sandbox; the only figure available is from 2014.
6. **Founding dates I could not verify:** DECUS (1961), SourceForge (1999), Google Code (2006–2016), GitHub Sponsors (2019), Open Collective, Tidelift, OpenStreetMap (2004), SQLite (2000), Python (1991), PostgreSQL/POSTGRES (1986/1996), Kubernetes and CNCF (2014/2015), Firefox 1.0 (9 Nov 2004), the GNU announcement (27 Sept 1983), the GNU Manifesto (March 1985), the FSF (October 1985), Linux's August 1991 announcement, and the Lions' Commentary (1977). All are widely cited and probably correct; none were confirmed from a primary source this session.
7. **VS Code's exact proprietary terms** (binary licence, marketplace ToS, extension restrictions) — I described these from general knowledge, not from a fetched source. Verify before publishing the open-core characterisation.
8. **OSAID revision timeline.** The OSI page shows "v1.0, published 28 May 2025, modified through 22 July 2026" but the process page gives no revision schedule and no v1.1 exists. Worth asking OSI directly rather than inferring.
---

This research document was compiled on 24 August 2026 using WebSearch and WebFetch only. Fetch failures are reported inline rather than worked around. It is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0); the sources it cites retain their own licences.