Why not pure GPL from the start FOSS is under sustained, structural attack
The open source ecosystem has been strip-mined for thirty years. In the early
days the threat came from proprietary companies who took your code, added
nothing back, and sold closed-source products. The community built
copyleft — the GPL — to close that door. It worked, mostly.
The new threat is harder. Cloud hyperscalers discovered that hosting an
open source project as a managed service requires no copyright violation at
all. You can run many copyleft codebases as a cloud service and pay the
author nothing, as long as you never modify the source. AWS built businesses
worth billions doing exactly this. Redis, Elasticsearch, MongoDB —
each one was running on Amazon infrastructure before the authors had a
chance to build their own commercial model around their own decade of work.
The maintainers were left with a choice between changing their licenses and
being called traitors to FOSS, or watching a trillion-dollar company take
the value they created. Most changed their licenses.
Amber Linux is a small project. I am not Redis. I am not fighting AWS.
But I watch the ecosystem and I understand the precedent, and I am not
going to hand a commercial exploit window to the first operator who
notices this project before 2030.
The record
AWS ran Elasticsearch, Redis, and MongoDB as managed services,
collecting commercial fees on a decade of open source work. All
three eventually changed their licenses. AWS forked Elasticsearch
as OpenSearch. The community forked HashiCorp's Terraform — which
also moved to BSL — as OpenTofu. The forks exist. The economics
that created them remain unchanged.
In early 2024, a patient, careful actor spent two years building
trust as a maintainer of xz-utils — the compression library that
underpins vast amounts of Linux infrastructure — then inserted a
backdoor that would have compromised SSH authentication across
millions of production systems. It was caught by accident. The
attack was near-complete before anyone noticed.
Before that: event-stream (2018, 2M downloads/week, cryptomining
injected via maintainer handoff), node-ipc (2022, geopolitical
malware in a widely-used npm package), and a long list of
dependency-confusion and typosquatting attacks that continue today.
Every major large language model was trained on open source code
and text. No author was asked. No license was read carefully. The
reasoning was that publicly available means freely usable for any
purpose, including commercial model training. GitHub Copilot,
Claude, GPT-4 — all of them absorbed open source repositories
under that assumption.
The explicit AI training restriction in this license is not
theoretical. It exists because the practice is ongoing, widespread,
and commercially motivated.
Open source communities attract impersonators who create
convincing clones of projects and donation pages, then collect
money that never reaches the original developers or the projects
they support. This site runs a fundraiser for Linux Mint.
Before you give to anyone claiming to fundraise for a FOSS
project, verify them on the project's own official channels.
See the verification steps on the homepage
for how to confirm that Amber Linux's fundraiser is legitimate.