Hi everyone! Today we’re going to talk about some not-so-positive things. It’s about the problems facing the open-source community, and personally, I see a very, very bad trend that could lead to some very, very unpleasant things in the future.
What prompted me to write this article was a piece of news from 2026 itself.
Volunteer participation problems at Debian - the Data Protection Team is left without members#
The gist of the news: The Debian project’s Data Protection Team, responsible for handling data requests, ensuring privacy compliance, and liaising with external parties, has been left completely without members - all three team members resigned simultaneously. Debian Mailing Lists
Why it matters:#
This highlights a real problem of volunteer fatigue and shortage in large open source projects:
- critical administrative functions are left unsupported;
- responsibilities shift onto other already time-constrained key contributors (e.g., the project leader);
- without new volunteers, Debian has no sustainable mechanism for handling data protection matters. Debian Mailing Lists
Context: The shortage of active contributors even in a project as large and mature as Debian reflects a broader problem in the open source ecosystem: growing technical obligations without a corresponding growth in the community willing to invest their time and effort. reddit.com
Open WebUI: tightening license wording and brand control#
The Open WebUI repository received a commit that doesn’t touch the project’s functionality at all, but is entirely focused on reworking the wording of the license and related texts. The changes concern the legal side of using the project - namely, the terms of distribution, liability, and mentions of the Open WebUI brand.
The key point is a strengthening of requirements to preserve the original name and identity of the project when distributing or modifying it. In effect, this is a step toward tighter control over how the project can be used by third parties, especially in commercial and semi-commercial scenarios.
This case nicely illustrates one of the systemic problems of open source in 2025: developers are increasingly trying to protect their projects not with code, but with licenses. This results in hybrid or “pseudo-open source” models that are formally open but impose additional restrictions, sparking disputes in the community and reducing compatibility with the classic open source ecosystem.
On one hand, developers say they’re simply fighting unfair competition, where bad actors pass off someone else’s work as their own. On the other hand, the community is starting to worry.
The same thing happened with the CentOS upstream model. “Various” Oracle and OpenSUSE took the distribution, brazenly slapped their own brand on it, and sold it for money to the corporate sector. Everyone knows how that ended. Honestly, Red Hat received, specifically in that case, a huge amount of not-entirely-deserved hate from the community.
Planka - now not quite “open source”: a special license and distribution practice#
The Planka project - a Kanban-style web app for task management - is positioned as a self-hostable Trello-like tool. However, its license differs from classic free licenses: the code is distributed under a Fair Use License and a separate Pro/Enterprise License, rather than a recognized free license like MIT or GPL. GitHub
What this means:#
- The source code is always available for viewing (source available), and the app can be self-hosted. GitHub
- At the same time, the legal terms of the license restrict how it can be used and distributed, especially in commercial scenarios. GitHub
- This is not classic open source in the OSI/Open Source Definition sense: the project has introduced its own restrictions that make it closer to a source available / fair-code model than to free software. GitHub
Why this matters for the open source ecosystem:#
Planka is not an isolated case. This is a trend.
Google strengthens Android security through Developer Verification#
In August 2025, Google announced the launch of a new Android developer verification system, aimed at improving platform security, especially regarding installing apps outside the official Google Play store. Android Developers Blog
According to the official Android Developers blog, research showed that the number of malicious apps distributed via direct downloads (sideloading) is 50 times higher than the number of threats found in Google Play. Android Developers Blog
In response, starting in 2026, Google plans to require that all apps installed on certified Android devices be linked to a verified and confirmed developer identity. This means the anonymity that malicious actors used to repeatedly release malware under different names will be eliminated through centralized identification. Android Developers Blog
This extension of existing Google Play requirements does not include content verification of apps - the company only verifies the developer’s identity, not the code itself. GIGAZINE
At the same time, users will still be able to install apps from any source, but developers will need to pass verification through the new Android Developer Console. Android Developers Blog
The pilot launch will begin in fall 2025, open registration in March 2026, and the mandatory requirement will start in Brazil, Indonesia, Singapore, and Thailand, followed by a global rollout in 2027 and beyond. Malwarebytes
Ultimately, this hits third-party app stores like F-Droid.
ESR and criticism of Codes of Conduct in open source#
In September 2025, the well-known author and leading open source theorist Eric S. Raymond (ESR) posted a sharp comment on X (Twitter) about modern Codes of Conduct (CoC) in open source projects. He called them “a disaster,” the result of “ten years of drama and idiocy,” and called for abandoning heavyweight codes of conduct in projects. X (formerly Twitter) (“the organization X’s activity is banned in the Russian Federation”)
ESR’s main point is that formal CoCs essentially don’t solve real problems and even create new ones. He believes such documents are overly bureaucratic, are easily weaponized against contributors, and distract communities from technical work and direct interaction between people. Shuji Sado
This criticism reflects a broader discussion in the open source community: many developers believe that aggressive and formal codes of conduct reduce the freedom of collaboration and turn projects into politicized spaces where more attention is paid to CoC compliance than to code quality or genuine communication. news.ycombinator.com
Nextcloud vs. Google: the file upload problem on Android#
In May 2025, the Nextcloud team publicly exposed a situation where the Nextcloud Files app for Android lost the ability to upload arbitrary files (not just photos and videos) due to actions taken by Google in the Google Play Store. This concerned a key Android permission (MANAGE_EXTERNAL_STORAGE), which allowed the app to access all files on the device. Half a year of working without it effectively limited functionality - users could only upload media files, not documents, archives, and other files, which undermined Nextcloud’s core promise as a self-hosted cloud. Nextcloud
Nextcloud argued this refusal was unjustified from a security standpoint, since similar apps continued to have full access, and that Google was simply “owning the platform and giving itself an advantage.” The team repeatedly reached out to Google asking for the permission to be restored, but the initial responses were generic and unproductive. In its blog, Nextcloud stated bluntly: “you all have a worse Nextcloud client because Google wanted it that way.” Nextcloud
In mid-May 2025, Google restored file access for the app, and an update with the restored full upload functionality was prepared for release. This was the result of public pressure and community feedback. However, the incident became a vivid example of the so-called Big Tech gatekeeping policy, where a company that owns the platform can restrict competing apps’ capabilities, even if they are technically safe and important to users. arstechnica.com
The Rust vs. C dispute in the Linux kernel - the threat of “unmaintainable complexity”#
In early February 2025, a sharp conflict erupted in the Linux community around attempts to expand the use of Rust inside the Linux kernel and ensure its interoperability with existing C code. The problem flared up after a patch supporting Rust integration in Linux, allowing Rust drivers to call low-level C kernel functions (for example, DMA APIs), met with harsh criticism from one of the kernel’s core maintainers, Christoph Hellwig. He called the idea of mixing Rust and C in the kernel “cancer - not because of Rust as a language, but because of the complexity created by a cross-language codebase,” and stated that it reduces “maintainability” and worsens the project’s readability. The Register+1
Hellwig insisted that kernel interfaces should remain in C, and that all Rust wrappers and interactions should be confined to separate layers, so as not to blur the code boundaries and force C subsystem maintainers to understand the Rust layer. Opponents of this position argue that such confrontation slows down kernel evolution and ignores the memory-safety benefits Rust provides. The Register
This conflict reflects a broader problem of the open source ecosystem in 2025: growing technical complexity and disagreement over tools and languages, where modernization attempts collide with a culture of conservatism, accusations of “IT drama,” and disagreements about how large projects like Linux should evolve. The Register
Nouveau maintainer resigns amid Linux kernel community toxicity#
In early 2025, developer Karol Herbst, one of the maintainers of the open-source Nouveau driver for Linux (a reverse-engineered NVIDIA driver), officially stepped down as kernel maintainer because he called the community toxic and unwelcoming. His statement came alongside his refusal to continue maintaining Nouveau code in the upstream Linux kernel. Phoronix
Herbst directly pointed out that the last straw was the use of the phrase “we are the thin blue line” in a kernel discussion, which he considered politically and culturally sensitive and harmful, especially given the current social situation in the US. He stated that such remarks do not contribute to inclusivity and respectful interaction in the community, and that under such conditions he could not continue participating. Phoronix
This story sparked a heated reaction in the developer community: some people believe technical debates shouldn’t turn into cultural and political conflicts, while others say ignoring the impact of phrases and behavior on different groups is also a problem. The discussion in Hacker News comments shows just how deep the disagreements run over where the line lies between technical discussions and cultural/social contexts in large open source projects. Hacker News
Why this matters:#
This case illustrates that in 2025, open source is increasingly grappling with issues not just about code, but about community - how people interact, what cultural and social expectations apply, and how conflicts around language and behavior can lead to the loss of key contributors. This is not just a technical, but also a human challenge to the sustainability of large projects. Phoronix
Asahi Linux: founder steps down, project moves to collective leadership#
In February 2025, the Asahi Linux team officially announced that its founder and leader Hector Martin (known as marcan) had stepped down as project lead. Instead of a single key figure, the project is moving to collective governance - leadership now includes seven active developers, including specialists in the Linux kernel, graphics, and audio. Asahi Linux+1
The official Asahi Linux blog post emphasizes that the project needs to become more resilient and independent of a single person: “no one, however talented, should have to carry the whole project on their shoulders.” This is a shift toward more formal and distributed responsibility, which is important for the long-term maintenance of a large codebase, especially given the challenges of supporting Apple Silicon and continuous work with the upstream Linux kernel. Asahi Linux
This decision came amid a burned-out leader and growing pressure faced by open source developers - the challenges included conflict with the Linux kernel over Rust code, complex technical tasks, and intense community workload. FOSS Force
Why this matters:#
This case reflects a broad problem of mature open source projects in 2025: dependency on key people, the risk of leader burnout, and the need for a distributed governance model for sustainable development. This is not just a technical transition, but also an organizational challenge faced by many large projects trying to maintain activity and effectiveness amid complex interactions with upstream communities and intense user demands. Asahi Linux
Automattic reduces WordPress contributions amid conflict with WP Engine#
In January 2025, Automattic, best known as the owner of WordPress.com and co-founder of the WordPress project, officially announced it would reduce its sponsored contributions to WordPress development. Instead of thousands of hours of contribution to the core and ecosystem, Automattic decided to limit its participation to roughly 45 hours a week, comparable to the contribution of another major host - WP Engine - and to focus its efforts on its own commercial products such as WordPress.com, Jetpack, WooCommerce, and others. Automattic+1
The company attributed this move to significant time and resources spent on litigation against WP Engine, as well as criticism and pressure from part of the community, which demanded the resignation of Automattic’s leadership. Automattic The authors of the statement emphasized that they wanted to “reconsider, rethink, and strategically plan” how their efforts could better serve the platform’s future. Automattic
This episode exposed a serious conflict within one of the largest open source projects: when a company that has been a key contributor for more than two decades publicly reduces its contribution under pressure from internal and external factors. This sparked debates about equity of participation, the responsibility of large organizations, and the sustainability of projects that live off community contribution. lwn.net
Mass resignation of NixOS moderators over Steering Committee interference#
In September 2025, most of the official NixOS forum moderation team announced their immediate resignation in protest against persistent interference by the project’s Steering Committee (SC) in moderation work. NixOS Discourse
In their open statement, the moderators said the SC had repeatedly attempted to question their decisions, constrain their work, and even influence the composition of the moderation team, up to and including attempts to overturn decisions and appoint its own people. They emphasized that the project’s existing Constitution provides no effective mechanisms to protect against such interference, so they could no longer continue working under these conditions. NixOS Discourse
The authors of the statement also called for greater transparency, accountability, and governance reform to create a system with real checks and balances between the SC and other teams, including those responsible for moderation and technical leadership. Many community members supported these demands, noting that the conflict reflects deep problems with governance, trust, and communication culture in a large open source project. NixOS Discourse
Why this matters:#
This case shows that problems in the open source ecosystem are far from being just about code - organizational structure, power, and trust within communities can be just as critical a factor as technical challenges or licensing. When basic governance mechanisms fail to guarantee independence and a balance of interests, it can lead to the loss of the very people who keep a project alive and sustainable. NixOS Discourse
Conclusion: a crisis of people and structure in open source in 2025#
The events of 2025 show that open source’s problems have long gone beyond purely technical issues. Major projects are dealing with chronic volunteer shortages (Debian, Asahi Linux), burnout among key contributors (Nouveau, Asahi), and conflicts between the old development culture and new languages and tools (Rust vs. C in Linux).
In addition, structural and organizational problems - from a toxic environment in the Linux kernel to Steering Committee interference in NixOS - threaten the sustainability of communities that are formally open but in practice depend on a handful of people willing to perform critical functions.
Legal and licensing restrictions (Planka, Open WebUI) show that control over a project is increasingly implemented through rules and licenses, rather than through the community. Big platforms (Android, Nextcloud, WordPress) are increasingly using the strength of the ecosystem to control access and contribution, which limits development freedom and the distribution of responsibility.
Altogether, this reflects a systemic challenge for open source in 2025: projects are becoming more complex, responsibility is growing, and the mechanisms for governance, support, and motivating people often fail to keep pace with technological and social realities. Without attention to structures, transparency, and care for people, the very idea of open code risks becoming technically open but humanly fragile projects.
