Open Source Is at a Crossroads  ## Metadata - Author: [[Bill Doerrfeld]] - Full Title: Open Source Is at a Crossroads - Category: #articles - Document Note: --- tags: [OpenSource, SoftwareSustainability, LicensingChanges, FundingChallenges, AI, Security] - OpenSource - SoftwareSustainability - LicensingChanges Author: Bill Doerrfeld Source: The New Stack Reference: [Open Source Is at a Crossroads](https://thenewstack.io) date created: {{date:YYYY-MM-DD}} {{time:HH:mm}} --- # Title: Open Source Is at a Crossroads ## Table of Contents: 1. [Sudden Licensing Changes](#sudden-licensing-changes) 2. [Economic Headwinds](#economic-headwinds) 3. [Operational Immaturity](#operational-immaturity) 4. [What Open Source Needs To Survive](#what-open-source-needs-to-survive) 5. [Intentional Business Strategies](#intentional-business-strategies) 6. [Case Study: AsyncAPI Initiative](#case-study-asyncapi-initiative) 7. [Case Study: Linkerd](#case-study-linkerd) 8. [Times Are A-Changin'](#times-are-a-changin) ## 📝 Summary: Open source software is facing critical challenges like sudden restrictive licensing changes, underfunded maintainers, and a rapidly evolving economic landscape. Projects like Terraform and Linkerd are moving towards more restrictive licenses, while others, like AsyncAPI, have found sustainability through foundations. Open source maintainers struggle with burnout and lack of financial support, while companies benefit without giving back. For open source to survive, collaboration, equitable funding, and new frameworks for AI and security are needed. ## 📖 Main Content: ### Sudden Licensing Changes: - **Licensing Shifts**: Popular projects like Terraform and Linkerd have moved to more restrictive licenses, causing concerns within the open source community. - **Business Interests**: Companies are looking to protect their business interests, which raises questions about the long-term viability of truly open-source software. ### Economic Headwinds: - **Impact of the Economy**: Low-interest rates fueled a boom in open source, but current economic pressures are forcing companies to reevaluate their open-source strategies. - **Abandoning Open Source**: Some companies may shift away from the open-source model as they seek to increase profits, potentially leaving smaller projects struggling. ### Operational Immaturity: - **Supply Chain Vulnerabilities**: Weak software supply chain practices, highlighted by incidents like the xz Utils hack, pose risks to open source. - **Lack of Support**: The majority of open-source projects rely on overworked, underfunded maintainers who can't always keep up with demands. ### What Open Source Needs To Survive: - **Foundation Support**: Open-source foundations like the Linux Foundation and Apache Software Foundation will play a key role in ensuring the survival of projects through governance and funding. - **Collaboration**: More collaboration is needed from companies to ensure the long-term sustainability of open-source projects, beyond just GitHub sponsors. ### Intentional Business Strategies: - **Open vs. Premium**: Open source projects need clear strategies to differentiate between what should remain free and what can be monetized as premium offerings. - **AI Frameworks**: AI presents new challenges for open source, requiring frameworks that address the openness of not just code but also datasets, model architectures, and parameters. ### Case Study: AsyncAPI Initiative: - **AsyncAPI Success**: AsyncAPI found stability by joining the Linux Foundation, receiving corporate support from Postman, and continuing to thrive in a vendor-neutral space. - **Corporate Investment**: AsyncAPI’s success highlights the importance of corporate backing for sustainable open-source development. ### Case Study: Linkerd: - **Linkerd Licensing Change**: Linkerd moved to charge for stable release artifacts while keeping open-source development alive, which led to both backlash and growth. - **Balancing Growth**: The decision to gate stable releases was driven by the need to ensure reinvestment in the project and maintain a healthier growth model. ### Times Are A-Changin’: - **Industry-Wide Struggles**: The tech industry is facing rising costs and pressures, with open source experiencing similar challenges. Companies must give back to the projects they rely on to prevent negative impacts on the broader ecosystem. ## 🗒️ Notes: - Sudden licensing changes in projects like Terraform and Linkerd reflect shifting business strategies in open source. - Open-source maintainers face burnout due to lack of funding and support, while companies benefit without contributing back. - Economic pressures are causing companies to reconsider their open-source strategies, potentially abandoning the model. - Foundations like the Linux Foundation and Apache Software Foundation are essential for ensuring long-term sustainability. - New frameworks for AI and improved security practices are crucial for adapting open-source software to modern challenges. ## 📖 References: - Bill Doerrfeld, "Open Source Is at a Crossroads," The New Stack. ## 🗣️ Paraphrase: 1. Open source software is at a critical juncture, with licensing changes, economic pressures, and maintainer burnout threatening the sustainability of many projects. 2. The economic downturn has led companies to reevaluate their use of open source, with some abandoning the model as they seek to increase profits. ## 📰 Newsletter: 💡 Open source is in a tough spot. With restrictive licensing changes, underfunded maintainers, and companies benefiting without contributing, the ecosystem faces serious challenges. Some projects, like AsyncAPI, have found stability through foundations, while others, like Linkerd, are gating features for premium users. To keep open source thriving, collaboration, funding, and new security frameworks are essential. Stay tuned for more on how the open-source community is adapting to these changes and what’s next for AI and security! ## ✅ Action Items: This article highlights the sustainability challenges that align with my advocacy for open-source maintainers and funding solutions. As someone focused on open-source contributor engagement and OSPO leadership, I can use these insights to push for more equitable business models in WordPress and other open-source projects. Addressing the funding gaps and collaboration needs within the ecosystem is critical to fostering a sustainable, inclusive open-source community. ## 🧪 Hypotheses: - Research could explore how licensing changes impact community engagement and long-term sustainability in open-source projects. - Future studies might investigate how foundations can better support the security and funding needs of key open-source projects. ### 📊 Methodology: - Conduct surveys with open-source maintainers and corporate users to evaluate the effects of licensing changes. - Analyze the financial models of foundation-supported projects to understand how they achieve sustainability. ### ❓ Questions: - How can companies and maintainers create more sustainable funding models for open-source projects? - What role should foundations play in ensuring security and sustainability across open-source ecosystems? ### 🔮 Future Research: - Explore the impact of restrictive licenses on user adoption and project health. - Investigate how AI frameworks can be adapted for more transparent and open-source-friendly development models. ### 💡 Implications: Creating sustainable funding models and improving collaboration between companies and maintainers are critical for the survival of open-source projects. Foundations will play an essential role in securing the future of the ecosystem, particularly in AI and security. ### ✅ Logical validity: The article effectively presents the challenges open-source software faces, using strong reasoning to argue for more sustainable business models and greater corporate responsibility. The case studies of AsyncAPI and Linkerd support the article’s claims about funding and licensing challenges. - **Causal Reasoning**: The connection between restrictive licensing and sustainability challenges is clear, with concrete examples to back up the claims. - **Appeal to Facts/Evidence**: The article draws from real-world cases, such as AsyncAPI’s success through foundati - Document Tags: [[ai]] [[funding]] [[open source]] [[open source corporate contribution]] [[security]] - Summary: Open source software faces challenges like funding and licensing changes, putting its sustainability at risk. Collaboration and support for open source maintainers are crucial for the future of the ecosystem. Companies need to consider giving back to the open source community to ensure its continued success. - URL: https://thenewstack.io/open-source-is-at-a-crossroads/  Open source software is having a midlife crisis. Open source contributors are struggling to keep pace. Popular open source projects are making restrictive licensing changes. [Backdoor threats](https://thenewstack.io/linux-xz-backdoor-damage-could-be-greater-than-feared/) are placing the open source supply chain in jeopardy. And, no one seems to have a clear grasp on [what “open” means in the context of artificial intelligence](https://thenewstack.io/open-source-has-a-definition-lets-get-serious-about-defending-it/). This whirlwind of challenges makes for a scary prospect if left to spiral. “The effect on our lives if open source software disappeared would be incalculable,” said [Ruth Suehle](https://www.linkedin.com/in/ruthsuehle/), an executive vice president of the Apache Software Foundation. Yet, the cracks are beginning to show in this global ecosystem, as many projects lack the basic funding to sustain the software that quite literally [runs the world](https://hbr.org/2021/09/the-digital-economy-runs-on-open-source-heres-how-to-protect-it). Like a brittle climate on the brink of collapse, there would be significant ripple effects if the life-giving waters of open source begin to dry up. “If one piece of the water cycle breaks, the well’s water won’t be replenished, and those who rely on it will suffer,” Suehle said. Yet, some open source maintainers already feel they have no choice but to reposition their software licenses to stay afloat. “Open source today is at a breaking point,” said [William Morgan](https://www.linkedin.com/in/wmorgan/), CEO of Buoyant. According to Morgan, a significant inequality has emerged between open source contributors and the companies using these projects, necessitating a change to the fundamental dynamics of the open source value chain. Others view today’s inflection point as nothing new for an industry that has weathered macroeconomic uncertainties over the decades. “These tensions pale in comparison to some of the others open source has faced in the past,” said [Dan Lorenc](https://www.linkedin.com/in/danlorenc/), founder and CEO of [Chainguard](https://www.chainguard.dev/?utm_content=inline+mention). Yet, he acknowledges the industry is currently at a major crossroads in how it thinks about and consumes open source. In this climate, other [tech leaders question](https://thenewstack.io/whats-next-for-companies-built-on-open-source/) if the open source model is still a valid business strategy. #### Sudden Licensing Changes On top of mind for most open source users is the recent slew of restrictive licensing changes for heavily used projects, including HashiCorp’s [Terraform](https://thenewstack.io/hashicorp-abandons-open-source-for-business-source-license/), [Redis](https://www.theregister.com/2024/03/22/redis_changes_license/), [Elasticsearch](https://www.itprotoday.com/hybrid-cloud/two-ways-interpreting-elastic-license-change) and Bouyant’s [Linkerd](https://thenewstack.io/buoyant-revises-release-model-for-the-linkerd-service-mesh/). “The changes of licenses in many of the large open source projects in the last year took the entire industry by surprise,” said [Nir Gazit](https://www.linkedin.com/in/nirga/?originalSubdomain=il), CEO and co-founder of Traceloop. Sudden shifts toward more restrictive licenses have users questioning the longevity of open source as a whole. “As an open source maintainer of an Apache-2.0 repository, I often hear this concern from potential users,” he said. The move toward more restrictive source code not only affects individual developer users — it impacts businesses that build around [open source projects](https://thenewstack.io/how-free-riders-make-the-musl-open-source-project-grow/). Liz Rice, who is the chief open source officer for Isovalent and a board member of the [Cloud Native Computing Foundation](https://cncf.io/?utm_content=inline+mention) and OpenUK, also considers the trend around relicensing to be a pressing challenge for open source. “While these companies have every right to protect their business interests, relicensing raises a number of questions and concerns across the ecosystem,” she said. Another ill-defined area for [open source licensing](https://thenewstack.io/how-do-open-source-licenses-work-the-ultimate-guide/) is determining what precisely constitutes open source in the realm of artificial intelligence. For instance, open language language models could be trained on proprietary assets, complicating ownership. “Open source licenses generally assume that software IP lies in source code,” said Neo4j’s CTO [Philip Rathle](https://twitter.com/prathle). “AI shifts this upstream.” The donation jar isn’t working for open source. The big problem with the open source model is that the vast majority of organizations who freely use these projects [don’t actively contribute back](https://cloudnativenow.com/features/why-cloud-native-companies-should-support-open-source/) to them, either financially or through code commits. Instead, they are more likely to request bug fixes or extensions, putting undue pressure on maintainers to work without pay. As Morgan described, “Open source has become, as Bruce Perens puts it, a ‘[great corporate welfare program](https://www.itpro.com/software/open-source/bruce-perens-open-source-licenses-arent-working-but-we-can-fix-them),’ where the beneficiaries are companies like [Google](https://cloud.google.com/?utm_content=inline+mention), [Microsoft](https://news.microsoft.com/?utm_content=inline+mention), [Amazon](https://aws.amazon.com/?utm_content=inline+mention), and Apple, who get to build billion-dollar revenue streams on the backs of open source, and the charity workers are the maintainers and engineers developing the projects.” People also don’t often realize that community management for open source projects is a full-time job, said AsyncAPI Initiative founder [Fran Mendez](https://www.linkedin.com/in/fmvilas/?originalSubdomain=es). This encompasses tasks beyond the code, like design, technical writing, marketing, responding to disputes and upkeeping a code of conduct. Money is required to support these initiatives, but the project stewards are rarely sustainably funded. Consider the case of Lightbend, which recently altered the open source license for Akka, an SDK for distributed applications. As [Tyler Jewell](https://www.linkedin.com/in/tylerjewell/), CEO of Lightbend explained, after 13 years, the team could no longer maintain the software without equitable contributions from the nearly 100,000 commercial organizations using it. “We altered our license model to enable us to better sustain the maintenance and improvement of the project while still making it freely available to the vast majority of developers.” #### Economic Headwinds [Struggles in open source communities](https://thenewstack.io/3-ways-to-help-struggling-open-source-communities/) undoubtedly stem from the greater economic climate. The start of the current decade saw a low interest rate environment, which Lorenc credits as ushering in a massive boom in the number of open source companies and projects. But now, we are experiencing significant realignment. “Time and money are even more scarce, making it harder for contributors or companies to allocate resources,” he said. “Many, but not all, open source businesses are at a crossroads,” said [Fermyon](https://www.fermyon.com/?utm_content=inline+mention) CEO [Matt Butcher](https://www.linkedin.com/in/mattbutcher/). For ages, the theory was that you built an open source tool, established a community and then figured out how to monetize it. But now, the companies in that final stage are under immense pressure to increase profit, he said. “For some, that means abandoning the open source model.” A lack of resources to justify open source may also stem from a “plethora of riches” problem, explains [Chris Aniszczyk](https://www.linkedin.com/in/caniszczyk/), the chief technology officer of CNCF. With so many projects vying for attention, it’s easier than ever for innovative projects to lose out on the resources they require. “As an industry, we should consider focusing our efforts on identifying and sustaining the critical open-source projects out there,” he said. #### Operational Immaturity It’s not just business sustainability qualms that threaten [open source — immature software supply chain management](https://thenewstack.io/effective-strategies-for-open-source-supply-chain-management/) practices do as well. “Wildly adopting projects without care or thought on how to maintain or secure them just delays the inevitable pain, and we’re facing that today,” explains Lorenc. For instance, cyberthreats are exposing the vulnerabilities inherent in modern software solutions, which [the Linux Foundation](https://www.linuxfoundation.org/blog/blog/a-summary-of-census-ii-open-source-software-application-libraries-the-world-depends-on) estimates are comprised of 70%-90% free and open source software. One recent damming exploit involved attackers contributing malicious commits to [xz Utils](https://arstechnica.com/security/2024/04/what-we-know-about-the-xz-utils-backdoor-that-almost-infected-the-world/), a ubiquitous open source compression tool in Linux. #### What Open Source Needs To Survive First and foremost, experts agree that open source foundation bodies like The Linux Foundation and the Apache Software Foundation will play a pivotal role in stabilizing the future of open source. “The path we take from this crossroads is likely to involve more projects contributed to foundations,” said Rice. Such bodies can guide open governance and set rules to prohibit relicensing, giving developers more reassurance in integrating projects into their software. Secondly, open source software maintainers will require more support in terms of funding and active contributions to sustain their projects. “Much of what we need now is not a technical solution, it’s collaboration,” Suehle said, “especially from organizations that rely on open source.” According to Aniszczyk, this collaboration must go beyond GitHub sponsors and donation platforms, which effectively turn maintainers into [gig economy workers](https://www.linkedin.com/pulse/troubles-open-source-gig-economy-sustainability-tip-jar-aniszczyk). Mendez proposes a future model wherein Open Collective enables more of a Stripe-like checkout experience for certain add-on features. ##### Intentional Business Strategies Not everything needs to be open sourced. As such, a more sustainable open source ecosystem will hinge on carefully determining what should be free and open and what deserves to be premium. For Butcher, a good rule of thumb is to open source the technologies individual developers need while gating premium features that are useful only for large deployments or organizations. The traditional open source definition doesn’t mesh well with the rapidly evolving world of AI. “We need a new framework that accommodates all of these nuances,” said Rathle. He highlights the work of [GenAI Commons](https://genaicommons.org/) and the importance of new licenses that gauge the [openness of all components](https://arxiv.org/abs/2403.13784) within an AI model, such as the foundational datasets, preprocessing code, model architecture and model parameters. “Security can’t be an afterthought anywhere in the industry, but this applies particularly strongly to open source, where fragmented communities of paid contributors and volunteers alike operate autonomously,” said Lorenc. Memory-safe languages and secure-by-default settings can go a long way toward eliminating the bulk of bugs and attack vectors, he said. Better inventory management using SBOMs and vulnerability scanners will also be key to safeguarding open source software. #### Case Study: AsyncAPI Initiative One example of a community-led and sustainable open source initiative is [AsyncAPI](https://www.asyncapi.com/en). AsyncAPI was founded in 2016 to define an open standard specification for messaging APIs. As [Mendez describes](https://www.youtube.com/watch?v=28cKNSsFFU0&ab_channel=AsyncAPI), AsyncAPI became more than a side project when he realized Slack was actively implementing it in production. As adoption and community support for AsyncAPI grew, corporations tried to buy up the intellectual property. Yet, [in 2021](https://www.linuxfoundation.org/press/press-release/linux-foundation-will-host-asyncapi-to-support-growth-and-collaboration-for-industrys-fastest-growing-api-spec), the community donated the project to the [Linux Foundation](https://training.linuxfoundation.org/training/course-catalog/?utm_content=inline+mention), safeguarding the technology and its governance as a vendor-neutral initiative. Mendez then got a job at Postman, which has been funding his full-time work on AsyncAPI with no strings attached. “We are fricking lucky,” he said. Such a situation is rare, which is why he believes more [companies should invest in employing people to support open source](https://thenewstack.io/non-contributing-developers-expect-companies-to-support-open-source/) full time. #### Case Study: Linkerd However, not all open source projects can source equitable funding this way, especially when a single company is at the helm of nearly all development. Consider [the recent evolution](https://www.sdxcentral.com/articles/news/linkerd-leaves-open-source-behind-to-fund-innovation/2024/02/) around [Linkerd](https://linkerd.io/), the popular lightweight cloud native service mesh. “We made a decision earlier this year with Linkerd to stop building open source stable release artifacts, and to start charging money for proprietary stable release artifacts instead,” describes Bouyant’s Morgan. Interestingly, the move is in line with the [rules for CNCF-graduated projects](https://www.tildee.com/understanding-the-implications-of-linkerds-new-licensing-model-and-the-role-of-cncf/), as they do not mandate stewards to issue new builds. Although the decision to gate stable releases for premium payers sparked outrage among some open source zealots, Morgan says it was necessary to strike a healthier balance. “As a result, Linkerd has been healthier and faster-growing than ever, and our ability to reinvest in the project has increased exponentially.” #### Times Are A-Changin’ Although budgetary struggles are a top challenge in the open source ecosystem, they are not exclusive to this area, as belt-tightening and [layoffs](https://www.npr.org/2024/01/28/1227326215/nearly-25-000-tech-workers-laid-off-in-the-first-weeks-of-2024-whats-going-on) have been playing out throughout the tech industry in recent years. Organizations are also facing rising [cloud native costs](https://leaddev.com/tech/ai-and-kubernetes-are-pushing-cloud-costs-out-control) and an urge to [streamline developer productivity](https://devops.com/can-improving-developer-experience-actually-reduce-costs/) to cut costs. “The overall software industry is facing a set of challenges I liken to a ‘hangover’ after years of carefree adoption,” added Lorenc. But, given how pervasive open source software is, fractures in this ecosystem are cause for concern. If more projects fall off the wayside, it could have detrimental effects across the board. As such, companies should be aware of the open source they are using and consider how they can give back. “Collaboration in open source across our projects, foundations, nationalities, and employers is critical to the entire world, whether it’s contributions of time, money, skills, or other resources,” Suehle said. The thing is, many maintainers have made calls for collaboration, yet they still lack an equitable exchange with consumers. This situation could stifle early-stage innovators, forcing many to rethink the open source software model entirely. As Rice said, “Startups may struggle to develop and protect their own intellectual property as a competitive edge in an environment where everyone looks less favorably on non-foundation open source projects.” That said, the open source software ecosystem is vast, and certain areas are experiencing positive growth. “Open source is thriving in both letter and spirit,” said Rathle, who points to the excitement around open source AI. Such excitement and development could inspire a new age of open source creators — hopefully, with the support they deserve. [Tech moves fast, don't miss an episode. Subscribe to our YouTube channel to stream all our podcasts, interviews, demos, and more.](https://youtube.com/thenewstack?sub_confirmation=1), Open Source Is at a Crossroads, Bill Doerrfeld, 01hxadcj316rnvc8pn8kryb0bb.