In March 2024, Andres Freund, a Microsoft database engineer benchmarking PostgreSQL on a Debian test machine, noticed that secure-shell logins were taking 500 milliseconds longer than usual. Half a second. Most engineers would have blamed the network and moved on. Freund kept digging. Within days he had uncovered a backdoor buried in XZ Utils, a compression library carried by nearly every Linux distribution on earth. America’s Cybersecurity and Infrastructure Security Agency logged the flaw as CVE-2024-3094 and assigned it a severity score of 10, the maximum. Had the malicious code reached production releases of Red Hat or Ubuntu, it would have handed its operators remote root access to a sizeable share of the world’s servers.
‘Jia Tan’, the alias of XZ’s mole, had spent two and a half years earning co-maintainer status, before slipping malicious code into versions 5.6.0 and 5.6.1. The patience of the campaign disturbed investigators most. Open-source software, the connective tissue of the modern internet, had come within weeks of its largest single compromise.
The story behind the near-miss began in 1983, when Richard Stallman, then a programmer at MIT, launched the GNU project to build a free clone of Unix, the dominant operating system of the era. His General Public Licence, published six years later, contained a piece of legal jujitsu: anyone could reuse the code, provided their derivative work remained open. In August 1991, a 21-year-old computer-science student in Helsinki named Linus Torvalds posted to a Usenet newsgroup announcing what he described as “just a hobby, won’t be big and professional like gnu”. That hobby, the Linux kernel, married to GNU’s tools, became the operating system that today powers Android phones, stock exchanges and most of the internet’s servers. The phrase ‘open-source software’ entered the lexicon only in February 1998, repackaging Stallman’s free-software ideology in language palatable to corporate procurement departments.
The Linux Foundation’s October 2025 survey of 851 organisations found open-source software in 55 per cent of corporate operating systems, 49 per cent of cloud and container deployments, and 46 per cent of database installations. Some 83 per cent of respondents described it as valuable to their organisation’s future; 46 per cent reported a rise in the business value derived from it over the past year. Artificial intelligence sits at the cutting edge of the trend. Thirty-eight per cent of respondents named AI as the technology that benefits most from being open source, a statistically significant five-point jump from 2024.
From bazaar to cathedral
Only 34 per cent of organisations surveyed had a defined open-source strategy; 26 per cent maintained an Open Source Program Office; 31 per cent ran automated security-testing tools against the components they pulled from public repositories. Seventy-one per cent nonetheless expected sub-12-hour support responses for production incidents, and 53 per cent wanted long-term support guarantees. Volunteer maintainers, however well meaning and motivated, cannot honour service-level agreements.
Harvard Business School’s Manuel Hoffmann, in a 2024 working paper, put the demand-side value of open-source software at 8.8 trillion US dollars (roughly what it would cost humanity to rebuild from scratch), against an estimated four billion US dollars in supply-side investment. Companies harvest enormous value from code they have not paid for; the ecosystem supplying it grows steadily more fragile. The economics of free-riding rarely reveal themselves so plainly.
In January 2025, DeepSeek, a Chinese laboratory spun out of a quantitative hedge fund, released the weights of its R1 reasoning model under an MIT licence, the most permissive available. The model rivalled OpenAI’s proprietary equivalents on benchmarks while costing a fraction to train. Other Chinese labs, Alibaba’s Qwen and Moonshot’s Kimi K2 among them, followed in quick succession. By August 2025 OpenAI itself had relented, releasing its GPT-OSS models openly while its chief executive Sam Altman conceded that the firm had been “on the wrong side of history”.
Germany’s Sovereign Tech Fund, launched in October 2022 by the Federal Ministry for Economic Affairs and Climate Action, has put more than 24 million euros into around 60 projects, including cURL, FreeBSD, GNOME, OpenSSL and PHP. Its annual budget reached 17 million euros in 2025, and the agency is now hiring a new head to scale operations up. A feasibility study published in July 2025 by OpenForum Europe, the Fraunhofer Institute and the European University Institute, commissioned by GitHub, proposes a pan-European version with a minimum 350 million euros budget drawn from the EU’s 2028-35 financial framework.
The European Cyber Resilience Act, which entered into force in December 2024 and becomes fully applicable in December 2027, will require any manufacturer placing software on the EU market to take active responsibility for the security of its open-source dependencies. Vulnerability reporting obligations kick in from September 2026. Manufacturers who fix flaws in upstream projects will be legally encouraged, under Article 13(6), to contribute those fixes back. Companies that have happily consumed without contributing will find the bill arriving in instalments.
The Open Source Security Foundation and OpenJS Foundation, in a joint statement issued shortly after the XZ disclosure, warned that compliance-conscious companies might simply offload paperwork onto people who write code in the evenings. Some maintainers have welcomed structured funding. Others share the foundations’ worry. The bazaar has acquired regulators, accountants and budget lines. New contributors have proved harder to come by.
The bazaar has become the cathedral. Whether its congregations will pay for the upkeep is the question that will define open source’s next decade.
Photo: Dreamstime.
