I've completed the research. Here is the full deliverable.

The History of Open Source and Its Major Success Stories

Research pack for open-source.sgit.ai — compiled 24 August 2026

Method note: everything below was gathered with WebSearch and WebFetch only, as instructed. No other fetching method was used. Where a fetch failed or a host blocked me, I say so. Where sources disagree, I give both. Anything I could not verify is marked [UNVERIFIED].

Fetch failures encountered (reported, not worked around):

• redis.io/blog/agplv3-open-source-license/ → 404. Used antirez.com (primary, same author) instead.
• stats.wikimedia.org → "domain is cache-only and cannot be fetched."
• openstreetmap.org/stats/data_stats.html → blocked by robots.txt. Used the OSM wiki instead.
• fsf.org/news/...machine-learning... → robots.txt fetch timed out. Used LWN's account of the FSF position instead.
• curl.se/docs/frequently-asked-questions.html → 404; curl.se/docs/faq.html worked.
• top500.org/statistics/details/osfam/1/ and /statistics/list/ → navigation shells only, no data table returned. I could not verify the "all 500 run Linux" figure directly. See Myth #1.
• en.wikipedia.org/wiki/Wikipedia:Statistics returned a badly stale cache (5.5M articles, c. 2017). Used the Wikipedia article instead, which returned current figures.

PART 1 — THE TIMELINE

1.1 Before free software: the sharing default (1955–1983)

1.2 Free software: the ideology arrives (1983–1991)

Why the GPL choice mattered. Torvalds' original licence forbade commercial distribution. Switching to GPLv2 in Feb 1992 did three things simultaneously: (1) it made Linux legally safe for companies to sell and ship, which no "non-commercial" licence does; (2) it guaranteed that a well-resourced vendor could not take the kernel private and out-develop the community — every improvement had to come back, so IBM, Intel, Red Hat, Google and AMD were structurally forced into cooperation rather than differentiation; and (3) it made Linux legally compatible with the GNU userland that already existed. The counterfactual is visible in the same period: BSD, technically ahead, permissively licensed, and simultaneously mired in litigation (below) — vendors forked it privately (SunOS, BSD/OS) and the shared codebase fragmented.

1.3 The Unix wars and the BSD near-death (1992–1994)

1.4 The 1998 inflection

1.5 The Cathedral and the Bazaar — the argument and its critics

Raymond's argument (1997/1999): two development styles exist. The cathedral — Emacs, GCC, commercial software — releases carefully, with source visible only between releases, developed by a closed group. The bazaar — Linux — releases early and often, delegates everything delegable, and treats users as co-developers. The mechanism Raymond claims makes the bazaar work is "Linus's law": "given enough eyeballs, all bugs are shallow." Raymond's deeper claim is a debugging claim, not a design claim: parallel debugging scales, parallel design does not.

Its actual effect was less as a theory than as a permission slip. Netscape executives read it before deciding to open Mozilla; it gave managers a business-legible vocabulary for something that had previously read as hobbyism.

The critiques, fairly stated:

• Robert Glass (2003, Facts and Fallacies about Software Engineering) called Linus's law a fallacy on evidentiary grounds: inspection research indicates a small maximum of useful reviewers, roughly two to four, with sharp diminishing returns beyond that. Eyeballs don't scale linearly. (Linus's law ↗)
• Heartbleed (2014) is the standing empirical counterexample — a catastrophic bug in the most-reviewed-in-principle crypto library, live for two years. Larry Seltzer argued availability of source may reduce testing rigour relative to closed-source, because everyone assumes someone else looked. Jim Zemlin (Linux Foundation, 2015): "In these cases, the eyeballs weren't really looking." (Linus's law ↗)
• xz (2024) is the sharper counterexample: not just unnoticed, but deliberately engineered to survive review by a hostile maintainer-of-record.
• Partial empirical support does exist: Amit and Feitelson (2020) found higher bug-fix rates in more popular GitHub projects. The law survives as a weak correlation, not a mechanism. (Linus's law ↗)
• Separately, Nikolai Bezroukov's long-running critique argues Raymond's Linux/cathedral dichotomy misdescribes both, and that Linux is in fact strongly hierarchical. [UNVERIFIED this session — I did not fetch Bezroukov directly.]

The honest summary for publication: Raymond correctly identified that low-friction, high-frequency, publicly-visible iteration is a real productivity mechanism. He incorrectly generalised it into a security guarantee. The last twelve years have been a sustained institutional response to that specific overclaim.

1.6 Free software vs open source — what the disagreement actually is

This is not a licensing disagreement. In practice the FSF's Free Software Definition and the OSI's Open Source Definition approve almost the same set of licences. The disagreement is about what the movement is for, and both positions are internally coherent.

The free software case (FSF, Stallman). Software freedom is a user's civil right, comparable to freedom of the press. Proprietary software is an injustice regardless of whether it is well-engineered, because it puts the user under the developer's power. On this view, "open source" is a deliberate depoliticisation that discards the reason to care: if you sell openness on the grounds that it produces better code, then the moment proprietary code is better, you have conceded the argument. The FSF's position is that the practical benefits are a consequence of the ethics, and that promoting the consequence while suppressing the cause is how you end up with an industry that ships Linux inside locked-down devices.

The open source case (OSI, Raymond, O'Reilly, Perens). The ethical framing was empirically failing. "Free" was misread as "zero-cost" in every commercial conversation; the FSF's rhetoric read to corporate counsel as anti-business; adoption was the bottleneck. The pragmatic reframing worked — measurably and quickly: Netscape, IBM, Sun and eventually Microsoft came in. On this view, freedom that nobody deploys protects nobody, and the OSD's checklist form is a feature, because a checklist can be written into a procurement policy and a manifesto cannot.

Why both persist. They serve different institutions. "Open source" is the term that functions in procurement, regulation and enterprise governance — the CRA, the EU strategy, and every corporate OSPO speak it. "Free software" remains the term that functions when the question is user power rather than supply-chain economics: the AGPL, the anti-tivoisation clauses in GPLv3, the "Public Money? Public Code!" campaign, and the current fight over open-weight AI models are all arguments that only make sense in the free-software register. "FOSS"/"FLOSS" exist because most working practitioners need to refer to the set without picking a side. Notably, the two camps have re-converged in 2024–26: both the FSF and OSI ended up on the restrictive side of the AI definition argument, just with different vocabularies (§1.11).

1.7 Institutions, tooling and the permissive turn (1999–2010)

The permissive turn, with numbers. The GPL family's share of licensed open source fell from roughly 71% (2008) → 54% (2013) → 39% (2015) → 24% (2018); by 2015 GPLv2 had been overtaken by MIT (GNU GPL ↗). RedMonk's March 2026 analysis puts permissive licensing at 82% in 2022, ticking down to 73% in 2025 — while cautioning about sampling (RedMonk, 25 Mar 2026 ↗).

Why it happened. Four causes, roughly in order of weight. (1) Corporate legal risk aversion: copyleft creates a compliance obligation that has to be assessed per-product; permissive creates almost none, so the path of least resistance inside a large company is always MIT or Apache. (2) Library-scale software: the GPL was designed for programs; the npm/PyPI/crates era is built from thousands of tiny components, and the derivative-work boundary for a 40-line dependency is legally miserable. (3) The SaaS loophole: copyleft is triggered by distribution, and cloud services don't distribute — so from about 2010 the GPL stopped protecting against the exact competitor that vendors feared. This is the direct cause of §1.9. (4) Deliberate seeding: companies that want their format or platform to become the default (Google with Kubernetes and Go, Meta with React and PyTorch) want frictionless adoption including by competitors, so they choose Apache-2.0.

1.8 The security reckonings

1.9 The relicensing wave — and what has happened since

The pattern, stated precisely. Of the four canonical relicensings: Elastic reversed (2024), Redis reversed (2025), MongoDB has not, HashiCorp has not (and is now inside IBM). In three of four cases a credible fork existed within weeks, and in two of those the fork acquired a neutral foundation home. The lesson the market appears to have drawn is that the fork is now the enforcement mechanism — the licence change buys you a competitor with your own codebase, foundation governance, and hyperscaler funding. Both reversals landed on the AGPL, which is the interesting outcome: the industry's answer to the SaaS loophole turned out to be an FSF licence written in 2007, not a new vendor-drafted one.

1.10 Funding and sustainability

1.11 The AI era and the "open source AI" definition fight

State of the argument in 2026 — my read of the evidence. The definition fight has not been resolved; it has been routed around. Three things happened. First, the industry standardised on the term "open weights" for the actual practice, which quietly concedes the critics' point without adopting their standard. Second, the licensing centre of gravity moved to Chinese labs, which are markedly more permissive: among 178 Chinese model releases above 20B parameters, 59% are Apache-2.0 and 22% MIT, versus US releases at 29% Apache/MIT, 41% custom terms, 30% no declared licence (Hugging Face, State of Open Models: Summer 2026 ↗). Third, OSI itself has shifted its public argument from definition-policing toward openness-advocacy, citing usage and cost data rather than compliance counts. The unresolved substance remains exactly where it was in October 2024: if you cannot obtain the training data, you cannot exercise the freedom to study or to rebuild, and no amount of "data information" changes that. Anyone publishing on this should say so plainly and then note that the OSI's counter-argument — that demanding data would define open source AI out of existence, given that essentially no frontier model could comply — is also true.

PART 2 — THE SUCCESS STORIES

1. Linux

• What: A Unix-like operating system kernel; with GNU userland, the substrate of servers, cloud, Android, embedded systems and supercomputing.
• Started: 1991. By: Linus Torvalds, then a student in Helsinki. Freely modifiable source in 1991; relicensed under GPLv2 at version 0.12, February 1992.
• Licence: GPL-2.0-only (deliberately not "or later").
• Scale:
  • Kernel 6.18 (released 30 Nov 2025): 2,134 developers — the highest in the kernel's history — 333 of them first-time contributors, 13,710 commits. Top corporate contributors by changeset: Intel 10.4%, Google 7.9%, Red Hat 6.3%, AMD 5.0%, Linaro 3.9%. 53.6% of commits carried Reviewed-by tags (LWN, 6.18 statistics ↗).
  • Android: 68.36% of worldwide mobile OS share, July 2026 (StatCounter ↗) — Android's kernel is Linux.
  • Supercomputing: on the June 2026 TOP500, the top five systems run LineShine/Kylin OS (China, 2,198 PFlop/s, first Chinese #1 since 2017, 13M+ cores), El Capitan/TOSS, Frontier/HPE Cray OS, Aurora, JUPITER Booster/RHEL — all Linux-derived. I could not fetch TOP500's OS-family statistics table to confirm the full-500 figure; see Myth #1 (TOP500 June 2026 ↗).
  • Desktop: 7.53%, July 2026 (StatCounter) — a noisy figure, see Myth #10.
• Mechanism: The GPL turned would-be competitors into co-maintainers. No vendor could privately fork and out-develop the commons, so IBM, Intel, Google, Red Hat and AMD all found it cheaper to upstream. Add Torvalds' maintainer hierarchy (which is a cathedral of trusted lieutenants, not a bazaar) and a merge window discipline that has shipped a release roughly every nine to ten weeks for two decades.
• Non-obvious fact: Linux's success is partly a litigation artefact. During 1992–94, while USL v. BSDi hung over BSD — the technically more mature free Unix — Linux was the only free Unix nobody was suing. When the case settled in Feb 1994, of 18,000 BSD files only three had to be removed. The claim was near-empty; the two years of uncertainty were not.

2. Git

• What: Distributed version control.
• Started: 3 April 2005. By: Linus Torvalds, after BitKeeper's free licence was withdrawn following the claim that Andrew Tridgell reverse-engineered its protocols. Maintainership passed to Junio Hamano on 26 July 2005 — 16 weeks after the first commit.
• Licence: GPL-2.0-only; trademark held by the Software Freedom Conservancy.
• Scale: 93.9% primary version control share, Stack Overflow 2022 (up from 69.3% in 2015) (Git ↗). Stack Overflow 2025 did not publish a comparable VCS figure; it reports GitHub at 81.1% of collaboration tools among 49,063 respondents (SO 2025 ↗). GitHub alone: 180M+ developers, 630M repositories, 395M public repositories, 1.128 billion contributions in 2025 (Octoverse 2025 ↗).
• Mechanism: Git made forking cheap and merging cheaper. Under CVS/SVN a fork was a political act; under Git it is the default unit of work. Everything social about modern open source — the pull request, the drive-by first contribution, "fork it" as a credible governance threat against a bad steward — is a second-order effect of a data-structure choice.
• Non-obvious fact: Git was self-hosting four days after development began (7 April 2005) and was managing the Linux 2.6.12 release within ten weeks. It was also written by someone who has repeatedly said he hates version control and built Git specifically so he could stop thinking about it.

3. Apache HTTP Server and the Apache Software Foundation

• What: The web server that ran the early web; and the foundation model that most of open source now uses.
• Started: httpd in early 1995, from patches to the stalled NCSA httpd. ASF incorporated 1999. By: the Apache Group — Brian Behlendorf, Roy Fielding and others.
• Licence: Apache License 2.0 (first shipped in httpd 1.3.31 / 2.0.49, January 2004).
• Scale:
  • httpd: first server to pass 100 million websites (2009). Now 22.6% of all websites — third behind Nginx 31.4% and Cloudflare 29.6%, ahead of LiteSpeed 14.9% and IIS 3.1% (W3Techs, 23 Aug 2026 ↗).
  • ASF FY2025: 295 top-level projects, 32 podlings, 9,905 committers, 208 PMCs, 1,147 members (824 active, 323 emeritus), 1,310 releases. Security: 29,000+ reports received → 1,584 real threads → 650 triaged across 136 projects → 239 CVEs published. Financials: revenue $2,080,861, expenses $2,279,270, net −$114,471; infrastructure alone cost $1,464,767 (ASF FY2025 Annual Report, PDF ↗).
• Mechanism: Two separate inventions. The licence: ALv2's explicit patent grant with defensive termination made permissive licensing safe for large companies — which is why Kubernetes, Kafka, Hadoop, Swift and most of CNCF use it. The institution: "community over code", merit-based committership, PMC governance, and a legal shield between volunteers and liability. Every major foundation since has copied the shape.
• Non-obvious fact: The ASF steward for 295 projects on a $2.1M annual budget and ran a deficit in FY2025. Nearly 70% of that budget is infrastructure. The organisation that hosts a meaningful fraction of the world's enterprise data plumbing operates on less than the salary bill of a mid-sized engineering team.

4. Kubernetes and the CNCF

• What: Container orchestration; and the foundation that turned it into an industry.
• Started: 2014, open-sourced by Google (descended from Borg); CNCF founded 2015 with Kubernetes as its seed project. [Founding years widely cited; not fetched this session — flag if publishing them as primary.]
• Licence: Apache-2.0.
• Scale (CNCF Annual Survey 2025, published *20 Jan 2026):* 82% of container users run Kubernetes in production, up from 66% in 2023. 98% of surveyed organisations have adopted cloud-native techniques; 59% say most or nearly all development is cloud-native. 66% of organisations hosting generative AI models use Kubernetes for some or all inference. CNCF has nearly 800 member organisations, including 200+ startups; OpenTelemetry alone has 24,000+ contributors. CNCF did not publish the survey sample size or field dates in the announcement — treat the percentages accordingly (CNCF, 20 Jan 2026 ↗).
• Mechanism: Google gave away the crown jewels deliberately, and immediately gave away control too. By donating to a neutral foundation rather than keeping a BDFL seat, Google made it rational for AWS, Microsoft and every enterprise vendor to standardise on a Google-designed abstraction. Commoditising the layer below your business is the clearest strategic use of open source in the industry's history — and it worked: Kubernetes became the portability layer that made multi-cloud plausible, which sells Google Cloud.
• Non-obvious fact: The CNCF survey's own framing for 2025 was that Kubernetes has become "the de facto operating system for AI" — but 44% of organisations still run no AI/ML workloads on Kubernetes at all. The headline and the base rate point in different directions.

5. Python

• What: General-purpose language; now the default language of data science, ML and scripting.
• Started: 1991, by Guido van Rossum. [Not verified this session.]
• Licence: Python Software Foundation License (permissive, GPL-compatible). [Not verified this session.]
• Scale: 57.9% of developers use Python (Stack Overflow 2025, n=49,063) — a 7-percentage-point jump from 2024, which SO attributes directly to AI and data science (SO 2025 ↗). On GitHub, Python added contributors faster than anything except TypeScript: 2.75 million contributors, +48% YoY as of August 2025 (Octoverse 2025 ↗). PyPI holds 44.9 TB of package files, dominated by ML: tf-nightly alone is 681.4 GB, PyTorch 271.4 GB (PyPI stats ↗, cached 24h).
• Mechanism: Python won by being the second-best language for almost every task and the easiest for scientists who are not software engineers. The compounding step was C interoperability: NumPy, SciPy, pandas, TensorFlow and PyTorch are C/C++/CUDA underneath with Python on top, which meant Python inherited high-performance numerics without having to be fast itself.
• Non-obvious fact: The Python Software Foundation's security staffing has been funded in part by Alpha-Omega grants from AWS, Google and Microsoft (Alpha-Omega 2024 ↗), and PyPI's infrastructure received €1,056,672 from the German government via the Sovereign Tech Fund (Sovereign Tech Agency ↗). The most-used language ecosystem in AI is partly secured by a German federal innovation agency.

6. PostgreSQL

• What: Relational database.
• Started: POSTGRES at UC Berkeley under Michael Stonebraker, 1986; renamed PostgreSQL 1996. [Not verified this session.]
• Licence: PostgreSQL License (a permissive, BSD/MIT-style licence).
• Scale: 55.6% of developers use PostgreSQL — the most-used database in Stack Overflow 2025, ahead of MySQL 40.5%, SQLite 37.5%, SQL Server 30.1%, Redis 28% (SO 2025 ↗).
• Mechanism: No company owns it, so no company can relicense it. PostgreSQL is the control case for the entire §1.9 relicensing wave: it is the one major database whose users never had to worry about a licence change, because there is no vendor with the standing to make one. Its extension architecture (PostGIS, TimescaleDB, pgvector) let it absorb every specialist database wave — geospatial, time-series, and now vector search for AI — without forking.
• Non-obvious fact: PostgreSQL's rise is measurably the direct beneficiary of the relicensing wave. Its permissive licence and vendor-neutral governance are precisely what MongoDB, Elastic and Redis users discovered they wanted after 2018.

7. Wikipedia and MediaWiki

• What: The encyclopaedia, and the wiki engine underneath it.
• Started: 15 January 2001. By: Jimmy Wales and Larry Sanger.
• Licence: Content under CC BY-SA 4.0; MediaWiki under GPL-2.0-or-later. [MediaWiki licence not verified this session.]
• Scale: 7,171,504 articles on English Wikipedia; 67,159,986 articles across all editions; 345 language editions; 275,757 active editors on English Wikipedia (one or more edits in 30 days) (Wikipedia ↗). Traffic: the article's cited figure — 18 billion page views and ~500 million unique visitors a month — is from a February 2014 New York Times report citing comScore. Do not publish that as a current number. I could not obtain current traffic figures: stats.wikimedia.org is cache-only and could not be fetched.
• Mechanism: Radical revert-cost asymmetry. Vandalism is cheap to commit and cheaper to undo, so a version-controlled, publicly-logged, anyone-can-edit system converges rather than degrades — the opposite of the intuition. Layer on citation norms, talk-page deliberation and an elected-ish administrative class, and you get a governance system, not just a website.
• Non-obvious fact: Wikipedia relicensed from the GFDL — a software documentation licence poorly suited to prose — to CC BY-SA in 2009, an operation that required the FSF to add a time-limited migration clause to GFDL 1.3 specifically to make it legally possible. It remains one of the largest licence migrations ever executed on a corpus that no single entity owned.

8. Let's Encrypt

• What: A free, automated, publicly-trusted certificate authority; and the ACME protocol that automates issuance.
• Started: First publicly-trusted certificate 14 September 2015. By: the Internet Security Research Group (ISRG), backed by EFF, Mozilla, Akamai, Cisco and the University of Michigan. [Backers not verified this session.]
• Licence: Boulder (the CA software) is MPL-2.0; certbot Apache-2.0; ACME is an IETF standard (RFC 8555). [Not verified this session.]
• Scale (from ISRG's own 10-year post, *9 December 2025):* 1 million certificates by March 2016; 1 million per day by September 2018; 1 billion cumulative by 2020; ~10 million certificates per day as of late September 2025. "Closing in on protecting one billion web sites." HTTPS share of page loads: below 30% globally in 2015 → around 80% globally and close to 95% in the US (Let's Encrypt, 10 Years ↗). The live stats page confirms it is tracking Firefox HTTPS page-load percentage and daily issuance but the numeric values did not render in the text-only fetch (page dated 18 Aug 2026) (letsencrypt.org/stats ↗).
• Mechanism: They did not compete on price; they removed the transaction entirely. Certificates were never mainly expensive — they were annoying: a CSR, a purchase, an email verification, a manual install, and an outage a year later when you forgot to renew. ACME made issuance a 90-day automated loop with no human in it. Free was necessary; automated was sufficient.
• Non-obvious fact: This is the single most measurable civilisational impact in the list. Global web traffic went from under 30% encrypted to around 80% in ten years, and one non-profit issuing certificates for free is the primary cause. Note that ISRG deliberately kept certificate lifetimes short (90 days, now shorter options) — a design choice that made automation mandatory rather than optional, and that the wider CA/Browser Forum has since followed.

9. SQLite

• What: An embedded, serverless, single-file SQL database engine.
• Started: 2000, by D. Richard Hipp. [Year not verified this session.]
• Licence: Public domain. Not MIT, not BSD — dedicated to the public domain by its authors, with no licence required at all.
• Scale: SQLite's own estimate: over 1 trillion SQLite databases in active use, extrapolated from 4+ billion active smartphones each carrying hundreds of database files. Present in every Android, iOS, macOS and Windows 10/11 device, in Firefox, Chrome and Safari, in PHP and Python, in Skype, iTunes, Dropbox, TurboTax and QuickBooks, and in televisions, set-top boxes and cars. The project claims it is "likely used more than all other database engines combined" and is plausibly the second most widely deployed software library after zlib — possibly the first, counting static instances. Independently: 37.5% of developers report using it (SO 2025) (sqlite.org/mostdeployed ↗; SO 2025 ↗).
• Mechanism: Zero configuration, zero dependencies, zero server, one file, and a test suite with famously exhaustive branch coverage. Combined with public-domain status, the legal cost of adoption is also zero — no attribution file, no licence audit, no lawyer.
• Non-obvious fact — and it inverts almost everything else in this document: *SQLite is not an open-contribution project. It does not accept patches from anyone who has not signed an affidavit dedicating the work to the public domain, no code is copied in from elsewhere, and the original affidavits are kept in a firesafe at Hwaci's offices. Hwaci separately *sells an optional "Warranty of Title" licence for organisations in jurisdictions that don't recognise public domain, and that revenue funds development. The most deployed database on Earth is a cathedral with a fireproof filing cabinet (sqlite.org/copyright ↗).

10. cURL / libcurl

• What: Command-line tool and library for transferring data over ~28 protocols.
• Started: the name has been in effective use since 1998. By: Daniel Stenberg, who remains project lead.
• Licence: An MIT-derivative — "similar but not identical to the MIT license", with its own SPDX identifier, curl.
• Scale: "In 2025, we estimate that curl runs in roughly thirty billion installations world wide" (curl FAQ ↗).
• Mechanism: One person's thirty-year commitment to backwards compatibility and protocol completeness, at a level no vendor would fund. libcurl is in cars, TVs, printers, games consoles, phones and satellites because it is the only thing that reliably does HTTP everywhere.
• Non-obvious fact — and the most important open source story of 2025–26: curl killed its own bug bounty because of AI. Stenberg reported in July 2025 that ~20% of all 2025 submissions were AI-generated slop, while only ~5% turned out to be genuine vulnerabilities; each report engages three or four people for 30 minutes to three hours. Over the programme's life since 2019 it received 81 genuine reports and paid over $90,000. On 22 January 2026 curl announced the HackerOne bounty would end 31 January 2026, moving to unpaid GitHub reporting: "The main goal with shutting down the bounty is to remove the incentive for people to submit crap." Thirty billion installations, seven volunteers on the security team, and the funding mechanism was destroyed by an externality nobody was paying for (Stenberg, 14 July 2025 ↗; BleepingComputer, 22 Jan 2026 ↗).

11. Blender

• What: 3D creation suite — modelling, animation, simulation, rendering, compositing, video editing.
• Started: launched 2 January 1994 as an in-house tool at the Dutch studio NeoGeo. By: Ton Roosendaal.
• Licence: GPL-2.0-or-later. The Blender Foundation initially reserved dual-licensing rights but suspended that indefinitely in 2005 and never exercised it.
• Scale: Blender Institute employs 26 full-time staff and 12 freelancers. Development Fund corporate members include Epic Games, Nvidia, Microsoft and Apple. The 2024 Latvian film Flow was made entirely in Blender using the EEVEE renderer and won the Academy Award for Best Animated Feature. Other credits include Spider-Man 2 previsualisation (Blender ↗).
• Mechanism: A crowdfunded liberation. When NaN went bankrupt in 2002, Roosendaal founded the Blender Foundation in May 2002 and launched the "Free Blender" campaign on 18 July 2002 to buy the source code back from the creditors for €100,000 (~US$100,670 at the time). It succeeded on 7 September 2002. Blender is the only major creative application whose community literally purchased its freedom.
• Non-obvious fact: An Oscar for Best Animated Feature (March 2025) was won by a film made entirely in a GPL-licensed tool that a community bought out of bankruptcy for €100,000, against competition from studios with per-seat licensing budgets larger than Blender's entire annual funding.

12. Visual Studio Code and the Language Server Protocol

• What: An editor, and the protocol that decoupled language intelligence from editors.
• Started: VS Code 2015; LSP standardisation announced 27 June 2016, by Microsoft with Red Hat and Codenvy.
• Licence: The vscode repository is MIT; the shipped Microsoft binary is not — it is proprietary, adds telemetry, and its marketplace and several extensions (C/C++, remote development) are licensed to permit use only with the Microsoft build. VSCodium exists to build the MIT source without those additions. LSP's specification is open and developed on GitHub. [The exact licence terms of the Microsoft build and marketplace were not fetched this session — verify before publishing specifics.]
• Scale: 75.9% of developers use VS Code — Stack Overflow 2025, n=49,063 — against Visual Studio 29% and IntelliJ IDEA 27.1% (SO 2025 ↗).
• Mechanism: LSP is the interesting half. Before it, supporting M* languages in *N editors was an M×N problem, and the practical consequence was that good tooling existed only for languages with a corporate IDE behind them. LSP made it M+N. Neovim, Emacs, Helix, Zed and JetBrains all consume language servers written for VS Code — Microsoft's open protocol subsidised its own competitors, and the ecosystem is strictly better for it.
• Non-obvious fact: This is a complicated success, and worth saying so. The MIT-licensed core plus proprietary shipped binary plus licence-restricted marketplace is a textbook open core structure, executed so smoothly that most of its 75.9% user base does not know it is running proprietary software. LSP's genuine open standard sits inside a strategy that also captured the editor market.

13. OpenStreetMap

• What: A free, editable map of the world.
• Started: 2004, by Steve Coast. [Not verified this session.]
• Licence: ODbL 1.0 (Open Database License) — a copyleft database licence, since map data is not software. [Not verified this session.]
• Scale: 10 million registered users (2025-Q2); 2.25 million distinct user contributors (2025-Q2); 10 billion nodes (12 Aug 2025); ~4 million map changes per day (2021-Q4) (OSM wiki Stats ↗). I could not fetch openstreetmap.org/stats/data_stats.html — blocked by robots.txt.
• Mechanism: Copyleft on data. The ODbL means a commercial user who improves the map must share the improved database back — which is why Apple, Meta, Microsoft, Amazon and TomTom all contribute rather than fork. Combined with the fact that local knowledge cannot be bought at scale: the mapper who knows which alley is one-way lives on that alley.
• Non-obvious fact: In humanitarian crises, OSM is often the only current map. The Humanitarian OpenStreetMap Team mobilises thousands of remote volunteers to trace buildings and roads from satellite imagery within hours of a disaster — a capability no commercial mapping provider offers, because there is no business model in mapping a place immediately after it has been destroyed. [HOT detail not verified this session.]

14. Hugging Face and the open-weight model ecosystem

• What: A hub for models, datasets and demos, plus the transformers library; the distribution layer for open-weight AI.
• Started: 2016 as a chatbot company; pivoted to ML tooling. [Not verified this session.]
• Licence: transformers is Apache-2.0; hosted models carry their own, wildly varying, licences. [transformers licence not verified this session.]
• Scale (Hugging Face, State of Open Models: Summer 2026, covering Jan–Aug 2026): models 2.43M → 2.96M; datasets 711,000 → 1,000,000; Spaces 1.00M → 1.44M. Concentration is extreme: 85.6% of models have fewer than 200 lifetime downloads, and 1.5% of repositories account for 99.2% of all downloads. Small models dominate actual use: sub-1B models are 83% of all-time downloads; >100B models are 1%; in 2026, models above 70B took just 3% of annual download volume. Leadership: AMD and NVIDIA each published 200+ new model repos; Qwen has 151,448 derivatives on the Hub — 2.6× Meta's total footprint — adding roughly 180–210 new derivative repos per day through 2026. Licence split above 20B parameters: Chinese releases 59% Apache-2.0 / 22% MIT; US releases 29% Apache or MIT, 41% custom terms, 30% no declared licence (HF, Summer 2026 ↗).
• Mechanism: Hugging Face made model distribution a package-manager problem. from_pretrained() is the pip install of ML, and once weights had a registry with versioning, cards, and a download counter, "open weights" became a competitive lane rather than a research gesture.
• Non-obvious fact: The economics are inverted from every other success story here. Open models are ~20% of token usage but only ~4% of revenue (OSI, Aug 2026 ↗), and Hugging Face's own report is blunt that for the labs releasing weights "the return has to come from somewhere else: API and cloud business, hardware and platform positioning, or the ecosystem position itself." Also worth noting: the most permissively licensed frontier-adjacent models in 2026 are Chinese, and the most restrictively licensed are American.

Instructive failures and near-misses

Failure 1 — OpenSolaris: open-sourced to death by licence and governance

Sun began planning OpenSolaris in early 2004, ran a pilot from September 2004, and chose the CDDL — an MPL-1.1 derivative — submitting it to the OSI on 14 January 2005. DTrace was released 25 January 2005; the bulk of the Solaris code on 14 June 2005. Governance looked serious: a Community Advisory Board from 4 April 2005 including Roy Fielding and Simon Phipps, replaced by an independent OpenSolaris Governing Board under a charter Sun approved on 10 February 2006.

Then Oracle acquired Sun in 2010. On 13 August 2010 an internal Oracle email leaked indicating binary distributions would end. The final build, 134b, appeared 12 November 2010; Oracle Solaris 11 Express, proprietary, on 15 November 2010. Former developers had already launched OpenIndiana on 14 September 2010, with the illumos Foundation taking the kernel and userland; illumos-based distributions survive today (OpenSolaris ↗).

Why it failed, precisely. Three compounding causes. (1) The licence was chosen to be file-level copyleft that could be mixed with other licences — with the effect, widely read as deliberate, of being GPL-incompatible. That permanently walled ZFS and DTrace off from Linux, denying OpenSolaris the one integration path that would have given it a mass developer base. (2) Governance was advisory, not sovereign. The OGB had a charter Sun approved; it never held the copyrights, the trademark, the build infrastructure or the release process. When ownership changed hands, the community discovered it owned nothing. (3) The community was never given a reason to exist independently of Sun — there was no vendor-neutral foundation with assets before the crisis, only after. The general lesson: a community that does not control the trademark, the copyrights and the infrastructure is a marketing programme, not a project.

Failure 2 — Apache OpenOffice: the fork that took the community, and the licence that made it one-way

StarOffice was acquired by Sun in 1999 and open-sourced as OpenOffice.org in July 2000. In September 2010 the majority of external developers left over Oracle's stewardship, forming The Document Foundation and launching LibreOffice in January 2011. Oracle discontinued OpenOffice.org development in April 2011, terminated the team, and donated trademarks and code to the ASF in June 2011.

The ASF relicensed the code to Apache-2.0, replacing the previous LGPL. This had a specific, corrosive consequence: code could flow from Apache OpenOffice into LibreOffice but not back, because LibreOffice's copyleft could not be absorbed into a permissive project. LibreOffice initially rebased on AOO 3.4, and then the flow stopped: by 2016 only 11 commits from Apache OpenOffice had been merged into LibreOffice — 0.07% of LibreOffice's commits for the period.

Downloads peaked at nearly 148,000/day in 2013, falling to about 50,000/day in 2019–20; cumulative downloads passed 200 million by November 2016. Retirement was formally raised by the project management committee chair in September 2016 (LWN covered it ↗). The latest release, 4.1.16, shipped 10 November 2025, security fixes only. In July 2025 the Apache Security Team raised OpenOffice's risk status to "red", citing unresolved vulnerabilities and inadequate development resources (Apache OpenOffice ↗).

Why it failed, precisely. The ASF got the asset and TDF got the people, and the people were the asset. Compounding it, the relicensing to Apache-2.0 — chosen for good foundation-policy reasons — created a one-way valve that guaranteed AOO could never benefit from its fork's development while the fork could freely benefit from its own. Fifteen years later a project with hundreds of millions of installed users is a security liability that its own foundation flags in red. The lesson: the licence you choose determines which direction code can flow after a fork, and after a fork that direction determines who survives.

Near-miss 3 — Netscape/Mozilla/Firefox: the model nearly failed, then worked, then lost anyway

Netscape announced the source release on 22 January 1998 and shipped on 31 March 1998 under the Netscape Public License, launching the Mozilla Project. This is the event that catalysed the coining of "open source", the OSI, and the whole 1998 inflection — and on its own terms it failed. The Communicator codebase was too degraded to build on; the team abandoned it and rewrote from scratch. Netscape 6 did not ship until November 2000. Firefox 1.0 did not arrive until November 2004 — six and a half years after the release, by which time Internet Explorer had won the desktop.

Then it worked: Firefox peaked around 30% worldwide usage share, forced Microsoft to resume IE development, and drove the standards revival that produced modern web platform governance. And then it lost: Firefox was at 10–11% in late 2015, and stands at 3.34% in July 2026, against Chrome 68.22%, Safari 16.47% and Edge 5.37% (StatCounter ↗; Mozilla ↗).

Why this is instructive. Two reasons. First, the founding event of the open source movement took six years to produce a shippable product — the standard narrative that "Netscape open-sourced the browser and the bazaar took over" is simply false, and anyone writing history should say so. Second, the funding structure: Mozilla Foundation and subsidiaries reported 2024 total revenue of $680.4 million, of which $498.2 million was royalty/search revenue, and the audited financials disclose that approximately 86% of Mozilla's revenues from customers with contracts were derived from one customer for the year ended 31 December 2024 (Mozilla Fdn 2024 audited financials, PDF ↗). The principal independent counterweight to Google's browser monopoly derives roughly 86% of its contracted revenue from Google. That is the sustainability problem in its purest form.

PART 3 — THE EVIDENCE TABLE

On AI and open source in 2025–26 — the credible evidence

Four independent, load-bearing data points, all fetched:

1. AI is generating vulnerability reports faster than volunteers can triage them. curl: ~20% AI slop, ~5% genuine, programme terminated 31 Jan 2026. FFmpeg publicly called Google's Big Sleep output "CVE slop" on 31 October 2025 after a report on a LucasArts Smush codec path affecting only early-1990s games — the FFmpeg team's line was "security issues are taken extremely seriously in FFmpeg, but fixes are written by volunteers" (TechSpot, 12 Nov 2025 ↗).
2. The industry has priced the problem at $12.5M (AWS/Anthropic/Google/Microsoft/OpenAI + Linux Foundation, 17 Mar 2026) — for tooling to validate and filter AI-generated reports.
3. Licence compliance is degrading measurably. OSSRA 2026: licence conflicts at 68%, up 12 points in one year, "the highest rate in OSSRA history", alongside components +30% and mean vulnerabilities +107% — Black Duck's explanation is AI-accelerated code creation. Governance has not kept up: only 24% of organisations evaluate AI-generated code across IP, licensing, security and quality.
4. The contribution mix has shifted. Octoverse 2025: 4.3M AI repos, 1.13M repos importing LLM SDKs (+178%), 693,867 new AI projects in 12 months, and 36.2M new developers (+23%) — the largest single-year influx ever, arriving with AI assistance as the default.

The synthesis worth publishing: AI raised the supply of code, of bug reports, and of contributors, without raising the supply of maintainers. Every 2025–26 crisis in this document is a variant of that one sentence.

PART 4 — THE ARGUMENTS WORTH PUBLISHING

1. Free software vs open source — is the ethical framing load-bearing or a distraction?

Load-bearing. Without the ethical frame, there is no principled reason to prefer freedom when proprietary is better — and proprietary is frequently better. The framing is what produced the legal instruments that actually protected anything: copyleft exists because Stallman was arguing about rights, not efficiency, and GPLv3's anti-tivoisation clauses exist because "the user must be able to run modified code on their own device" is an ethical proposition that no engineering argument generates. Every genuinely durable win in this history traces to a copyleft or copyleft-descended instrument: Linux's GPLv2 forced hyperscaler cooperation; the ODbL forces Apple and Meta to give map data back; the reversals of both Elastic (2024) and Redis (2025) landed on the AGPL, an FSF licence. And in the 2024–26 AI definition fight, the FSF's position — that you cannot call a system free if its training data doesn't respect users — is the one that has held its shape while OSI's has had to absorb "data information" compromises.

A distraction. The ethical frame was empirically losing in 1998 and the pragmatic reframe empirically won — Netscape, IBM, Sun, and eventually Microsoft, GitHub, Kubernetes, and a $680M-revenue Mozilla. "Free" was misread as "free of charge" in every commercial conversation, and the FSF's rhetorical style read to corporate counsel as hostile, which meant the code did not get deployed, which meant the freedoms protected nobody. The OSD's checklist form is the whole point: a checklist can be written into an EU procurement rule and a manifesto cannot. The EU's June 2026 "Free Software first principle" got into a Commission strategy because there is an OSI-approved licence list that a lawyer can point at. Moreover, most of the practical wins in this document are not copyleft: Apache-2.0 built Kubernetes and the entire cloud-native stack; MIT built the JavaScript ecosystem; SQLite is public domain and is the most-deployed database on Earth.

Where I'd land, and say so openly: the framing is load-bearing for the licences and distracting for the adoption. The movement needed both, and the fact that the two camps have re-converged on the AI question in 2026 — arriving at the same restrictive conclusion in different vocabularies — is evidence that the split was always tactical rather than substantive.

2. Copyleft vs permissive — which produced more freedom in practice?

Copyleft. Linux is the largest cooperative engineering project in history and its GPLv2 is why: no vendor could privately fork and out-develop the commons, so Intel, Google, Red Hat and AMD were structurally compelled to upstream (6.18: 2,134 developers, Intel 10.4%, Google 7.9%). Compare BSD, technically ahead in 1992, permissively licensed, and fragmented into SunOS, BSD/OS and proprietary derivatives. Compare OpenOffice: the ASF's relicensing to Apache-2.0 created a one-way valve into LibreOffice and killed the original. Compare OpenStreetMap: the ODbL is why Apple, Meta and Microsoft contribute rather than take. And note the direction of travel in the relicensing wave — the vendors who felt exploited by hyperscalers did not reach for a permissive licence, they reached for the AGPL.

Permissive. Freedom that isn't deployed protects nobody, and permissive licences got deployed far more. Apache-2.0 — with the patent grant that MIT/BSD lack — is why Kubernetes, Kafka, Hadoop, Swift and effectively all of CNCF exist and why competitors co-develop them. MIT is why the JavaScript and Python package ecosystems exist at the scale they do. Permissive licensing is a market-share strategy that also happens to produce commons: Google gave Kubernetes away and gave away control of it, and got a portability standard it designed. And copyleft has a specific, demonstrated failure: it did not protect against the cloud, because copyleft triggers on distribution and SaaS does not distribute. Every vendor grievance of 2018–2024 is a GPL failure mode.

The honest scorecard. Copyleft produced more irreversible freedom in the specific cases where a single codebase had strategic value and the alternative was capture (Linux, OSM, Blender). Permissive produced more total deployed freedom by volume, and produced the patent protections that copyleft licences of the 1991 vintage lack. The data show permissive winning on share (82%→73% permissive, RedMonk 2026; GPL family 71%→24%, 2008–2018) — but share of repositories is a poor proxy for share of consequence, since Linux, Git, Blender and WordPress are all GPL and all count as one repository each.

3. Open core — legitimate sustainability model or bait and switch?

Legitimate. Someone has to pay for full-time engineering, and the alternatives are worse: 60% of maintainers are unpaid, 60% have quit or considered it, and 61% of the unpaid are solo (Tidelift 2024). Open core at least funds people. GitLab, Grafana, Sentry, Elastic and HashiCorp have collectively employed thousands of full-time open source engineers — vastly more than Alpha-Omega's $8.6M cumulative or the Sovereign Tech Agency's €24.6M could. And the model has a real self-correcting property: if the core is genuinely open, the community can fork when the vendor overreaches, and in 2023–25 it did so three times in a row (OpenTofu, Valkey, OpenSearch). VS Code is open core executed so well that 75.9% of developers use it without noticing.

Bait and switch. The pattern is now documented, not speculative. A project is released permissively to acquire adoption because it is open; adoption creates lock-in; the licence is then changed once switching costs are high enough. MongoDB (2018), Elastic (2021), HashiCorp (2023) and Redis (2024) all followed it, and in each case the community had built businesses, careers and production systems on a promise that was withdrawn. The deeper objection is about the shape of the value capture: features get moved above the line over time (SSO, audit logs, RBAC — the "SSO tax"), so the open core hollows out. And the community's contributions, made under one set of expectations, end up inside a product sold under another.

What the evidence actually shows. Both. It is legitimate and it was used as a bait and switch, and the market has now developed an immune response: the credible fork. Two of the four canonical relicensings were reversed (Elastic to AGPL in 2024, Redis to AGPL in 2025), and in both cases the stated reason was that the community had rejected the new licence. The practical test to publish: does the project have a neutral foundation home, a trademark held outside the vendor, and a CLA that does not assign copyright? If not, assume the licence can change.

4. Do the hyperscalers free-ride, or fund more than they take?

They fund more than they take. The numbers are not close to zero. AWS, Google and Microsoft are the entire funding base of Alpha-Omega ($8.6M cumulative, 63% of 2024 grants to security staffing at the PSF, Rust Foundation, Node.js, Eclipse, the kernel, RubyGems, FreeBSD, Jenkins). They were founding funders of the CII in 2014. On the kernel itself, Intel, Google, Red Hat (IBM) and AMD are four of the top five contributors to 6.18. Google created and gave away Kubernetes and then handed governance to a neutral foundation. AWS took the OpenSearch fork and donated it to the Linux Foundation in Sept 2024, where it has passed a billion downloads with 400+ contributing organisations. Meta open-sourced PyTorch and moved it to the Linux Foundation in 2022. In March 2026 the five largest AI firms put $12.5M into maintainer triage tooling.

They free-ride. Scale matters. Against an $8.8 trillion demand-side estimate (or even the sceptics' far smaller figure), $8.6 million cumulative from the three largest cloud companies over four years is a rounding error — Alpha-Omega's average grant is $227,445, less than one senior engineer's fully-loaded cost. The funding is also strategically directed: it goes to security (which protects the funders' own supply chain) and to projects that anchor the funders' platforms, not to the boring, load-bearing, unglamorous dependencies that Census III identifies as maintained by "only a handful of contributors". And the behavioural evidence is damning: Google's automated systems generated enough low-value bug reports to make FFmpeg publicly demand "fund us or stop sending bugs", and to contribute to curl ending its bounty programme. That is the free-rider problem in its purest form — externalising triage cost onto volunteers while contributing no triage capacity.

The sharpest version of the disagreement: hyperscalers fund open source security generously and open source maintenance barely at all, because security failures are their risk and maintainer burnout is not. The CSRB spotted this in 2022 (Recommendation 14: pilot open source maintenance support) and the market has still not solved it.

5. Should maintainers be paid, and by whom — and what does paying change?

Yes, obviously. The evidence that it changes outcomes is the strongest in this whole document. Tidelift 2024: paid maintainers are 55% more likely on average to implement critical security practices (2FA 76% vs 68%, static analysis 75% vs 59%), and — the more important finding — only 26% of paid maintainers work alone versus 61% of unpaid, with 53% of paid projects having co-maintainers versus 20% of unpaid. Payment does not merely buy attention; it buys a second maintainer, which is the actual fix for the bus factor. And the counterfactual is documented: the xz attack succeeded through a multi-year pressure campaign against a single, exhausted, unpaid maintainer. A funded project with three maintainers is a materially harder target.

By whom — the four models, with their failure modes. (a) Companies directly (Tidelift subscriptions, corporate employment): responsive to whoever pays, so unfashionable dependencies stay unfunded. (b) Pooled industry funds (Alpha-Omega, OpenSSF): neutral allocation, but total capital is two orders of magnitude too small. (c) States (Sovereign Tech Agency; the proposed EU-STF at €350M; the EU's €2bn/7yr): the only source at plausible scale, but introduces sovereignty questions — the STA is a German federal body funding globally-used infrastructure like PyPI, which is either a public good or a soft-power instrument depending on who you ask, and it is subject to budget politics (2022 €13M → 2023 €22M → 2024 €16M is a declining trajectory). (d) Individual sponsorship (GitHub Sponsors, Open Collective): dignified, and demonstrably insufficient at 60% unpaid.

What paying changes — including the costs, which are real. It changes the relationship. An unpaid maintainer owes nobody anything and can say no; a paid one acquires obligations, SLAs and stakeholders. It can convert a gift economy into a service economy, and gift economies are why several projects here are good. It introduces allocation politics into communities that previously had none. And it can distort priorities toward whatever the funder measures — the CRA-compliance-shaped work that a grant will pay for, rather than the refactor the maintainer knows is needed. The strongest version of the sceptical case is Daniel Stenberg's own trajectory: curl's problem in 2026 was not that nobody paid, it was that money attracted the wrong contributors — the bounty had to be killed because it was paid.

6. Is "open source AI" coherent without training data?

No. The OSD's freedoms are not a mood; they are operational. "Freedom to study" means being able to determine why a system behaves as it does, and with weights alone you can observe behaviour but not trace its cause. "Freedom to modify" in any meaningful sense means being able to rebuild — and you cannot rebuild without data. Julia Ferraioli's formulation is the cleanest: without data, "the only things that the OSAID guarantees are the ability to use and distribute." Tom Callaway's is the strategic one: a data-optional definition "devalue[s] the meaning of 'open source' in all other contexts" — you cannot maintain a strict definition for code and a loose one for models without the loose one bleeding across. And there is a concrete security argument: Giacomo Tesio's point that undetectable backdoors can be planted via training data is exactly the xz lesson applied to a domain where review is harder, not easier. The FSF and the Software Freedom Conservancy both landed here.

Yes. A definition that no existing system can satisfy is not a definition, it is a boycott. Essentially no frontier model could release its training corpus — for copyright reasons, licensing reasons, privacy reasons, and sheer scale — so "open source AI requires open data" designates the empty set while the world proceeds to call things open source anyway. That is worse for the term than a workable standard. OSI's substantive claim is that weights plus architecture plus code genuinely are the preferred form for making modifications to an AI system, which is what the OSD's language actually requires: nobody retrains from scratch, everyone fine-tunes, and fine-tuning needs weights. The "data information" requirement is a real disclosure obligation, not nothing. And OSI reached it through a global co-design process spanning builders, deployers, unions, ethicists and lawyers, not by fiat.

State of play in 2026, honestly. Unresolved and increasingly moot. The market settled on "open weights" as the operative term, which concedes the critics' semantics while declining their standard. OSI has shifted from definition-policing to openness-advocacy (its 12 Aug 2026 post argues from usage, cost and performance data). And the licensing centre of gravity moved: the most permissively licensed serious models in 2026 are Chinese (59% Apache-2.0, 22% MIT above 20B params), while US releases are 41% custom terms and 30% unlicensed. None of them release training data. The definition fight was won on points by the critics and lost on the ground.

7. Did the CRA help or harm European open source?

Helped. For the first time, a regulator distinguished between commercial manufacturers and the non-commercial commons rather than treating all software identically. The "open source steward" category — code-hosting foundations and organisations that support software they do not monetise — carries lighter obligations than manufacturers, and pure contributors and non-monetising developers are not directly in scope. That distinction did not exist in the first draft and was won by open source institutions engaging the process. The regulation also forces the thing everyone has been asking for since Heartbleed: someone must actually be accountable for the security of shipped software, which shifts cost onto the commercial integrators who have been extracting value from unpaid maintainers. And it arrived with money attached — the CRA is part of the same policy arc that produced the June 2026 Open Source Strategy, CADA's "Free Software first principle", €2bn over seven years and the EU-STF proposal.

Harmed. The steward category is defined by a negative ("not monetising the particular pieces of software they are stewarding") that maps badly onto how projects actually fund themselves — support contracts, hosted versions, sponsorships and dual licensing all blur it, and a foundation that guesses wrong faces EU market-access risk. The compliance burden (SBOMs, vulnerability handling, coordinated disclosure, reporting from 11 September 2026, full application 11 December 2027) is fixed cost that scales badly to volunteer projects — the ASF triaged 650 vulnerability reports and published 239 CVEs in FY2025 on a $2.08M budget that ran a deficit, and the CRA adds to that. The predictable failure mode is not that European open source stops; it is that maintainers geo-fence, add "not for EU commercial use" notices, or simply stop responding to European enterprises — which reduces European access to open source rather than improving its security. And even sympathetic observers (ORC WG) note that non-monetising contributors "may experience indirect impact in terms of higher expectations around security" — i.e. the burden lands on them anyway, without the carve-out's protection.

Too early to score, and say so. Reporting obligations have not started (11 Sept 2026 is two weeks after this research was compiled). The honest position for publication is: the legislative outcome was better than the open source community feared in 2023, the operational outcome is unknown, and the first real evidence arrives in late 2026. Anyone claiming to know now is guessing.

PART 5 — COMMONLY REPEATED AND WRONG

1. "Linux runs 90% of the cloud" / "100% of the TOP500." The cloud figure has no primary source I could locate, and every result returned was SEO content citing other SEO content. Do not publish it. The supercomputing figure is probably still true — on the June 2026 TOP500 the top five systems run Kylin OS (China), TOSS, HPE Cray OS, an unspecified OS, and RHEL, all Linux-derived — but I could not fetch TOP500's operating-system-family statistics table (the pages returned navigation shells only), so I cannot verify "all 500". Say what you can verify: Android is 68.36% of mobile (StatCounter, July 2026); Linux-derived OSes run the top five supercomputers (TOP500, June 2026); Nginx + Apache + Cloudflare + LiteSpeed — all running predominantly on Linux — are 98.5% of identified web servers (W3Techs, Aug 2026).

2. "Eric Raymond coined 'open source'." No. Christine Peterson of the Foresight Institute suggested it, in the first week of February 1998. She deliberately did not propose it herself — Todd Anderson, who had community credibility as a Linux programmer, introduced it into discussion so it would spread "memetically". Raymond, Tim O'Reilly and Bruce Perens championed its adoption. (Peterson's own account ↗) Bonus correction: sources disagree on the date — OSI says 3 February 1998; Peterson's account describes Raymond visiting on 2 February and the VA Research meeting on 5 February.

3. "Netscape open-sourced the browser and the bazaar took over." The opposite. Announced 22 January 1998, released 31 March 1998, and the codebase was so degraded that the team threw it away and rewrote from scratch. Netscape 6 shipped November 2000; Firefox 1.0 did not arrive until November 2004 — six and a half years after the founding event of the open source movement, by which time IE had won. The model's flagship case study was a six-year near-failure. (Mozilla ↗; Netscape Communicator ↗)

4. "Given enough eyeballs, all bugs are shallow." Not a security property. Robert Glass called it a fallacy in 2003 on evidence that useful reviewers cap out at two to four. Heartbleed survived two years in the most security-critical library on the internet. Jim Zemlin, running the Linux Foundation, said of the 2014 vulnerabilities: "In these cases, the eyeballs weren't really looking." And xz was engineered by the maintainer specifically to survive review. The residual truth is weak and correlational (Amit & Feitelson 2020 found higher fix rates in popular projects). (Linus's law ↗)

5. "The xz backdoor was caught by the community's many eyes." It was caught by one engineer — Andres Freund, a PostgreSQL developer at Microsoft — investigating a performance anomaly: SSH logins consuming unexpected CPU and throwing Valgrind errors in a Debian test build. He was not doing a security review. He was benchmarking. Had he not been curious about a sub-second latency regression, the backdoor would have shipped into Debian and Ubuntu stable. (XZ Utils backdoor ↗)

6. "MongoDB / Elastic / Redis / HashiCorp went closed source." Imprecise and now partly obsolete. They went source-available — code readable and modifiable, but with use restrictions that fail the OSD. And the picture has changed: Elastic added AGPLv3 in August 2024. Redis 8 shipped under AGPLv3 around 1 May 2025. MongoDB remains SSPL. Terraform remains BUSL and HashiCorp is now inside IBM (acquisition closed 27 Feb 2025). Two of four reversed. (Elastic ↗; antirez ↗; SSPL ↗)

7. "Open source is worth $8.8 trillion." No. $8.8 trillion is the demand-side replacement cost — what it would cost if every firm using OSS had to independently recreate it, priced at global average developer wages. The supply-side figure (recreate everything once) is $4.15 billion. And a substantive critique argues the paper's own alternative "goods market" model — OSS replaced by commercial vendors, which is the realistic counterfactual — yields $177 million, four orders of magnitude lower. Publish the $8.8tn only with its definition and this critique attached. (HBS WP 24-038 ↗; Open Path ↗)

8. "70–90% of a modern codebase is open source." The commonly cited OSSRA number is a different thing: 98% of 947 audited codebases contain open source (OSSRA 2026). That is a presence figure, not a share-of-lines figure. OSSRA's 2026 press release did not publish a share-of-code percentage, and the audit population (heavily M&A due diligence) is not a random sample of software. Use "98% of audited codebases contain open source components (Black Duck OSSRA 2026, n=947)" and stop there.

9. "SQLite is open source — send them a patch." SQLite is public domain, not open-source-licensed, and it is explicitly not open-contribution. It refuses patches from anyone who has not signed a public-domain dedication affidavit; the originals are kept in a firesafe at Hwaci's offices; and Hwaci sells an optional commercial "Warranty of Title" for jurisdictions that don't recognise public domain. The most-deployed database in the world is one of the most closed development processes in this document. (sqlite.org/copyright ↗)

10. "Linux desktop share is about 4%." StatCounter puts Linux at 7.53% of desktop for July 2026. But treat this metric as unreliable in both directions: StatCounter is page-view-derived, it splits macOS into two categories ("OS X" 12.21% and "macOS" 7.61%), ChromeOS is counted separately at 1.47% despite being Linux, and a large "unknown" bucket exists. Quote it with the method attached or not at all. (StatCounter ↗)

11. "Wikipedia is GFDL-licensed" / "Wikipedia gets 18 billion views a month." Wikipedia content is CC BY-SA 4.0; it migrated off the GFDL in 2009. And the 18bn/500M-uniques figure that circulates is from a February 2014 New York Times report citing comScore — it is twelve years old. I could not obtain current traffic figures: stats.wikimedia.org is cache-only and cannot be fetched. (Wikipedia ↗)

12. "GitHub has 100 million developers." 180+ million as of Octoverse 2025, with 36.2M added in 2025 alone. Also note that GitHub's own numbers do not reconcile cleanly: Octoverse reports 630M repositories while GitHub separately announced its "1 billionth repository" in June 2025 (cumulative-ever-created, including deleted and forked), and Wikipedia carries a "150 million users, May 2025" figure that is inconsistent with Octoverse. Cite Octoverse and say which measure you mean. (Octoverse 2025 ↗; GitHub ↗)

13. "Mozilla/Firefox is funded by its community." 86% of Mozilla's revenue from customers with contracts came from a single customer in 2024 ($498.2M of $680.4M total revenue was royalty/search). The main independent check on Google's browser dominance is overwhelmingly funded by Google. (Mozilla Fdn 2024 audited financials ↗)

14. "BSD lost because it was permissively licensed." Partly, but the proximate cause was litigation risk, not licence choice. USL v. BSDi (April 1992 – February 1994) put a legal cloud over free Unix during exactly the window Linux needed. The settlement removed 3 files out of 18,000 and added copyright notices to 70. The claim was nearly empty; the uncertainty was decisive. (USL v. BSDi ↗)

15. "Unix was open because Bell Labs believed in sharing." Unix circulated because the 1956 AT&T consent decree made it illegal for AT&T to sell it — Bell Labs was barred from any business other than common carrier communications. Unix shipped for the cost of media and postage as a compliance artefact. The moment the decree was lifted (1982 settlement, divestiture effective 1984), AT&T commercialised System V immediately. (History of Unix ↗)

16. "Apache is still the most popular web server." Third, at 22.6% — behind Nginx (31.4%) and Cloudflare (29.6%), as of 23 August 2026. Note also that Netcraft's "million busiest sites" measure gave Apache 17.83% in March 2025 while W3Techs gave 26.4% across all sites in April 2025 — the two methodologies routinely disagree by 8+ points. (W3Techs ↗; Apache HTTP Server ↗)

17. "There are millions of open source AI models available." Technically true, practically misleading. Of ~2.96M models on Hugging Face (Aug 2026), 85.6% have fewer than 200 lifetime downloads, and 1.5% of repositories account for 99.2% of all downloads. And almost none meet the OSI's Open Source AI Definition — "open weights" is the accurate term. (HF Summer 2026 ↗)

SOURCE LIST

Fetched in full this session (primary or best-available)

Primary / official

• HBS Working Paper 24-038, The Value of Open Source Software (PDF) ↗
• ASF FY2025 Annual Report (PDF) ↗ · apache.org/foundation ↗
• Alpha-Omega 2024 Annual Report (PDF) ↗
• CISA Cyber Safety Review Board, Log4j report, 11 July 2022 (PDF) ↗
• Mozilla Foundation 2024 audited financials (PDF) ↗
• Tidelift State of the Open Source Maintainer 2024 (PDF) ↗
• OSI History ↗ · OSI: Open Source AI ↗ · OSI: OSAID process ↗ · OSI: The AI Era Arcs Toward Openness, 12 Aug 2026 ↗
• Christine Peterson, "How I coined the term 'open source'" ↗
• Mozilla Turns Twenty ↗
• Let's Encrypt: 10 Years of Certificates, 9 Dec 2025 ↗ · Let's Encrypt stats ↗
• sqlite.org: Most Widely Deployed ↗ · sqlite.org: Copyright ↗
• curl FAQ ↗ · Daniel Stenberg, "Death by a thousand slops", 14 July 2025 ↗
• antirez, "Redis is open source again" ↗
• Elastic, "Elasticsearch is Open Source, Again" ↗
• npm blog: Details about the event-stream incident ↗
• GitHub Octoverse 2025 ↗
• Stack Overflow Developer Survey 2025 — Technology ↗
• CNCF 2025 Annual Cloud Native Survey ↗
• Black Duck OSSRA 2026 press release, 25 Feb 2026 ↗
• OpenSSF/LF: Census III press release, 4 Dec 2024 ↗
• OpenSSF: EU Cyber Resilience Act ↗ · ORC WG: The EU CRA ↗
• Linux Foundation: OpenSearch Software Foundation one year on, 25 Aug 2025 ↗
• AWS Open Source Blog: $12.5M against AI threats, 17 Mar 2026 ↗
• Hugging Face: State of Open Models, Summer 2026 ↗
• FSFE: EU Tech Sovereignty — a milestone for Public Code?, 3 June 2026 ↗
• OWASP: About ↗
• PyPI Statistics ↗
• OpenStreetMap wiki: Stats ↗
• TOP500, June 2026 list ↗

Measurement services

• StatCounter: mobile OS ↗ · desktop OS ↗ · browsers ↗
• W3Techs: web server survey ↗

Analysis and journalism (fetched)

• LWN: Some 6.18 development statistics ↗ · LWN: OSI readies controversial Open AI definition ↗
• RedMonk: The State of Open Source Licensing in 2026 ↗
• Chad Whitacre / Open Path: Questioning "The Value of Open Source Software" ↗
• TechPolicy.Press: How the EU's Tech Sovereignty Package Puts Open Source to the Test ↗
• BleepingComputer: curl ending bug bounty, 22 Jan 2026 ↗
• TechSpot: FFmpeg thanks Google for the bug reporting, now asks where the funding is ↗
• TechCrunch: IBM closes $6.4B HashiCorp acquisition ↗

Wikipedia (fetched — used for dated chronology; treat as secondary) History of FOSS ↗ · History of Unix ↗ · USL v. BSDi ↗ · GNU GPL ↗ · Git ↗ · GitHub ↗ · Halloween documents ↗ · Linus's law ↗ · Apache HTTP Server ↗ · XZ Utils backdoor ↗ · Core Infrastructure Initiative ↗ · OpenSSF ↗ · Server Side Public License ↗ · OpenTofu ↗ · Sovereign Tech Agency ↗ · EU Sovereign Tech Fund ↗ · OpenSolaris ↗ · Apache OpenOffice ↗ · Blender ↗ · Wikipedia ↗ · PyTorch ↗ · Language Server Protocol ↗ · Netscape Communicator ↗ · Mozilla ↗

Search-derived only (surfaced but NOT fetched — verify before citing)

The Register: Redis returns to open source with AGPL, 1 May 2025 ↗ · InfoQ: Redis AGPL ↗ · devclass: AWS hands OpenSearch to Linux Foundation ↗ · TechCrunch: official definition for open source AI, 28 Oct 2024 ↗ · LWN: Contemplating the retirement of Apache OpenOffice ↗ · Black Duck OSSRA report page ↗ and full PDF ↗ · SSRN: The Value of Open Source Software ↗ · HBS AI Institute summary ↗ · FSF: freedom in machine learning applications ↗ (robots.txt blocked) · FOSDEM 2025: FSF criteria for free ML applications ↗ · FOSDEM 2026: EU Sovereign Tech Fund case ↗ · EU-STF campaign site ↗ · European Commission: Cyber Resilience Act ↗ · NetBSD archive: USL lawsuit settlement documents ↗ · Netscape Public License 1.1 ↗ · Raymond, The Cathedral and the Bazaar (PDF) ↗ · JFrog: XZ backdoor analysis ↗ · Snyk: event-stream post-mortem ↗ · Linux Foundation: OpenTofu GA ↗ · MongoDB SSPL FAQ ↗ · OpenSSF: EU CRA resources ↗

GAPS AND THINGS TO CHASE BEFORE PUBLICATION

1. TOP500 operating-system statistics. The pages I tried returned navigation only. Get the OS-family table for the June 2026 list before making any "all 500 run Linux" claim.
2. The definitive xz account. Wikipedia was the best consolidated source I could reach. For a security audience — which Dinis Cruz's is — you want Andres Freund's original oss-security post, Russ Cox's research.swtch.com timeline, and Filippo Valsorda's analysis. I did not fetch them.
3. CRA article and recital numbers. Neither the OpenSSF nor ORC WG pages gave them. The steward provisions and the non-commercial carve-out need citation to Regulation (EU) 2024/2847 directly, and the 10-vs-11 December 2024 entry-into-force discrepancy needs resolving against the Official Journal.
4. OpenTofu vs Terraform adoption. Every 2026 figure I found came from IaC vendor blogs with an interest in the answer. I would publish no number here.
5. Current Wikimedia traffic. stats.wikimedia.org is cache-only and unfetchable from this sandbox; the only figure available is from 2014.
6. Founding dates I could not verify: DECUS (1961), SourceForge (1999), Google Code (2006–2016), GitHub Sponsors (2019), Open Collective, Tidelift, OpenStreetMap (2004), SQLite (2000), Python (1991), PostgreSQL/POSTGRES (1986/1996), Kubernetes and CNCF (2014/2015), Firefox 1.0 (9 Nov 2004), the GNU announcement (27 Sept 1983), the GNU Manifesto (March 1985), the FSF (October 1985), Linux's August 1991 announcement, and the Lions' Commentary (1977). All are widely cited and probably correct; none were confirmed from a primary source this session.
7. VS Code's exact proprietary terms (binary licence, marketplace ToS, extension restrictions) — I described these from general knowledge, not from a fetched source. Verify before publishing the open-core characterisation.
8. OSAID revision timeline. The OSI page shows "v1.0, published 28 May 2025, modified through 22 July 2026" but the process page gives no revision schedule and no v1.1 exists. Worth asking OSI directly rather than inferring.

   ---

This research document was compiled on 24 August 2026 using WebSearch and WebFetch only. Fetch failures are reported inline rather than worked around. It is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0); the sources it cites retain their own licences.