A history of open source software

What open source software is, and where it came from

The history of open source software is mostly the history of its licences, because a licence is the only thing that decides what you may do with code somebody else wrote. Code was shared openly long before anyone wrote those licences down. It stopped being shared once it became a product, and the licences were written to make sharing hold up in a court.

That is the short version. The long version matters because the software you run on a server today still carries the marks of those decisions. Some of those decisions were made in 1983. Some were made last year, and they are the reason a few of the applications in our self-hosting guides now come in two versions with different names.

Software was shared before it was sold

In the 1950s and 1960s, software arrived with the machine. IBM shipped source code with its systems, and user groups such as SHARE, founded in 1955, passed programs around on tape. Two things ended that. IBM announced in 1969 that it would price software separately from hardware, which created a market for software on its own. Then the law caught up. The Computer Software Copyright Act of 1980 confirmed that programs are copyrightable works in the United States. After 1980, code you did not write was closed by default, so sharing it needed written permission from the author.

The Homebrew Computer Club and the Open Letter to Hobbyists

The Homebrew Computer Club held its first meeting in March 1975, in a garage in Menlo Park, California. Members brought hardware and paper tape, and copying was part of the meeting. Altair BASIC, written by Bill Gates and Paul Allen, went round the room on copied tape. In February 1976 Gates answered in the club's newsletter with "An Open Letter to Hobbyists".

As the majority of hobbyists must be aware, most of you steal your software.

He wrote that fewer than one in ten Altair owners had paid for BASIC, and that the computer time used to write it was worth more than 40,000 dollars. The whole modern argument is already in that letter. Copying software costs nothing and helps everyone who copies it. Writing it still cost someone a year of their life. Every licence described below is an attempt to answer both of those facts at once.

GNU in 1983, and the GPL as a legal invention

Richard Stallman announced GNU in September 1983 on Usenet, the newsgroup network that people used before the web. GNU stands for "GNU's Not Unix". The plan was a complete Unix-compatible system that anyone could copy and change.

Free Unix! Starting this Thanksgiving I am going to write a complete Unix-compatible software system called GNU (for Gnu's Not Unix), and give it away free to everyone who can use it.

The Free Software Foundation (FSF) followed in 1985. Its Free Software Definition lists four freedoms, numbered from zero: run the program for any purpose, study and change it, redistribute copies, and distribute your changed versions. Freedom 1 requires the source code, because nobody can study a binary in any practical way. "Free" here means freedom and not price. The FSF's own phrase is free as in free speech, not free beer.

The manifesto was not the invention. The licence was. The GNU General Public License (GPL) uses copyright to require sharing instead of to prevent it. You receive the four freedoms on one condition: anyone you pass the software to receives them too, with the source. Stallman called this copyleft. It shipped first with GNU Emacs in 1985, became GPL version 1 in 1989, and version 2 in June 1991.

The GPL works because it stands on copyright law, not against it. Without a licence you have no right to distribute someone's code at all. The GPL grants that right and attaches conditions to it. So a vendor who ships modified GPL code inside a router and refuses to hand over the source is not breaking a promise. They are infringing copyright, which a copyright holder can take to court. That is why enforcement is possible at all, from Harald Welte's gpl-violations.org cases in the 2000s to the Software Freedom Conservancy's suit against Vizio, filed in 2021, which argues that a person who bought the television can demand the source too.

Linux finished the system

By 1991 the GNU project had the compiler, the C library, the shell and most of the tools. It had no working kernel, because GNU's own kernel, the Hurd, took far longer than planned. In August 1991 a student in Helsinki posted to the comp.os.minix newsgroup:

I'm doing a (free) operating system (just a hobby, won't be big and professional like gnu) for 386(486) AT clones.

Linux 0.01 arrived in September 1991 under a licence Linus Torvalds wrote himself, which forbade selling it. He replaced that with GPLv2 in early 1992 and has said since that it was one of his best decisions. The licence is what made corporate contribution safe: a company could put engineers on the kernel knowing a competitor could not take those improvements private.

A free Unix already existed at Berkeley. The reason Linux and not BSD (Berkeley Software Distribution) became the default free Unix is partly a lawsuit. Unix System Laboratories sued Berkeley Software Design in 1992, and the case ran until early 1994. For those two years the BSD systems carried legal risk and Linux carried none, and that is when the users arrived. The FSF asks people to call the combined system GNU/Linux, since Linux is the kernel and most of the surrounding tools are GNU. Most people say Linux. Both names point at the same collection of software.

1998: the open source rebrand, and the split that never healed

In January 1998 Netscape announced it would publish the source code of its browser. That was the biggest company yet to do such a thing, and it exposed a practical problem. The phrase "free software" reads in English as "software that costs nothing", and executives heard exactly that. A group met in Palo Alto in February 1998 to find a better term, and Christine Peterson proposed "open source". Within weeks Eric Raymond and Bruce Perens set up the Open Source Initiative (OSI). It adopted the Open Source Definition, adapted from the Debian Free Software Guidelines that Perens had written in 1997.

The Open Source Definition has ten criteria. Two of them decide most modern arguments: the source must be available, and the licence must not restrict who may use the program or what they may use it for. A licence saying "you may not offer this as a commercial service" fails the test, whatever else it permits. Hold on to that sentence. It is the line that today's source-available licences cross.

The split that opened in 1998 is about reasons, not about which licences are acceptable. The FSF's case is ethical: a user who cannot change the program does not control their own computer. The OSI's case, argued to business by Raymond's essay "The Cathedral and the Bazaar", is practical: open development produces better software, and a company can act on that. Stallman's reply, "Why Open Source Misses the Point of Free Software", is still published on gnu.org, and he has never accepted the newer term. Perens, who helped create it, resigned from the OSI board in 1999 saying the movement had drifted away from free software.

It is worth being precise about how small the practical gap is. The FSF's list of free licences and the OSI's list of approved licences agree on nearly everything, including the GPL, MIT, Apache 2.0 and BSD. Writers who need both meanings at once use FOSS (free and open source software) or FLOSS (free/libre and open source software).

How companies learned to ship the code

Red Hat's stock market listing in 1999 showed there was money in support and packaging rather than in selling copies. IBM committed a billion dollars to Linux for 2001. Microsoft's chief executive called Linux "a cancer" in 2001, and the same company joined the Linux Foundation as a platinum member in 2016, then bought GitHub in 2018 for 7.5 billion dollars in stock. IBM bought Red Hat in 2019 for 34 billion dollars. None of that was a change of heart about licences. It was a change in where the money sits. When an operating system is a shared cost, paying to maintain your own is expensive, and every vendor would rather compete on the layer above it.

Corporate ownership cuts the other way too. When Oracle bought Sun in 2010 it inherited MySQL and OpenOffice.org, and both communities left. MariaDB grew out of MySQL, and LibreOffice was forked from OpenOffice.org in September 2010. A fork is the only vote a user community really holds, and the licence is what makes that vote possible.

Why some of the apps you self-host now have forks

From 2018 onward a group of companies changed the terms on software they had already released. The situation was the same each time. One company employed almost all of the developers, a much larger cloud provider sold the same software as a managed service, and the smaller company decided the licence was the reason it could not compete.

• MongoDB adopted the Server Side Public License (SSPL) in October 2018. The SSPL says that if you offer the software to others as a service, you must publish the source of everything you use to provide that service. The OSI did not accept it as open source, and MongoDB withdrew it from review in 2019.
• Redis added use restrictions to some modules in 2018 and 2019, then moved the main server to dual source-available terms with version 7.4 in March 2024. A fork of the last BSD-licensed release appeared days later as Valkey, under the Linux Foundation, backed by Amazon, Google and Oracle among others. In May 2025 Redis added the Affero General Public License version 3 (AGPLv3), which is OSI-approved, as a third option for Redis 8.
• Elastic moved Elasticsearch and Kibana off Apache 2.0 in January 2021, to dual SSPL and Elastic License terms. Amazon forked OpenSearch. Elastic added AGPLv3 as a third option in August 2024, and OpenSearch was transferred to the Linux Foundation in September 2024 as the OpenSearch Software Foundation.
• HashiCorp moved Terraform and its other tools to the Business Source License (BUSL) in August 2023. BUSL is not an open source licence while it is in force, because it forbids competing production use. Each release converts to an open licence on a fixed date, four years later for Terraform. OpenTofu was forked within weeks and now sits under the Linux Foundation as well.

Both sides of this have a real case and neither is acting in bad faith. A company paying fifty salaries while a far larger firm resells its work has a problem that goodwill does not fix. A user who built on Apache 2.0 terms and woke up under new terms also has a problem, and nobody asked them first. Notice what happened next in two of those cases. After the forks took hold, Elastic and Redis both added strong copyleft back. Copyleft answered the original complaint, because AGPLv3 requires a service provider to publish the changes it runs. As of August 2026 both projects and both forks are still active, which is the outcome the licences were designed to allow.

Who is allowed to change a licence

A project can only be relicensed if one party controls the copyright on all of it. Companies get that control in one of two ways. Copyright assignment hands ownership of each contribution to the company. A contributor licence agreement (CLA) leaves you as the owner but grants the company rights broad enough to relicense your work. Either one is usually signed by clicking a link a bot posts on your first pull request.

Linux has no CLA. Contributions arrive under GPLv2 with a Developer Certificate of Origin, and the copyright is spread across thousands of people and companies. Nobody can relicense Linux, because nobody could ever collect all those signatures. The same protection applies to any project with many independent copyright holders, and it is a stronger protection than a promise, because it is a fact about who owns what.

So the question to ask about software you plan to depend on is not whether it is open source today. It is who could change that, and whether they could do it alone.

What a foundation actually gives you

A foundation holds the assets and fixes the rules for how decisions get made. The Apache Software Foundation, the Linux Foundation, the Cloud Native Computing Foundation inside it, and the Software Freedom Conservancy each do a version of that job. A foundation is not neutral by magic. Members pay for their seats, and most people working full time on a large foundation project are paid by member companies. What you get is narrower and still worth a lot: the trademark and the release process do not belong to one vendor, so no single company can take the project private.

The trademark is the part people miss. Code is licensed. A name is a trademark, and a trademark is not covered by the code licence. You can always fork the code. You usually cannot keep the name. That is why the forks in this story are called Valkey, OpenSearch, OpenTofu and Forgejo.

The maintainer problem

Modern infrastructure rests on projects with one or two unpaid maintainers, and the failures are what make that visible. The Heartbleed bug in OpenSSL in 2014 hit a library carrying a large share of the web's encrypted traffic, maintained by a handful of people on almost no money. Log4Shell in December 2021 routed the world's incident response through a small volunteer team at the Apache Log4j project.

The XZ Utils backdoor found in March 2024 is the sharpest example, because the attack targeted the maintainer instead of the code. An account spent roughly two years making genuinely useful contributions to a compression library used across Linux distributions. Other accounts pressured the exhausted sole maintainer to accept help. The new co-maintainer then planted a backdoor in the release archives, aimed at systems where the SSH (secure shell) daemon links against liblzma. A developer found it while investigating why logins took about half a second longer than expected. That was luck, and everyone involved has said so publicly.

Money has started to arrive: GitHub Sponsors since 2019, Open Collective, Germany's Sovereign Tech Fund since 2022, and the OpenSSF's Alpha-Omega project. It arrives unevenly, and it tends to find the projects that are already famous. Regulation is arriving too. The European Union's Cyber Resilience Act entered into force in December 2024, with most of its duties applying from December 2027. Early drafts would have put manufacturer liability on unpaid volunteers, so the final text creates a lighter category called an "open source software steward" after long lobbying by foundations and distributions.

What the history of open source means for the software on your VPS

Every application in our self-hosting guides sits downstream of these decisions. Nextcloud exists because of a fork: in 2016 ownCloud's founder and much of the team left and restarted the project under AGPLv3, and the two products have run in parallel ever since. That history is the background to the Nextcloud alternatives worth considering and to the self-hosted Dropbox alternatives that compete with both of them.

The same pattern runs through Git hosting. Gitea itself began in 2016 as a fork of Gogs. In late 2022 the project's trademark and domains moved to a company, Codeberg forked Forgejo in December of that year, and Forgejo moved from MIT to GPLv3 with version 9 in 2024. Both are covered in the self-hosted Git server options, and the licence difference is a large part of why they keep diverging. Meanwhile most free software is developed on GitHub, a closed platform owned by Microsoft, which is an old argument with good points on each side: see what GitHub actually is.

Before you commit a server to a project, four checks are worth ten minutes.

• Read the LICENSE file in the repository, not the marketing page. Pages keep saying "open source" long after the file has stopped agreeing.
• Look for a CLA or a copyright assignment. If one exists, a single owner can change the terms of future releases.
• Find out who holds the copyright: one company, many contributors, or a foundation.
• Count the active maintainers. A project with one is a risk to that person as much as to you.

None of this says avoid single-vendor software. Much of it is excellent, and being paid for is often why it is maintained at all. It tells you what you are exposed to. When you are deciding what is worth self-hosting, put the licence in the comparison next to the memory requirement.

You can read part of this history on the machine in front of you. Every package on a Debian or Ubuntu system ships its own terms:

ls /usr/share/doc | wc -l
head -n 20 /usr/share/doc/bash/copyright

The first number is how many installed packages carry a copyright file, usually a few hundred on a small VPS. The second command prints the top of the one for bash, which names the GNU General Public License version 3. A missing file means the package was not built to Debian policy, which is rare and worth a second look before you trust it.

FAQ

What is the difference between free software and open source?

They cover almost the same set of licences and disagree about why those licences matter. "Free software" is the older term, from the Free Software Foundation in 1985, and its argument is ethical: a user who cannot change the program does not control the computer. "Open source" was coined in February 1998 to make the same licences easier to explain to companies, and its argument is practical. The GPL, MIT, BSD and Apache 2.0 licences are all on both official lists. Writers who want to mean both at once use FOSS or FLOSS.

Is source-available software the same as open source?

No. Source-available means you can read the code. Open source, under the Open Source Definition, also means the licence may not restrict who uses the software or what they use it for. The SSPL and the Business Source License both restrict competing commercial use, so neither is open source by that definition, even though both publish their source. If you only self-host for yourself, the restriction may never touch you. If you want to build a product on top, read the licence text closely first.

Can a company take back an open source licence it already granted?

Not for code it has already released. That version stays under the licence it shipped with, which is exactly why forks such as Valkey and OpenTofu could start from the last permissively licensed commit. What a company can do is put future versions under new terms, and it can do that only if it controls the copyright on the whole project through assignment or a contributor licence agreement. Projects with many independent copyright holders, Linux among them, cannot be relicensed by anybody.

Which licence should I look for in self-hosted software?

For software you run yourself and do not resell, any OSI-approved licence such as GPL, AGPL, MIT or Apache 2.0 gives you everything you need. The more useful check is who holds the copyright, because that decides whether the terms can change under you later. A project held by a foundation or by many independent contributors cannot be relicensed against its users. A single-vendor project with a contributor licence agreement can be. Both can be good software. Only one of them can change the rules on its own.