Open Source Is Dead. Long Live Open Source.

A fable, first.

In a certain kingdom there was a well that never ran dry. Nobody owned it. A gardener had dug it long ago because his own field was thirsty, and once it was dug, he saw no reason to fence it. Travelers drank. Farmers drank. In return they did small things: one patched the stones, one carved a better bucket, one sat by the well on hot days and told newcomers which rope frayed and which held. The kingdom grew rich on that water, and the arrangement was so old that people forgot it was an arrangement at all. They thought it was geography.

Then the kingdom built machines that could drink. The machines came at night, in numbers, with a thousand mouths. They never patched a stone. They never carved a bucket. They never sat and talked. One morning the gardener came to the well and found the water level unchanged — the well never ran dry, remember — but the path to it empty of people, and he stood there wondering what, exactly, he had been tending all these years.

It was never the water. It was the path.

The king is dead

When the old cry rang out in European courts — the king is dead, long live the king — it wasn't a contradiction. It was a legal trick. The crown must never touch the ground; the instant one king dies, the next already reigns. Say both sentences fast enough and there is no gap for chaos to crawl through.

I want to say both sentences about open source. But honesty requires sitting with the first one for a while, because something really has died, and it had a face. Several faces, actually.

Start with Lasse Collin. For over a decade he maintained xz Utils — a compression library so deep in the plumbing of Linux that you've used it if you've ever touched a server, which is to say, if you've ever touched the internet. He did this unpaid, as a hobby, while telling people on his mailing list, apologetically, that he didn't even turn his computer on every day. He was tired. So when a friendly, patient, technically excellent contributor named "Jia Tan" showed up and offered to share the load, Collin did the sane human thing and said yes. It took the attacker roughly two and a half years of trust-building before slipping a backdoor into the build process in early 2024 — one that, had a Microsoft engineer not noticed half a second of odd SSH latency, would have handed its creators what one researcher called a master key to hundreds of millions of machines. The postmortems all converged on the same uncomfortable finding: the exploit wasn't really in the code. It was in the loneliness. One exhausted volunteer, carrying infrastructure-grade responsibility with hobby-grade support, and no mechanism anywhere in the system to notice he was drowning.

Now Daniel Stenberg. He has maintained cURL — the tool that moves data for practically every connected device on Earth — for twenty-eight years. This January he shut down cURL's bug bounty program after six years and $90,000 paid out for 81 real vulnerabilities. The reason was not a lack of reports. It was a flood of them: AI-generated security reports, confident and hollow, arriving faster than seven humans could debunk them. Until early 2025, roughly one report in six was real. By late 2025 it was one in twenty or thirty. In six years, per Stenberg's own accounting, AI-generated submissions found exactly zero genuine vulnerabilities — while consuming the team so thoroughly that at FOSDEM 2026 he described it as "terror reporting," noise calibrated to bury the signal. Around the same time, Jeff Geerling gave the mood its bluntest headline yet: AI is destroying open source, and it's not even good at it yet.

And behind these two men, a quieter structural death. Julien Danjou describes it as a flywheel running in reverse. For thirty years the deal was: you share a library, people use it, and using it touches you — they read your docs, file your bugs, star your repo, occasionally send money, occasionally send love. Reputation and feedback flowed back and made the sharing worth it. Now an AI agent assembles a project from a dozen libraries and none of those maintainers see a docs visit, an issue, or a human being. The code still flows out. Nothing flows back. And when the maintainer quits, the developer downstream doesn't fork the project — they ask the AI to regenerate the functionality from scratch, and that generated code is never shared with anyone. Nadia Eghbal had already documented, back in Working in Public, that consumers outnumbered contributors thousands to one. AI didn't start the extraction. It just removed the last human friction that made extraction feel like membership.

That's the king lying in state: the gift economy. The specific, fragile, gloriously irrational arrangement in which strangers gave software away and the giving was repaid in attention, gratitude, and the occasional patched stone. The machines drink now. The path to the well is empty.

Long live the king

Here is what makes the eulogy premature: while the volunteers were burning out, open source itself was quietly being crowned as something else — and the coronation had witnesses.

Consider the strangest reversal of 2025. In March 2024, Redis — one of the most beloved pieces of infrastructure ever written — abandoned its open source license for "source-available" terms, betting it could force the cloud giants to pay. The community's answer was swift and institutional: a fork called Valkey, taken up under the Linux Foundation and backed by AWS, Google, and Oracle, which promptly started outperforming the original in independent benchmarks. Fourteen months later Redis folded. Its creator, Salvatore "antirez" Sanfilippo — who had rejoined the company and lobbied from inside — announced Redis 8 under the OSI-approved AGPLv3, writing that writing anything other than open source software was simply not in him. The company's own CEO conceded that the source-available experiment had failed to win community acceptance. Elastic had already walked the same road back a year earlier.

Read that story cynically if you like — Dirk Riehle does, classifying these AGPL returns as "triple licensing," a strategy for buying back goodwill, and OpenUK's Amanda Brock says the community is growing weary of welcoming prodigal children home. Fine. But notice what the cynical reading concedes: openness is now so commercially valuable that a company reversed its own strategy to reclaim the word. And notice the mechanism that forced the reversal. Not a boycott. Not a flame war. A fork under neutral foundation governance — a repeatable, almost boring institutional playbook (Valkey, OpenTofu, OpenBao) that gives the community a permanent credible threat. One analyst drew the practical moral: a project's governance structure is now a legitimate procurement criterion. The gift economy defended itself with lawyers and foundations. The old king would not have recognized his heir. The heir is winning anyway.

And the kingdom, measured coldly, has never been larger. The Linux Foundation's 2025 survey finds open source has graduated from cost-saving trick to the mission-critical backbone of enterprise infrastructure — with 71% of organizations now expecting sub-12-hour support response times, which tells you they've stopped thinking of it as free-as-in-puppy. Perforce and the OSI report that 96% of organizations increased or maintained their open source use this past year. Nobody adopts a corpse at those rates.

The crown changed shape

There's one more turn, and it's the one the fable can't quite hold: the succession crisis isn't only about who wears the crown. It's about what the crown is.

The most consequential "open source" artifacts of this decade are AI models, and almost none of them are open source. The Open Source Initiative drew the line in October 2024 with its Open Source AI Definition: to qualify, a model must ship weights, training code, and enough data information to rebuild it — freedom to study and reproduce, not just to run. By that standard, Llama is not open source (the OSI and FSF both note its license discriminates by user and use, including a clause letting Meta refuse the largest deployers), DeepSeek is not open source, Qwen is not open source. They are open weights: you get the baked cake, not the recipe. The models that actually meet the definition — OLMo, Pythia — are the ones you've never seen top a leaderboard.

And yet the gravitational pull of the word is astonishing. OpenAI — the company whose name became an industry punchline for closedness — shipped GPT-OSS under Apache 2.0 in August 2025, with Sam Altman admitting the company had been "on the wrong side of history" about openness. Everyone wants to be crowned open. Nobody wants to govern openly. That gap between the word and the practice is where the next decade's fights will happen — some are already proposing new vocabulary entirely, like Alfonso de la Rocha's "open execution", on the theory that when AI can regenerate any codebase from a description, what needs to be open isn't the source at all.

Succession, or usurpation?

Back at the well, the gardener did not fill it in. He did something stranger. He formed a guild with the neighboring villages, wrote down the rules of the water for the first time in anyone's memory, hired a keeper, and charged the machine-owners for the road their machines had worn. Travelers still drank free. The water was the same water. And on quiet evenings the gardener would stand there and honestly could not tell you whether the well had been saved or replaced — whether this was his well grown up, or a new thing wearing its name.

That's where I land, and I think anywhere more comfortable would be dishonest. The open source that died was a relationship: hobbyist, human, sustained by attention flowing back to the people who gave. Lasse Collin's open source is dead, and we should say so plainly, because pretending otherwise is how we get the next xz. The open source being crowned is an institution: foundation-governed, copyleft-armored, enterprise-funded, fluent in procurement — durable in ways the gift economy never was, and colder in ways it never had to be.

The old royal cry worked because it refused to let the crown touch the ground. Ours should too. The values — the right to read, to change, to share, to not be locked in — must not touch the ground between one embodiment and the next, even if the next embodiment files quarterly reports and the one after that might not involve source code at all.

The king is dead. Long live the king. Just don't expect him to look like his father.

Sources

• Julien Danjou, "Open Source Is Getting Used to Death" — the reversed flywheel; Eghbal's contributor ratios; the Koren et al. "Vibe Coding Kills Open Source" model.
• "The Siege of Open Source" — Stenberg's cURL bug-bounty shutdown and FOSDEM 2026 talk; Geerling's essay; paid vs. unpaid maintainer security statistics.
• "Wolves in the Repository" (arXiv 2504.17473) and Cloud Odyssey on the xz backdoor — the CVE-2024-3094 timeline, Lasse Collin, and burnout-as-attack-surface.
• a16z, "Et Tu, Agent?" — modern npm supply-chain attacks and slopsquatting.
• The Register, Redis returns to open source with AGPL; InfoQ and Kuray Karaaslan on the reversal and antirez's return; DSA Research on Valkey and governance-as-procurement; Redis's own announcement.
• Dirk Riehle on triple licensing; Computing.co.uk for Amanda Brock's skepticism.
• Linux Foundation, State of Global Open Source 2025; OSI / Perforce 2025 State of Open Source Report — adoption and enterprise-expectation data.
• Let's Data Science and GEO Toolbox on OSAID 1.0 and open weights vs. open source; FabriXAI on GPT-OSS and Altman's admission.
• Alfonso de la Rocha, "Open Source is Dead. Long Live Open Execution" — an adjacent coinage that makes a similar move.