The History of Open Source

From Richard Stallman's printer frustration to billion-dollar acquisitions, the open source movement reshaped how software is built, shared, and monetized.

A Printer Started It All

The story of open source begins, improbably, with a jammed printer. In the late 1970s at MIT's AI Lab, Richard Stallman wanted to modify the software on a Xerox 9700 laser printer so it would notify users when their print jobs were done or when the printer jammed. Xerox refused to share the source code. This small corporate decision, perfectly reasonable from Xerox's perspective, planted a seed of outrage that would grow into a global movement.

Stallman had grown up in a culture of sharing code. At the AI Lab, software was communal property. Programmers improved each other's work freely. The idea that someone could lock away source code felt like a betrayal of how computing was supposed to work. In 1983, Stallman announced the GNU Project, aiming to create a complete free operating system. In 1985, he founded the Free Software Foundation and wrote the GNU General Public License, which used copyright law as a weapon for sharing: you could use, modify, and distribute GPL software freely, but any derivative work had to carry the same license.

Free Software vs. Open Source

Stallman's philosophy was explicitly moral. Software should be free (as in freedom, not price) because restricting it harmed society. This message resonated with idealists but alienated businesses. By the mid-1990s, free software was technically impressive (GCC, Emacs, and most of GNU existed) but commercially marginal.

Then came Linux. Linus Torvalds started writing his kernel in 1991 as a hobby project, announcing it on a Usenet newsgroup with characteristic modesty: "I'm doing a (free) operating system (just a hobby, won't be big and professional like gnu)." Combined with GNU's userland tools, Linux became a complete, free operating system. It spread rapidly through universities and then into server rooms.

In 1997, Eric S. Raymond published "The Cathedral and the Bazaar," contrasting top-down software development (the cathedral) with the distributed, organic process that produced Linux (the bazaar). The essay was influential. Netscape, struggling against Microsoft's Internet Explorer, decided to release its browser's source code. In 1998, a group including Raymond, Bruce Perens, and Tim O'Reilly coined the term "open source" to rebrand free software in business-friendly language.

Stallman hated it. "Open source" dropped the ethical dimension he considered essential. The split between "free software" (Stallman's camp) and "open source" (the pragmatists) persists to this day. They agree on most practical matters but disagree about why sharing code matters.

The Enterprise Warms Up

Red Hat, founded in 1993, proved that open source could be a business. You gave away the software and sold support, training, and certification. IBM's 2000 announcement that it would invest $1 billion in Linux was a watershed moment. Suddenly, open source was not a hippie movement. It was a strategic choice made by the world's largest technology companies.

Apache had already conquered the web server market. MySQL and PostgreSQL offered free alternatives to Oracle. The LAMP stack (Linux, Apache, MySQL, PHP/Perl/Python) became the default platform for web development in the 2000s. Startups could launch products without paying for operating systems, web servers, or databases. The economics of software changed permanently.

GitHub and the Social Coding Revolution

Git, created by Linus Torvalds in 2005 after a licensing dispute with BitKeeper, made distributed version control practical. GitHub, launched in 2008, made it social. Pull requests, issues, and forks lowered the barrier to contribution dramatically. A developer in Lagos could fix a bug in a library maintained in Berlin, and the entire process could happen asynchronously through a web browser.

GitHub became the resume, the portfolio, and the collaboration platform for an entire generation of developers. Microsoft's acquisition of GitHub in 2018 for $7.5 billion would have been unthinkable a decade earlier, when Microsoft's Steve Ballmer called Linux "a cancer." The acquisition signaled that open source had won, at least in terms of developer mindshare.

The Corporate Open Source Playbook

By the 2010s, major technology companies had developed sophisticated strategies for open source. Google open-sourced Kubernetes, TensorFlow, Angular, and Go, establishing itself as the center of gravity for cloud-native and machine-learning ecosystems. Facebook released React, PyTorch, and GraphQL, becoming the reference point for frontend development and AI research. Microsoft, once open source's fiercest opponent, open-sourced VS Code, TypeScript, and .NET, and acquired GitHub for $7.5 billion.

These companies did not release software out of altruism. Open-sourcing a project creates an ecosystem around the company's technology, making it the de facto standard. It attracts talent (developers want to work on popular open source projects). It commoditizes competitors' advantages (if the database layer is free, competition moves to the services layer, where the open-sourcing company has advantages). And it distributes the maintenance burden: community contributors fix bugs, add features, and port to new platforms at no cost to the sponsoring company.

The strategy works best when the open source project promotes usage of the company's paid services. Kubernetes is free, but running it at scale is complex, which drives adoption of Google's managed Kubernetes service (GKE). TensorFlow is free, but training large models requires compute, which drives usage of Google Cloud's TPUs. The open source project is the on-ramp to the commercial product.

Amazon Web Services became the most controversial player in this dynamic. AWS took popular open source databases (Elasticsearch, Redis, MongoDB) and offered them as managed services, capturing revenue without contributing proportionally to the projects. Elastic, Redis Labs, and MongoDB responded by changing their licenses to restrict cloud providers. The Server Side Public License (SSPL), adopted by MongoDB, requires anyone offering the software as a service to open-source their entire stack, a condition designed to be unacceptable to cloud providers.

The Sustainability Crisis

The economic model of open source has a structural flaw: the people who maintain critical infrastructure are often unpaid or underpaid. The OpenSSL project, which secures the majority of the internet's encrypted traffic, was maintained primarily by two people with a budget of approximately $2,000 per year when the Heartbleed vulnerability was discovered in 2014. The bug affected an estimated 500,000 websites and cost the industry billions in remediation.

Core-js, a JavaScript polyfill library used by virtually every major website, was maintained primarily by a single developer, Denis Pushkarev, who posted publicly about his financial struggles and eventually served prison time in Russia for an unrelated incident. The library continued to be depended upon by millions of projects despite having essentially no active maintenance.

The Log4Shell vulnerability in December 2021, a critical remote code execution flaw in Apache Log4j, was the clearest illustration of the problem. Log4j was used by virtually every Java application in production, including those at Apple, Amazon, Cloudflare, and Twitter. The vulnerability was discovered, patched, and disclosed within days, but the maintainers were volunteers working without compensation on a project that Fortune 500 companies depended on for their infrastructure.

In response, initiatives like GitHub Sponsors, Open Collective, and Tidelift have created mechanisms for funding open source maintainers. The Linux Foundation and Apache Software Foundation provide organizational infrastructure for major projects. But the fundamental asymmetry remains: companies capture billions in value from open source software while the maintainers often receive nothing.

Licenses and the Freedom Spectrum

Open source licenses exist on a spectrum from permissive to copyleft. Permissive licenses (MIT, BSD, Apache 2.0) allow almost unlimited use, including incorporation into proprietary products. Copyleft licenses (GPL, LGPL, AGPL) require that derivative works be distributed under the same license, ensuring that improvements remain open.

The license choice reflects philosophical priorities. The MIT license says "do whatever you want." The GPL says "you can do whatever you want, but you must share your modifications." The AGPL extends this to network use: if you modify AGPL software and run it as a web service, you must publish your modifications, even though you are not distributing the software in the traditional sense.

The trend since 2010 has been toward permissive licensing. The majority of new open source projects choose MIT or Apache 2.0. The reasons are pragmatic: permissive licenses have lower adoption friction (lawyers are less nervous), and they align with the corporate open source playbook of building ecosystems rather than protecting code.

This trend concerns free software advocates. Permissive licenses allow companies to take open source code, improve it, and sell the improved version without sharing the improvements. The most commercially successful software in history is built on permissive open source foundations (macOS on BSD, Android on Linux with permissive userland), and the improvements Apple and Google made are largely proprietary.

The Corporate Open Source Playbook

By the 2010s, major technology companies had developed sophisticated strategies for open source. Google open-sourced Kubernetes, TensorFlow, Angular, and Go, establishing itself as the center of gravity for cloud-native and machine-learning ecosystems. Facebook released React, PyTorch, and GraphQL, becoming the reference point for frontend development and AI research. Microsoft, once open source's fiercest opponent, open-sourced VS Code, TypeScript, and .NET, and acquired GitHub for $7.5 billion.

These companies did not release software out of altruism. Open-sourcing a project creates an ecosystem around the company's technology, making it the de facto standard. It attracts talent (developers want to work on popular open source projects). It commoditizes competitors' advantages (if the database layer is free, competition moves to the services layer). And it distributes the maintenance burden: community contributors fix bugs, add features, and port to new platforms at no cost to the sponsoring company.

The strategy works best when the open source project promotes usage of the company's paid services. Kubernetes is free, but running it at scale is complex, which drives adoption of Google's managed Kubernetes service (GKE). TensorFlow is free, but training large models requires compute, which drives usage of Google Cloud's TPUs and GPUs. The open source project is the on-ramp to the commercial product.

Amazon Web Services became the most controversial player in this dynamic. AWS took popular open source databases (Elasticsearch, Redis, MongoDB) and offered them as managed services, capturing revenue without contributing proportionally to the projects. Elastic, Redis Labs, and MongoDB responded by changing their licenses to restrict cloud providers. The Server Side Public License (SSPL), adopted by MongoDB, requires anyone offering the software as a service to open-source their entire operational stack, a condition designed to be unacceptable to cloud providers.

The Sustainability Crisis

The economic model of open source has a structural flaw: the people who maintain critical infrastructure are often unpaid or underpaid. The OpenSSL project, which secures the majority of the internet's encrypted traffic, was maintained primarily by two people with a budget of approximately $2,000 per year when the Heartbleed vulnerability was discovered in 2014. The bug affected an estimated 500,000 websites and cost the industry billions in remediation.

The Log4Shell vulnerability in December 2021, a critical remote code execution flaw in Apache Log4j, was an even clearer illustration. Log4j was used by virtually every Java application in production, including those at Apple, Amazon, Cloudflare, and Twitter. The maintainers were volunteers working without compensation on a project that Fortune 500 companies depended on for their critical infrastructure.

In response, initiatives like GitHub Sponsors, Open Collective, and Tidelift have created mechanisms for funding open source maintainers. The Linux Foundation and Apache Software Foundation provide organizational infrastructure for major projects. Google's Open Source Security Team (OSST) and the OpenSSF (Open Source Security Foundation) fund security audits of critical projects. But the fundamental asymmetry remains: companies capture billions in value from open source software while the maintainers often receive little or nothing.

Licenses and the Freedom Spectrum

Open source licenses exist on a spectrum from permissive to copyleft. Permissive licenses (MIT, BSD, Apache 2.0) allow almost unlimited use, including incorporation into proprietary products. Copyleft licenses (GPL, LGPL, AGPL) require that derivative works be distributed under the same license, ensuring that improvements remain open.

The license choice reflects philosophical priorities. The MIT license says: do whatever you want. The GPL says: you can do whatever you want, but you must share your modifications. The AGPL extends this to network use: if you modify AGPL software and run it as a web service, you must publish your modifications, even though you are not distributing the software in the traditional sense.

The trend since 2010 has been toward permissive licensing. The majority of new open source projects choose MIT or Apache 2.0. The reasons are pragmatic: permissive licenses have lower adoption friction (corporate lawyers are less nervous), and they align with the corporate open source playbook of building ecosystems rather than protecting code.

The Complicated Present

Today, nearly all software is built on open source foundations. Even proprietary products depend on open source libraries, frameworks, and tools. Cloud providers run on Linux. Mobile apps use open source networking libraries. Machine learning models are trained with open source frameworks. The question is no longer whether to use open source, but how to use it responsibly.

Companies have adopted open source strategically, sometimes controversially. "Open core" models offer a free open source base with proprietary premium features. HashiCorp's 2023 decision to move Terraform from the Mozilla Public License to the Business Source License (BSL), restricting competing commercial offerings, prompted a community fork (OpenTofu) and reignited the debate about corporate stewardship of open source projects.

The tension Stallman identified in the 1980s has not gone away. It has just gotten more complicated. Open source won the technical argument. The ethical and economic arguments remain unresolved.

Key Takeaways

The Complicated Present

Today, nearly all software is built on open source foundations. Even proprietary products depend on open source libraries, frameworks, and tools. But the economics remain challenging. Maintainers of critical infrastructure projects often work for free, leading to burnout and security vulnerabilities. The Log4j crisis in 2021 exposed how a single under-resourced open source library could threaten global infrastructure.

Companies have adopted open source strategically, sometimes controversially. "Open core" models offer a free open source base with proprietary premium features. Cloud providers have been accused of free-riding by offering hosted versions of open source databases without contributing back. In response, some projects adopted licenses like the Server Side Public License (SSPL) that restrict cloud hosting.

The tension Stallman identified in the 1980s has not gone away. It has just gotten more complicated. Open source won the technical argument. The ethical and economic arguments remain unresolved.