Open source is one of the most successful international collaborations in history. A kernel maintained by people on six continents runs most of the world's servers. A compression library written by a volunteer in Finland sits on nearly every Linux system. It works because code moves freely across borders and because enough people are paid, somehow, to keep it maintained.
Both of those conditions are political, and both are under pressure. I see three currents in particular, and none of them map neatly onto one party or one country.
1. Markets that reward taking without giving back
Free markets built much of the open source economy, and I'm not arguing against them. But a market with no expectations attached rewards companies for using open source heavily while contributing as little as possible, and the results are showing.
- Critical projects go unfunded. The xz backdoor discovered this March got in through a project maintained by one exhausted volunteer, used by every major Linux distribution and by companies worth trillions of dollars combined. Nobody was paying for its upkeep. Heartbleed and Log4Shell told the same story.
- Relicensing. Companies that controlled popular projects, including HashiCorp, Redis and Elastic, switched to source-available licenses to fence out competitors. Each time, the community had to fork to keep the software open. I wrote about that pattern in Free as in Freedom.
- Consolidation. When a handful of platforms host the code, run the CI and own the package registries, a handful of companies' policies effectively govern the whole commons.
What helps: governments and companies funding the maintenance of critical infrastructure directly. Germany's Sovereign Tech Fund, set up in 2022, does exactly that, paying for security and maintenance work on core open source projects. It's a model other countries should copy.
2. Nationalism that treats code as territory
Technology has become a front in geopolitical competition, and open source is getting caught in it.
- Export controls. The US has steadily tightened controls on advanced chips and chipmaking tools to China since 2022. Last fall, some members of Congress went further and pressed the administration to restrict American participation in RISC-V, the open processor instruction set. Restricting who may collaborate on an open standard is a strange way to protect a lead.
- Sanctions and platforms. In 2019 GitHub restricted accounts of developers in sanctioned countries, including people who had nothing to do with their governments, until it secured a license to serve some of them again. Developers in a sanctioned country can lose access to their own code overnight.
- Parallel stacks. China is building domestic operating systems, chip designs and standards to reduce its dependence on Western technology. Russia is pursuing "import substitution." Each fork of the global ecosystem into national versions means duplicated effort and fewer eyes on each.
Some of this is the unavoidable cost of real conflicts, and governments have legitimate security concerns. But open source's security benefit comes precisely from many independent people reviewing the same code. Splitting it into national versions trades that away.
3. Isolationism that walls it off
Isolationism is nationalism's quieter cousin: not hostility, just pulling back. Fewer international visas for conferences. Data-localization rules that make cross-border collaboration legally risky. Procurement rules that favor domestic vendors over shared open source. Each makes it harder for a developer in one country to work with one in another, and that collaboration is the entire engine.
Politics that helps
It's not all bad news, and the counterexamples are instructive.
The European Union's Cyber Resilience Act, which the European Parliament approved in March, began life with drafts that could have made individual open source developers liable for flaws in code they gave away for free. The open source community and its foundations pushed back hard, and lawmakers listened. The final text exempts non-commercial open source development and creates a lighter "open source steward" role for foundations that support projects used commercially. That's what good technology policy looks like: regulators asking how the thing actually works before they regulate it.
Other things that help:
- Funding maintenance of critical projects, as Germany's Sovereign Tech Fund does.
- "Public money, public code" laws that require publicly funded software to be released openly, as Switzerland did this year, which I covered in Switzerland and public code.
- Keeping sanctions targeted at governments and companies, not at individual developers' access to shared code.
- Treating open source as infrastructure, like roads and bridges: shared, maintained, and funded because everyone depends on it.
The bottom line
Open source is a commons. Commons survive when the people who benefit from them help maintain them, and when nobody fences off a piece for themselves. Politics can protect that or erode it. Anyone who depends on open source, which is everyone, has a stake in which way it goes.
Since then
Added October 2026. The question of where sanctions end and open collaboration begins became concrete a couple of months later, when Russian maintainers were removed from the Linux kernel's maintainer list for legal compliance reasons. I wrote about that decision in why Linus Torvalds' decision to exclude Russian contributors is justified.