In early 1995 the most popular web server on the internet was NCSA HTTPd, and nobody was maintaining it. Its lead developer had left for Netscape. Webmasters were keeping it alive by emailing patches to each other.
A group of them decided to collect those patches and release them together. They called themselves the Apache Group, and their first release came out that April. Within a year it was the most popular web server on the web, a position it held for two decades.
In March 1999 that informal group incorporated as the Apache Software Foundation, so it would have a legal entity to hold the code, the trademarks and the donations. This spring the foundation turned twenty-five. It's worth taking stock, because the ASF matters far more than most people who use its software realize.
What it hosts
The web server is just the start. The ASF now looks after more than 300 projects, maintained by thousands of committers. A short tour shows how much of modern computing runs on them:
- Web and Java: the Apache HTTP Server, Tomcat, Maven, Ant and Groovy.
- Big data: Hadoop, which made storing and processing huge datasets on cheap hardware practical, and Spark, which made it fast. Then Hive, HBase, Flink and Arrow.
- Data platforms: Kafka, the event-streaming backbone of countless companies, Cassandra for distributed databases, and Iceberg, which this year became the open table format the industry fought over, as I wrote in understanding data lakes.
- Search: Lucene and Solr, the search libraries underneath much of the internet, including the core of Elasticsearch and OpenSearch.
- Developer tools: Subversion, which moved to the ASF in 2009, and Airflow for scheduling data pipelines.
- And Log4j, the Java logging library that sits in an astonishing number of applications. More on that below.
Many of these began inside companies: Hadoop at Yahoo, Kafka at LinkedIn, Cassandra at Facebook, Airflow at Airbnb, Iceberg at Netflix. Donating a project to the ASF is how a company tells the world "this won't become ours again."
The Apache Way
The ASF's most influential creation may be its governance model, which it calls the Apache Way:
- Community over code. A healthy community will fix bad code. Great code with no community dies.
- Individuals, not companies. People participate as individuals, even if an employer pays them. A company can't buy a seat on a project, and no single company may dominate one.
- Earned responsibility. Contributors become committers, and committers join the project management committee, by the work they do.
- Consensus and public decisions. Discussions happen on public mailing lists. "If it didn't happen on the list, it didn't happen."
- The Incubator. New projects go through it before graduating, which tests whether they have an independent, diverse community.
The Apache License 2.0, released in 2004, deserves its own mention. It's permissive, like BSD and MIT, but with an explicit patent grant: contributors license any patents covering their contributions. That protection made it the license of choice for companies open sourcing serious software, and it's the license of Kubernetes, Android, TensorFlow and much more.
Log4Shell
On December 9, 2021, the world learned that Log4j had a flaw that let an attacker run code on a server by getting it to log a specially crafted string. Since applications log everything, including usernames, headers and search terms, that was nearly everything. It was rated as severe as a vulnerability can be, and companies spent the holidays hunting for every copy of Log4j buried in their software.
The maintainers were a handful of volunteers who worked on it in their spare time, and they shipped fixes within days, under enormous pressure, for software used by most of the Fortune 500 without payment.
Log4Shell didn't show that the Apache model failed. The ASF project did its job. It showed something about everyone else: the world's companies had built critical systems on volunteer work they'd never paid for, never audited and in many cases didn't know they were using. It's one reason software bills of materials, already being written into US government rules, became something every vendor was suddenly asked for.
Twenty-five years on
The ASF is less fashionable than it was. Newer projects tend to go to the Linux Foundation and its sub-foundations, and a few Apache projects have faded. OpenOffice is the sad example, outpaced by its own fork, LibreOffice. The Apache Way's insistence on mailing lists and consensus can feel slow next to a company-run GitHub project.
But it's still among the strongest guarantees open source has against what's happened to so many projects in the past few years. An Apache project can't be relicensed by a company that decides it wants a bigger share of the market. Its trademark belongs to a non-profit. Its decisions are made in public. Twenty-five years of keeping that promise is worth celebrating.
Since then
Added October 2026. The relicensing wave that hit company-owned projects like Terraform and Redis never touched Apache projects, which is exactly the point of putting them there. I wrote about the wider pattern in When the Cathedral Ate the Bazaar.