Transcription
On March 29, 2024, a single person accidentally discovered that practically the entire internet had been standing on the brink of disaster three weeks prior. Andreas Freund, a Microsoft developer, was surprised that logging into one of his servers took half a second longer than usual. He investigated the matter, and what he found was a state-sponsored backdoor into a tiny open-source program called XZ Utils. Had this attack not been discovered, the attackers could have accessed a large portion of the world's servers – banks, hospitals, governments, power grids, you name it. And the craziest thing about the whole situation isn't the attack itself, but the question of how it was even possible. The answer comes immediately, but it's a bit darker than you might think, and it has something to do with the fact that the internet, on which you are currently watching this video, is being kept alive by a handful of exhausted people who are paid nothing and are on the verge of giving up. Most of you have probably never written a line of code in your lives, and that's perfectly fine, because you still interact with this world every day without realizing it. Estimates vary depending on the study, but they all fall within a range that leaves very little room for maneuver. About 96% of all commercial software products contain open-source components, and between 70% and 90% of the code shipped worldwide is open-source. This applies to your banking app just as much as to YouTube, to the software in your car, and to the system your employer uses for accounting. Open source simply means that the source code of a program is publicly accessible, so that anyone can read, review, and also use it. What is often misunderstood here, because YouTube is obviously not open-source itself, is that individual components can also be open-source. Here, for example, PlayStation lists all the open-source products it uses on the PlayStation. Probably 99% of the world has never heard of most of them, but PlayStation wouldn't function without them. And the games then have their own, often listed in the credits. Perhaps you've seen them before. This all sounds harmless at first, but it's precisely from this principle that the digital world we know today emerged. When you send a message via WhatsApp, it runs on Linux servers. That's open-source. When you open a website, it's very likely that Tailwind or a similar open-source tool is involved somewhere. When your computer establishes a secure connection, it runs via OpenSSL. All of this is open-source. It's everywhere in the background, without you noticing. And this is precisely the point where the story from the beginning suddenly becomes very personal. This one software, in which the backdoor was discovered, was maintained by a single person. His name is Lasse Collin. He did this in his free time and without pay. And two years before the attack, he had openly written in an email that his capacity to care for the project had become very limited. It was precisely into this gap of exhaustion that the attacker squeezed in, offered himself as a helpful contributor for months, and ultimately installed the backdoor. A half-second delay prevented this attack from being truly successful, but the next loophole might not end so favorably. I myself have been maintaining several such open-source projects for several years, and I'm not telling you this out of purely academic interest, but because I feel every day what is actually breaking down there, both as a user, as a maintainer, and as a developer. And the real problem isn't that open-source doesn't make money. That hasn't really been the honest problem for decades. The real problem is something else, something that has only truly existed for two years and is currently becoming the biggest structural threat to essentially the entire digital world, and well, we'll just ignore the question again. What makes the whole thing so strange is that we are actually in the most productive phase of software development ever. At Google, over a quarter of all new lines of code are now written by AI, briefly reviewed by humans, and then adopted. At Anthropic, the company behind Claude, CEO Dario Amodei says that depending on the project, between 70% and 90% of the code is written by Claude. On GitHub, the largest platform for programmers, about 30% of all new features come from an AI model, and the tools are naturally getting better week by week. We all feel this. So, this should actually be the golden age for open-source. We have more tools, more speed, more possibilities than ever before, and yet the foundation on which everything is built is currently completely crumbling. The question is, why actually? To understand this, we need to talk briefly about what open-source actually is, beyond that superficial definition from the beginning. Open-source works on a principle that in economics is called a self-reinforcing cycle. And it is precisely this principle that is the reason why this entire movement has grown so incredibly over the last 30 years. Consider the following scenario: Someone writes a small program that solves a very specific problem. Let's just say a function that formats dates cleanly in different languages. As soon as this program exists and is freely available, the next developer can simply use it instead of having to solve the same problem themselves again. They can thus invest their energy in something else, perhaps in a program that combines this date formatting with calendar functions. This new program, in turn, makes it easier to build an application that used to take weeks and might now be finished over the weekend. This means that software builds on software, and the more software there is, the cheaper and faster it becomes to write new software, which in turn leads to more people being able to write software, which leads to even more building blocks, and all of this makes itself cheaper overall. This cycle is what has made Linux, the entire modern web, almost the entire cloud infrastructure possible in the first place. It is also what most people are not aware of when they talk about open-source, because they tend to see it as a matter of idealism or hobby. In reality, it is actually a matter of economies of scale, and it is precisely these economies of scale that are now reversing. When you tell people that open-source is doing badly, almost the same answer always comes back, namely that the developers just don't make money and that this can't go on forever. This is not wrong in itself, because according to a recent survey, six out of ten open-source maintainers describe themselves as unpaid hobbyists, and half cite lack of payment as the main burden. These are tough numbers, and they have remained very stable over the past few years. But the money problem is not new. It existed in 2015, it existed in 2018, and of course in 2022. And yet open-source has continued to explode during this time. What has changed is not the money. What has changed is rather subtle. Something that many developers have only truly felt for one to two years, often without being able to pinpoint it exactly. And to understand what this is, we need to look at a specific case that makes the entire mechanism very clear with an example. But before we get there, I want to show you something that I have at home myself and that actually fits the topic very well, because it's also about systems that work quietly in the background without you having to constantly think about them. And that is Ecoflow Oasis, their smart energy management system. If you have a dynamic electricity tariff, like Tibber or similar, then your electricity price fluctuates considerably throughout the day. At night or at noon, when there is a lot of wind and sun in the grid, electricity becomes very cheap. At 7 PM, when everyone comes home and cooks, it becomes very expensive. What many people don't even know, by the way, is that the electricity price can even become negative if so much energy flows into the grid that the providers have to get rid of it. Look at this screenshot from recently, I got paid 39 cents per kilowatt-hour. So the electricity provider paid me to take electricity. And this is exactly where Oasis comes in, because the system analyzes the electricity price trends for the coming days and automatically decides on that basis when to store energy and when to feed it back into the house. In addition, there is a solar forecast that also estimates how much energy will come in tomorrow, and both are reconciled with your actual consumption. So you don't have to deal with tariff logic or check the app daily, Oasis does it all automatically in the background. And for me, it's now so far removed from active thinking that I honestly mostly forget about it. Tibber, Shelly, and Meta are directly supported. And if all of this sounds like a cloud login to you, there is actually even an open developer platform with which you can even build your own automations on top of it. What Oasis specifically controls are the Ecoflow Stream batteries, which you see here. They absorb electricity from the grid when it's cheap or even negative, and then release it when it's expensive and you can consume it. The Stream AC Pro is the version without a direct PV input for 1.92 kWh, which is simply plugged into a normal socket. And for those who, like me, recently finally have a balcony, a facade, or perhaps even a garden, which I don't have, can opt for the Stream Ultra or Pro, which additionally have a PV input on the device itself. The legal 800-watt feed-in limit to the public grid is even automatically observed. So no stress with applications or regulations that you would have to read up on again. And incidentally, the entire series has just received the German Innovation Award, which I find quite remarkable for a hardware product from the balcony power station sector. You'll find the link with the discount either here or in the description below. Many, many thanks to Ecoflow for sponsoring this video. And now back to the question we left open at the end, namely what has fundamentally changed in the last two years? Adam Wason is the creator of Tailwind. Tailwind is a tool used to design websites, and if the name doesn't ring a bell at all, that's perfectly fine, because you're probably using Tailwind right now without knowing it. A few weeks ago, Wason wrote in a public comment that traffic to his documentation had dropped by 40% since the beginning of 2023, and that his revenue had decreased by almost 80%. In the same period, however, Tailwind has become more popular than ever before. Downloads have increased. So, adoption has grown. The tool is more successful than ever, but nevertheless, what he had from maintaining this tool has collapsed. And this is precisely where the mechanic, so to speak, explains everything. If more people use Tailwind, but no one visits the documentation anymore, it doesn't automatically mean that Tailwind is used less. It means that the people who use Tailwind no longer interact with Tailwind as a project. They don't read the manual themselves because they simply ask ChatGPT how to use a specific function. So they no longer open a question because the AI already provides them with the answer, and they don't post anything on Stack Overflow, that well-known question-and-answer site for developers, because the AI model is faster than any community. This effect is actually measurable. Researcher Maria Del Rio Chanona and her team have shown that activity on Stack Overflow dropped by about 25% within 6 months of ChatGPT's launch, and of course, it has only gone downhill since then. So Stack Overflow is not dead, but it's not exactly on a healthy path right now. And this is where it gets interesting, because a recent economics paper has tried to formally describe exactly this mechanism. And the finding is that open-source developers were never really paid directly for the use of their software. They give it away voluntarily, but rather for something else, namely for visibility. Those who maintain a popular project are offered lectures, job offers, small donations, perhaps a book contract, perhaps a consulting position. These rewards are not tied to the mere use of this open-source software, but to attention. That is, to the fact that people see the project, interact with it, and talk about the project, that the project itself is known. If AI now inserts itself between the user and the project, then precisely this visibility disappears, they say. So the tool is used like never before, but no one sees that it is being used. And with that, the reward that compensated open-source developers for essentially giving away their work also disappears. Wason puts it this way: Tailwind is more popular than ever, but the avenues through which he benefited from it have dried up. I experience this very similarly with my own projects, I must say. For example, I maintain European Alternatives, a site that shows European alternatives to large American services. You know it, I introduced it once. The site does have human users, but the majority of users are no longer human. They are automated systems that read the data from the API or from the code and serve it to their users as an answer, without anyone actually clicking directly on the site. Nevertheless, I still have to answer emails. I have to deal with all the legal matters, the requirements. I take care of the server, which I also have to pay for, of course. None of this actually brings in a single cent. It is, however, actual working time, but that's only the first layer, and honestly, the ones that come after are even more unsettling. It's not that the users simply disappear completely. They still come back, only they increasingly come with content generated by AI. And unfortunately, that in itself creates new problems. Daniel Steinberg is the maintainer of Curl, a program that you've probably never used, but which nevertheless runs on practically every computer in the world because it's the standard tool for downloading and uploading data on the internet. In 2025, Steinberg made public that he had to essentially discontinue the bug bounty program for Curl because less than 5% of the submitted security reports were actually legitimate. The rest were AI-generated hallucinations that look like real reports to him, but which he has to read, review, and refute, because he cannot take any risks when it comes to security. This work is unpaid, extremely time-consuming, and it has increased explosively in the last few years. A recent survey of open-source maintainers found that 45% of them say AI tools tend to negatively impact their work, not positively. 64% say they would be less willing to review code contributions from others if they knew they were AI-generated. And in the free-text comments, terms like spam, false reports, and time-wasters are accumulating. I want to pause here for a moment, because I am not an AI opponent in principle. Quite the opposite. AI can be an incredibly valuable tool. I myself use AI for programming very, very regularly, and I find it an incredibly important tool if you handle it carefully. However, I have also experienced with my own projects what happens when others don't do it so carefully. And that's where, for example, contributions come in that ignore our guidelines, that break central design decisions, for example, that are so generic that you immediately see that no human has ever truly thought them through. So it's not the problem of AI itself, but a misalignment that arises from AI or is amplified much more strongly. It has become very, very cheap to generate a contribution, but it has remained just as expensive to review a contribution. And this entire misalignment tips the whole system in one direction because it is based on the assumption that generation is more expensive than review. And unfortunately, another layer is added, which is discussed much less often because it flips an argument that has saved open-source for decades. The old argument was that open-source software is safer than closed software because many eyes can find many errors. If the code is public, then security researchers, maintainers, and even normal users can discover and report vulnerabilities before attackers exploit them. This statement is the ideological basis for very, very much of what has happened in the security industry over the last 30 years. In April 2026, a company called Cal.com publicly declared this statement dead. This went quite viral. Cal.com is an open-source alternative to Calendly. This is the tool used to book appointments, for example, and the company has explicitly positioned itself as an open-source company for years. Then, on April 14th of this year, Bailey Pumplee, one of the founders, published a blog post titled "Cal.com goes closed-source." And the reasoning in it is one that has fundamentally shaken the entire open-source movement. Pumplee writes that AI systems can scan public codebases for vulnerabilities at a speed that is impossible for human maintainers and caretakers to keep up with. If an AI can go through all of Cal.com's code in a few minutes and find security vulnerabilities, then it no longer helps that the defenders can also read the code, because the attackers simply have more and cheaper eyes, sometimes perhaps even state-funded. His co-founder Pierre Rickson even intensified this in a press release with the statement that open-source code is like the blueprint to a bank vault that is now being studied by 100 times more hackers than before. And Pumplee himself formulated the sentence that has been quoted everywhere since then: Transparency becomes exposure. What happens then, however, is at least as interesting. Sam Saffron, one of the co-founders of Discourse, an open-source forum platform, published a, I would say, devastating response the next day, in which he says that closed software, i.e., closed-source, does not mean less attack surface, but less defense capacity, because the defenders lose the advantage of code access, which attackers have never really needed anyway. John Nolan, the founder of Ghost, wrote that the assumption that closed code would save a modern online application from AI analysis is too naive, and Anthropic itself, the company whose models Pumplee explicitly calls a threat, states in its own research on its security model Mythos, which you have also encountered through the video, right, that this model can also analyze closed-source software very well. So the protection that Cal.com is hoping for is essentially an illusion. But what is truly disturbing about this case is not whether Cal.com is right or the people who want to defend open-source. What is truly disturbing is that it is now being seriously discussed whether the actual open reading of code, where AI models are no longer a shoo-in, is still a protective function at all, or whether it has become a risk. If this discussion tips in a certain direction in the next few years, then it would be a fundamental crisis for the entire open-source movement, which goes much deeper than just the question of money. So. So far, we've talked about structural mechanisms. But there's another one that sounds more mundane, and precisely because of that, is often overlooked: how the people who use open-source interact with the people who maintain open-source. And this is a story I would rather not tell, because it is also my own, unfortunately. A few years ago, I started building the Bootstrap Academy, a platform where people can learn to program. And I published the entire project as open-source. I then also organized hackathons, i.e., events where people are invited to contribute to the project and for which people are paid. Not a single permanent employee remained. What remained are demands for what still needs to be done, what doesn't work, what should be better, and of course, all for free, because the project is open-source. I have also experienced people simply copying my work from public repositories and selling it under their own name without any form of attribution. And when you address this publicly, the maintainer, in this case me, is the one who is making a drama. I have received insults that I would rather not repeat here from people who use my tools for free and then complain that a function doesn't work the way they expect it to. Oh, and fittingly, just at this moment as I was writing the script, I received another email describing me as antisocial because I don't personally answer all my approximately 30 emails per hour, but referred them to my management in one email. Yes, and this is not just my experience. A study of people active on GitHub found as early as 2017 that 21% of people who had experienced or observed negative behavior stopped contributing to or maintaining open-source projects for exactly this reason. A more recent study from last year, 2025, analyzed over 100 million public comments from almost 3,000 projects and found that popular projects actually receive more toxicity, not less. So, the success of a project is paid for with increased burden on its maintainers. Marak Squires is the most prominent case for this. He maintained two popular components, Faker.js and Colors.js, which together ran on truly thousands of projects and servers. In 2022, he modified both so that they no longer worked, and in his explanation, he wrote that he would no longer support large corporations with his unpaid work. Henry Zu, the maintainer of Bubble, a tool that runs through almost the entire modern JavaScript world, no kidding, has publicly described that he is constantly working in fire-fighting mode and then formulated the sentence that has become the core sentence of the entire topic for me. Our digital infrastructure is based almost entirely on us pushing through burnt-out maintainers. We're not talking about any delicate hobbyists who just need a short break on a weekend and get rich anyway. We're really talking about people who bear legal responsibility for code that billions of companies depend on, without ever having received a contract, insurance, or compensation for it. If an error in a component like Bubble or Curl leads to a security incident, the maintainer is treated like a supplier who hasn't delivered when it comes to payment. They are treated like a hobbyist who should be happy that someone is using their work. I've been writing and talking with some maintainers, contributors, and so on lately, and I'm starting to see things that way myself. Why all this, actually? Quite a few have written to me, they've started with gardening, 3D printing, or other completely unrelated topics. And even I am raising a small plant over there. Frankly, we're fed up with being treated like garbage by companies, and this is best illustrated by the platform itself, which presents itself as the savior for open-source. GitHub, the platform on which practically all open-source code resides, changed the default setting for its users in the spring of 2026. By the way, GitHub belongs to Microsoft, just so you have the context. From April 24, 2026, usage data from all Copilot users on the cheaper plans were used for training new AI models, unless you actively opted out. This means that any usage, code input, code output, code snippets, context, all of this naturally goes into training the new models. That would be okay from my perspective, and by the way, business and enterprise customers are excluded because they have different contracts. Practically, all of this means that the platform on which open-source maintainers publish their unpaid work, and on which GitHub itself literally depends, is now using their work to train a product that will at least partially make them obsolete in the foreseeable future, and which already makes their work more difficult today, as we heard earlier. Sure, you can now decide against it, you don't have to use Copilot AI, but open-source projects are of course open, meaning public. And for exactly these projects, GitHub has said they will still use them, regardless of how Copilot is used or not used, to incorporate them into the training of any AI models. GitHub doesn't even offer opting out for public data. There is an ongoing class-action lawsuit that has been trying to legally challenge this practice for years. And in February 2026, the case was heard by a US federal appeals court. A decision is still pending, and even if it goes in favor of the plaintiffs, the proceedings concern a rather narrow detail. In Europe, the implementation of the AI Act is running in parallel, which requires providers of such models to publish a summary of their training data. These are all steps in the right direction, but they are 5 years too late, because the models that have already been trained are already trained, and no law in the world will retrain them. Do you remember the cycle I described at the beginning? So software builds on software. More building blocks make the whole thing cheaper, and building new building blocks, the whole rise of open-source is a self-reinforcing mechanism that has been running in exactly this right direction for 30 years. Now it's turning around, the mechanism is running backwards again. If the reward breaks down because users no longer interact with the project, then maintenance becomes less worthwhile. If the work increases because more questionable contributions have to be reviewed, then maintenance becomes even less worthwhile. And if the security logic flips and open code can potentially become a risk, then projects migrate to closed-source, as Cal.com has done. If the platform turns around and uses the maintainers' code to train their replacements, then trust in the infrastructure also breaks down. And additionally, which I've omitted here, the next generation is missing because no one learns to program publicly anymore. Then there will simply be no one to replace the burnt-out maintainers. And if the maintainers finally stop, then building blocks are missing, which in turn are the basis for other building blocks. And these other building blocks also become worse because what they are built on is crumbling, and so on. This is not my hypothesis, by the way, but precisely what economists Miklos Koren and his colleagues have formally modeled in a recent paper. And their finding is mathematically relatively clear. Under the traditional business models of open-source, i.e., when maintainers draw their reward primarily from visibility, widespread adoption of AI-mediated usage leads to less provision, lower quality, and lower overall prosperity, despite higher productivity per individual software unit. The same mechanism that has carried us for 30 years is now carrying us down, and quite quickly. How quickly this can happen can be seen when you look at what reaches the people who actually carry these projects. A survey of open-source maintainers conducted annually since 2021 shows that the numbers have remained astonishingly stable. 59% in '21, 58% in '23, 60% in '24 say they are either giving up a project or seriously considering quitting. In the 2021 survey, 50% of this group cited burnout as the reason. And in the list of main burdens in 2024 are the same factors that were there in previous years, namely insufficient payment, the feeling of ingratitude, not just the absence of thanks, but the opposite of it, personal stress, demanding users, and loneliness. So this is more the normal state of affairs than exceptions. And with that, we come back to the story from the beginning. Lasse Collin, the maintainer of XZ Utils, wrote in an email in 2022 that his capacity to care for the project had become very limited and that the whole thing was an unpaid hobby project. It was precisely into this gap that this attacker slipped two years later. He offered himself as a helpful contributor, gained trust over months, and then installed the backdoor, and he almost got away with it. This attack is one of the most sophisticated examples of state-sponsored interference in digital infrastructure that we know of. And it was made possible because a tiny piece of software, on which half the world depends, was maintained by a single burnt-out person who was paid nothing. So, I'm not telling you all this to evoke pity, neither for Collin, nor for maintainers in general, nor for myself, nor for anyone else. Rather, it shows us that the structural situation has long since reached the real people who care for this software, and that the next few years will mean that we can expect much worse software, which you may have already encountered today, with more concrete bugs, security vulnerabilities, and serious failures everywhere, and not just in this little nerd part and the Linux community. At this point, you could stop the video, and it would be a great doomsday narrative that might even get more clicks and change nothing, because I would finally be brief. I know I've received criticism, but I want to make a different point, because there is research that investigated exactly this problem decades ago in a different context, and its findings help us to put what is currently happening into perspective. Elinor Ostrom received the Nobel Prize in Economics in 2009 for her work on common-pool resources, i.e., resources shared by a community without anyone owning them alone. That is, fishing grounds, irrigation systems, forests, and she investigated all of this and asked herself why some of these common-pool resources have functioned for centuries and others have collapsed within a few generations. Her finding was that functioning common-pool resources share eight design principles, from clear boundaries about who belongs, to common decision-making mechanisms, mutual monitoring, graduated sanctions for free-riders, to nested structures that mediate between small units and the large overall system. Open-source, without many people talking about it, is a common-pool resource in exactly this sense, at least I think so. It is a shared resource that is generated by many and used by even more. And some projects like Linux or Apache have developed exactly such structures over the decades that come very close to Ostrom's principles. They have formal roles, they have mutual review, they have nested structures with responsible parties for individual areas, and they even have conflict resolution procedures, and precisely these projects survive without problems. However, the vast majority of open-source projects are not huge Linux-like structures, but individual projects or mini-collectives that implement almost none of what Ostrom identified as necessary. There are no clear boundaries on who can benefit from the project. There is no monitoring beyond the person of the maintainer. There are no graduated sanctions for free-riders. There is no recognition by higher institutions, because the start of open-source is legally barely understood. And above all, the eighth principle is missing, the nested structure that mediates between an individual maintainer of an open-source project and the global software ecosystem. And it is precisely these missing mechanisms that AI is currently attacking. And they are even part of the solution, as we will see. AI exploits the fact that there are no boundaries because it simply takes from everything. It exploits the fact that there are no sanctions because no one bears consequences. It exploits the fact that there are no nested structures because it finds no negotiating partner who would speak for the maintainers. So what we have is not just an AI problem, but actually a management problem. To say that we need to manage. God, if that's the diagnosis, then the question for me is, what could a cure look like? And I don't want to give cheap answers here.
because none of the existing or proposed solutions are even close to perfect. And I've tried some of them myself quite unsuccessfully. The most obvious answer, for example, is direct donations via platforms like GitHub Sponsors or Open Collective. And that works for a handful of prominent maintainers who have enough reach to make their request for support visible. And it works particularly well when companies are dependent, for example, for legal reasons and have to finance certain projects. As with Curl, for instance. If a company is truly dependent on a project, then the famous morphic egg theory comes into play. I showed you that in another video. But for most maintainers, this is not really a sensible way because they don't have the reach and also no YouTube platform from which they can spread their donation links. As I said, I tried to do it this way myself, and the result was that the few sponsors I could win wanted more reach than an open-source project can typically offer, because nobody reads the project these days, but simply downloads and uses it. The second answer, however, is more commercial models, where the project remains open, but the commercial version is monetized. A company called Centry did this with its own license, which formally is no longer an open-source license because it no longer meets the official definition of the Open Source Initiative. But in practice, it has allowed the company to generate over $100 million in revenue annually without having to completely close-source the code. Other providers like Tutanota or Bitborn rely on the model that anyone can run the software themselves, but that most customers pay for the hosted version, i.e., what is perceived as the end product. However, this only works as long as self-hosting is complicated. But if you can simply ask an AI and the complexity of setting up such a platform yourself is eliminated, it works less and less. While this is a good thing in itself, it enables more people. However, this leads us back to the original problem. The third answer, and this is the one I believe in the most, is funding, including government funding. In 2021, Germany set up the Sovereign Tech Agency. Yes, Germany, which has since distributed over 37.3 million euros to 108 open-source technologies, including CL GNU Core Utils, Free BSD, J Unit. Mark Philip, a German J Unit maintainer, was able to make open source his full-time job for the first time in his life thanks to this funding. The Netherlands, France, and the EU are currently building similar programs, and a joint European consortium called Digital Commons EDIC is to coordinate these efforts. And this is a big, great step. This sounds like a really good solution, and in parts it is, but there's a small comparison that makes me a bit angry every time I look at it: the entire Sovereign Tech Agency, in the last three years of its existence, has spent 37 million euros on 108 projects. That sounds like a lot. The Ministry of the Interior of North Rhine-Westphalia alone recently spent 39 million euros on a single, parliamentary-based surveillance system in a similar period. Bavaria has a parliamentary grant of about 25 million euros, and the Federal Ministry of the Interior spent 160 million euros in 2025 alone on closed-source licenses. The Ministry of Finance had 253 million. The Ministry of Defense has about 250,000 Microsoft workstations in Germany, and for the Microsoft price increase in 2026, the federal government has already preemptively prepared for it to be hundreds of millions of euros more expensive. So it's really not about a lack of money in the German state. The German state spends hundreds of millions of euros on closed-source software every year, and a fraction of that on the open-source infrastructure that the same state needs to function at all. So what's missing is not the budget, but clearly the political will to correct this imbalance in some way. But it is precisely here that the paper from the beginning offers a very, very exciting proposal, a kind of Spotify for open source model. They called it that. AI providers, whose models know exactly which open-source building blocks they themselves use, pass on a portion of their revenue to the maintainers of these building blocks, based on traceable usage measurement. This means that if the AI writes code for me, and we are now using Tailwind, then a certain portion of my subscription goes to Tailwind. The technology for this exists. It's simply the usage data they get anyway. So the platforms actually know what I'm using and what percentage it was. What's missing, of course, is the willingness to actually set up this mechanism. So, at this point, I want to make a point that I must admit to myself, because otherwise everything I've said so far would just be an indictment of others. In my own projects, I use countless open-source building blocks, whose maintainers I have never personally contacted, whose donation buttons I have never clicked, and to whom I have never said thank you. And this, even though I know myself how it feels to be on the other side. So I am exhibiting the exact behavior that I always complain about, because I also don't have the time to deal with every tool I use in detail, because I myself am completely stressed for a not insignificant part of the time and can't even come close to achieving everything I want to achieve. And I don't know a single maintainer who doesn't do the same, because we are all in the same predicament. That's why I want to say thank you here, at least representatively, to every single person who spends their free time so that others can use free software. But that is precisely why this crisis cannot be solved by better behavior. Nobody will wake up tomorrow morning and decide, from now on, all maintainers of all building blocks we use will be properly thanked and paid. The system is far too large and too invisible and too complex for individual virtue to save it. What is needed are structural changes that link reward back to work, even if individuals don't change their behavior. And that's exactly why I find this Spotify-like principle for AI platforms, which measure everything anyway, fascinating. Government funding, of course, which would be not 37 million, but rather 370 million or 3.7 billion, in the order of magnitude of what we spend on closed source, so that there are resources to create structures that can mediate between individual maintainers and large customers. Licenses that link commercial use with obligations without completely destroying free access. If you will, a kind of union for open source. None of this is perfect, none of it will solve the crisis alone, but it can cushion it or at least make it less bad, and that before it gets so bad that everyone has given up. But the alternative, which we are currently experiencing, is that an industry that builds 70 to 90% of its code on open source is consuming this open source faster than it can replace it, because it believes that AI makes consumption invisible enough to ignore the consequences. Because what happens is that what practically the entire digital world stands on, doesn't go to the dogs with a bang, but very quietly, very slowly, and with many more bugs, as probably more than one person has noticed recently. Feel free to write in the comments which open-source projects are important to you personally, or which tool you regularly use without ever thinking about who is behind it. And in that spirit, today a shout-out for everyone who simply holds together everything we use for free, and also to those who have done so for years until the system exploited them too much and they had to leave. Thank you to you, and until next time in cyberspace. Bye.