Most sites arguing for open source argue that it is generous. This one does not. The power of open source is not for the community, it is not because it is nice for others, and it is not to give back — it is that technology stops being the moat, that you become free to delete your own code, and that sovereignty becomes possible at all. And the accurate history supports that far better than the romantic one does.
Every solo founder who ships something that works arrives at the same fear: a bigger, better-resourced company takes the code and there is nothing left. Notes from a strategy session with an early-stage SaaS founder — the walk-through that answers it, and what it changes about how you build.
An established company holding a full copy of your code still has to decide, fund, staff, deploy and own it forever. Optimistic: three months to reach where you already are. Realistic: closer to a year. Which turns the fear into the pitch: "You can take it. It will cost you that. Or you can pay me, and have it next week."
Read → Four things that surfaceThe shop-front reflex, the keys in the repo, prototype code asked to behave like a product, and the collaboration that is not a commitment — each an instinct that made sense once, with the counter-argument that reverses it now.
Read → The practical routeFour you do while the repo is still private, one point of no return, and three habits that run alongside from this week. Plus the three things to settle before you publish: the licence is a commercial decision, trade marks come first, and where the cost argument stops holding.
Read → The disciplineReleases tagged, untrue claims removed, support channels live. The handover from prototype to product is invisible from the outside unless you count it — and publishing the count means you cannot quietly skip a week.
Read →Two sentences carry the whole site. The first is the unfashionable one; the second is the one that makes it land.
"the power of open source is not for the community, it is not because it is nice for others, and it is not to give back."
"open source is not free, somebody is always paying for it. What you get from open source is freedom, that is different… We play the game of empowering the user and being the reputable source of trust. We are selling trust."
Everything else here is a consequence of those two. If open source is a gift, then its funding problem is a moral failure and the answer is to shame people into paying. If it is a strategy, the funding problem is an externality — and externalities are fixed by structure and by market forces, not by virtue. cURL is the case that settles it →
Three things a site about open source should be able to show: what it thinks, what it actually ships and under which licence, and whether the history it leans on is true. This one does all three, and says where each comes from.
| What | Where it comes from | What this site does |
|---|---|---|
| The position | The author's own writing — 56 catalogued concepts, 24 of them original arguments rather than restatements | Argues them, and names the counter-case each time |
| The practice | The licence files — three licences across three layers of a real, shipping estate | Publishes the licences, and the reasoning behind each |
| The history | Researched from primary sources for this site — 1955 to 2026, every number carrying its source, date and caveat | Leads with six corrections to the standard story |
The division of labour is deliberate: the argument comes from experience, the ground under it comes from research — and the research turned out to support the argument better than the version everybody repeats. The numbers, and the ones this site declines to publish →
These lead, rather than a timeline, because everyone has a timeline and almost nobody publishes these. Each one is checkable, and each one points the same way: the model wins on economics and structure, not on virtue and not on eyeballs.
The 1956 AT&T consent decree barred Bell Labs from any business but common-carrier communications. Unix shipped for media and postage as a compliance artefact. The decree lifted in 1982 and AT&T commercialised System V immediately.
Read → 1992–1994USL v. BSDi clouded free Unix during exactly the window Linux needed. The settlement removed three files out of eighteen thousand. The claim was nearly empty; the two years of uncertainty were decisive.
Read → 1998–2004The code was so degraded the team threw it away and rewrote. Firefox 1.0 did not ship until November 2004, by which time IE had won. The founding case study of the movement is a cautionary tale.
Read → Feb 1998Christine Peterson did — and deliberately had someone with more credibility as a Linux programmer introduce it, so that it would spread. Sources disagree on the exact day; they do not disagree on who.
Read → 2014, 2024Heartbleed survived two years in the most security-critical library on the internet. xz was engineered by the maintainer to survive review — and was caught by one engineer benchmarking SSH latency, not by a security review.
Read → 2018–2025Elastic added AGPLv3 in August 2024; Redis 8 shipped AGPLv3 in May 2025. That does not weaken the survivability argument — it sharpens it. The same single-holder standing that let them leave let them come back.
Read →Buyers read licence files. Licence files are the weakest of the structural protections, and 2018–2024 is the proof.
"Survivable is not a property of the licence file. It is a property of the copyright and trademark structure."
The mechanism, which is what makes it a finding rather than an opinion: "Every catalogued relicensing between 2018 and 2024 followed the same legal pattern: a single corporate copyright holder, having aggregated contributor copyright via a CLA, exercised the right to change terms going forward. Distributed-copyright projects could not be moved the same way, because no single party had standing." And the kicker — HashiCorp went BUSL, IBM acquired it, and the licence stayed. Acquisition entrenches the closure; it does not reverse it.
PostgreSQL is the control case — no company owns it, so no company can relicense it, and it is now the most-used database. OpenSolaris is the counter-case. The licence was not the problem; the copyright holder was.
Read → The toolFour legs — copyright, trademark, schema licence, named fork capacity — every one answerable from public artefacts, with no cooperation from the vendor. Run it here, on any project, and keep the result.
Run it → The self-auditA test its author will not apply to themselves is marketing. The four legs run against the sgit estate, the verdict published, and what each leg would take to change — including the one that is not in any project's own gift.
Read →A page that only states one side reads as advocacy. Every argument here carries the strongest objection to it — and where the author's own position moved between one dated document and the next, both dates are published rather than tidied into one.
You are one SLA away from losing access; the schemas matter as much as the code; and whichever government has jurisdiction over the company that controls the code controls everyone downstream. Necessary, but not sufficient — and the site stays careful about that.
Read → Position moved18 June: "There should be nothing proprietary." 17 July: "customers only have a subset of the code that exists in the main repo." Five weeks apart, and the July document names the tension itself. Here is the one-question test that settles which one it is.
Read → The marketMaintaining the non-functional requirements as a market, and the ability to read and repair code somebody else wrote as an appreciating asset — published with both of its own counter-arguments, including the sharp one: a firm paid to maintain has no incentive to say the thing should be retired.
Read → Two datesMarch: the density of learning per hour increases. July: the gains shifted work from juniors to seniors, at exactly the moment the maintenance need is growing. Both on the record, and what would settle it.
Read → A positionLabelling, a maintainer platform, sovereignty bounties. Three proposals for three different failures — information, transaction, substitution — compared for the first time, with a position on which is the precondition and which is the mechanism.
Read → All of itTechnology is not the moat. Lock-in relocates to quality and certification. Lock-in degrades your own architecture. Open source frees you to cannibalise your own code. And the moat is a rate, not a wall: a competitor who forks today gets your position, not your velocity.
Read →This is the page that makes the rest credible: the licences actually in force across a shipping estate, and the reasoning behind each of them.
Code is Apache-2.0, where the patent grant matters. Around 1,100 working documents and the published essays at docs.diniscruz.ai carry CC BY 4.0, where attribution carries provenance — settled on 6 September 2026, after the published-articles repository was found to say CC0. Two licences, three layers, and what each is for.
The entire estate rests on that choice. The patent grant, the defensive termination clause, the NOTICE file — and the cost, which is that Apache-2.0 is the heavier licence to comply with.
Read → A mechanismEvery page available as markdown at the same path with the extension swapped, and the links inside the markdown pointing at markdown — which is how this site is built. Plus the radical version: publish the evidence, the provenance, and every prompt.
Read →An agent-access report run against this estate found the failure precisely: "many agents can only fetch URLs that a search engine has already returned to them… A link listed inside a fetched document did not count as having been seen. It can read the map and cannot walk it." A site about open source that agents cannot traverse would fail in exactly the way its own author had already diagnosed — so the mitigation is built in.
| The rung | What this site ships | What it fixes |
|---|---|---|
| The markdown twin | Every page, same path, extension swapped — and links inside the markdown point at markdown | An agent never parses HTML, and never leaves the markdown surface once it arrives |
llms.txt | Self-sufficient — it states the thesis rather than linking to it | A bare link list is the failure mode when links inside a document do not count as seen |
llms-full.txt | Every page in one file | Removes link-following from the problem entirely |
| Getting indexed | In progress — the site is new | The rung that takes time rather than engineering. On the build order → |
Read this page as markdown, take the whole site as llms-full.txt, or start from llms.txt. The generator is published with the rest of the build tooling, because a site making this argument should show the mechanism.
The build order is published with its open questions visible, because a position that hides what it has not yet settled is advertising. Three items lead.
The site argues that companies should declare their supply chain. The estate's own declaration is the first item on the build order — roughly a day's work, and it converts the labelling argument from a proposal into a demonstration.
Read → Four thesesLicence compliance at machine speed, provenance of AI-generated code, training-data licensing, and what CC BY means for machine reuse. Each follows from material already published; each is named, and next to be written.
Read → Open questionsIs the customer subset open core or packaging? Do agents help or harm sustainability? Is "open source AI" coherent without training data? Several are decisions for the project rather than research for the site — listed so the decisions can be seen being made.
Read → The build orderEvery section's state, seven items in sequence, and where this site stops and a sibling site in the network begins.
Read →Dinis Cruz — founder of The Cyber Boardroom, MyFeeds.ai, RiskMandate.ai, VoiceDebrief.ai and the sgit.ai network (commercialised through sgraph.ai); former OWASP Board member and organiser of the OWASP Summits; creator of the O2 Platform and of the OSBot, MGraph-DB, Issues-FS and sgit families of open-source tools. This site is the strategy those companies run on, written from the experience of running it: everything they ship is open source, and so are their investor materials. The estate is run through its own stress test, result published.