open-source.sgit.ai / history / the numbers

The numbers, and the ones we refuse to publish

This site's credibility position is that it corrects other people's unsourced figures. That only works if it does not accumulate its own — so this page states what the load-bearing numbers actually measure, and lists the ones the research could not source and which therefore do not appear anywhere else on this site.

The standing warning, in the author's own words: "the figures circulating are largely recycled from a smaller set of studies through commercial blogs, so the direction is well supported and the precision is not." That is the right way to hold nearly every number in this field, including the ones below that survive scrutiny.

"Open source is worth $8.8 trillion" — no

This is the most-repeated figure in the field and it is almost always cited without the thing that makes it meaningful. It comes from a Harvard Business School working paper (24-038), and it is a demand-side replacement cost: what it would cost if every firm using open source independently recreated the software it uses, priced at global average developer wages.

The source, linked — because this page asks other people to cite theirs. ↗ Revealing Value: The Economic Power of Open Source Software, the HBS AI Institute's own summary of working paper 24-038 by Manuel Hoffmann (Harvard LISH), Frank Nagle (HBS Strategy Unit) and Yanuo Zhou (Rotman Toronto). It is worth reading rather than citing second-hand for one reason: it carries both figures, in the same table, which is exactly the context that falls off in transmission. It ends where this site does — on the tragedy of the commons, the risk that something free and ubiquitous is overused and underfunded, with the remedy framed as treating open source as critical infrastructure rather than as goodwill.

And two findings in it travel better than the trillion does. Six languages — JavaScript, Java, Go, TypeScript, C, Python — account for 84% of the demand-side value, and roughly 5% of developers create the bulk of it. Those are concentration figures rather than valuation ones, they are measured rather than counterfactual, and concentration is a survivability question. The headline is the least useful number in the paper.

Measure	Figure	What it means
Demand-side replacement	$8.8 trillion	Every firm rebuilds everything it uses, separately. Counts the same library once per user.
Supply-side replacement	$4.15 billion	Recreate everything once. Three orders of magnitude smaller, and the same paper's own figure.
Goods-market model	~$177 million	A substantive published critique argues the paper's own alternative model — the realistic counterfactual, in which firms would have bought or substituted rather than rebuilt — yields this. Four orders of magnitude below the headline.

The rule this site applies: publish $8.8tn only with its definition and the critique attached, or do not publish it. It is not a fabrication — it is a real calculation of a specific counterfactual, and the counterfactual is unrealistic in a way that matters. Quoted bare, it functions as a claim about market value, which is not what it measures.

The author's own earlier writing cited it bare, and this page is the correction. Stated rather than quietly fixed, because a site that holds others to a citation standard should be seen applying it to itself first.

"70–90% of a modern codebase is open source" — a different measurement

The underlying finding, from Black Duck's OSSRA report, is that 98% of 947 audited codebases contain open source. That is a presence figure, not a share-of-lines figure. "Does this codebase contain any open source at all?" and "what proportion of these lines are open source?" are different questions with very different answers.

And the population matters: OSSRA's audit sample is skewed toward M&A due diligence — codebases being examined because someone is buying the company. That is not a random sample of software, and there is no particular reason to think its composition matches the industry's.

The direction is not in dispute. Modern applications rest heavily on open source; that is obvious to anyone who has read a lockfile. The precision is what is unsupported, and quoting "70–90% of the code" as though it were measured lends a rhetorical exactness the evidence does not carry.

The numbers that hold up

These appear elsewhere on the site, with their source, date and caveat:

Number	Source and date	Caveat
2,134 developers on Linux kernel 6.18, the most in its history; 333 first-timers, 13,710 commits	Kernel release, 30 Nov 2025	Counts contributors to one release, not the maintainer population.
55.6% of developers use PostgreSQL — the most-used database	Stack Overflow Developer Survey 2025, n=49,063	Self-selected respondents. Reliable for direction, not a census.
HTTPS page loads: <30% (2015) → ~80% globally, ~95% US; ~10M certificates/day by Sept 2025	Let's Encrypt / browser telemetry, 2015–2025	Telemetry measures the browsers reporting it.
~30 billion cURL installations; seven volunteers on the security team	Project statements, 2025–26	Installations are an estimate by the project; the security-team figure is a headcount.
81 genuine reports, >$90,000 paid since 2019; ~20% of 2025 submissions AI slop vs ~5% genuine; bounty closed 31 Jan 2026	curl's own published figures, Jan 2026	First-party, from the programme that ran it. The full story →
€100,000 in seven weeks to free Blender, Jul–Sep 2002	Contemporary records	—
Three files out of eighteen thousand removed in the USL v. BSDi settlement	Settlement, Feb 1994	—
Licence conflicts in 68% of audited codebases, up 12 points — the highest in the report's history	OSSRA 2026	Same skewed audit population as above. Use for direction. Relevant to the compliance argument →
Mean vulnerabilities per codebase up 107% year on year, attributed to AI-accelerated code creation	OSSRA 2026	Correlation, not demonstrated causation — and the report's attribution is its own interpretation. Cited that way on the agents page →

The claims this site will not publish

These were investigated and could not be established from a primary source. They do not appear anywhere else on this site, and this list is the reason.

The claim	Why it is not published
"Linux runs 90% of the cloud"	No primary source found. Every result traced back to SEO content citing other SEO content. The number may well be roughly right; there is nothing behind it to cite.
"All 500 of the TOP500 supercomputers run Linux"	TOP500's OS-family table could not be fetched, so this is unverified — though the top five on the June 2026 list are all Linux-derived, which is stated as what it is.
Wikipedia's traffic figures ("18 billion views, 500M uniques")	Traces to a February 2014 New York Times report. `stats.wikimedia.org` is cache-only and could not be fetched. A twelve-year-old number presented as current.
GitHub's scale figures	They do not reconcile with each other. Octoverse 2025 reports 630M repositories and 180M+ developers; GitHub separately announced its billionth repository in June 2025; Wikipedia carries "150 million users, May 2025". Cite Octoverse and say which measure you mean — or say nothing.
CNCF's 2025 headline that Kubernetes is "the de facto operating system for AI"	The survey published no sample size and no field dates. And its own data shows 44% of organisations run no AI/ML workloads on Kubernetes at all — which is difficult to reconcile with the headline.

Why publish a list of things you are not saying? Because the absence is otherwise invisible, and because these are figures a reader will encounter everywhere else. Naming them is more useful than silently omitting them — and it is the same reasoning that puts the site's own open questions on a page rather than in a footnote.

← Six success stories The practice →