back to reflections

Why I May Not Open Source Our Tools

I keep itching to open source the internal things we have built over the years. Every time I get close I reach the same conclusion. The upside is mostly gone, and handing over the source now means handing over the moat.
Petko D. Petkovon a break from CISO duties, building cbk.ai

Every now and then I ponder whether to open source various internal things we have built over the years. You know, little harnesses, tools, pieces of infrastructure that took real work to get right. Every time I get close to pull the trigger, I come to the same conclusion and give up. It is simply a bad idea. It is not a bad idea for any moral reason. It just does not pay off for both the maintainer or the community.

The true nature of open source is to give something back but for years companies used open source as a way to market themselves, and that kind of worked most of the time. There are great many companies that started like this. That game is over. Unless your project is genuinely significant on a technical level, almost nobody is going to actually use it. They will read it as a reference and build their own version, because building your own has become cheap.

That is what open source is about. Permissive licensing always meant anyone could take your work, swap the backend for their own, and ship a derivative. That is what the source is for. Nobody really did it, because the economics did not allow it. But now they do. You might spend twenty, fifty, a hundred thousand dollars making a piece of software real, and a competitor can have their own copy for almost nothing. A new player with a new model can take an established coding harness, give it a bit of attribution, and use it directly instead of maintaining anything themselves. It is a bit of a power move, and we are going to see a lot more of it.

Then there is the fact that open sourcing is hard, and it is not for everybody. It takes real community work, and you still have to market the thing. Open source can be a marketing job for a business, but the marketing does not do itself. And if the project does become successful, which is the whole point, you now have to deal with the influx. That is not just people anymore. It is a flood of patches written by language models that you are expected to review so that the project does not feel abandoned. There are data points on how expensive this gets. Look at what it takes to keep the big AI tooling projects alive and you see teams that can easily burn millions just on the documentation and infrastructure needed to stay maintainable. Not every project ends up there, but that is the risk.

And if the thing you are opening is anywhere near the core of your business, you have just made your product easy to copy. A model can write the code. What it cannot do is see your problems. It cannot see your circumstances, your users and the particular set of conditions you work under. Your code is, in a real sense, a model of your use cases. It does certain things in a peculiar way that others do not, and that is exactly what makes it yours. Open source it and you are handing over the secret sauce, and whatever small moat you had is gone. I have made this argument before in a different piece, that you can only copy what you can see. Opening the source is just the act of making the invisible part visible.

There is a saying that your data is your moat, and I believe it. Your customers are data. Your documentation is also data. Your manuals, the hardware you run, the procedures you have worked out over the years, all of it is data, built up slowly, and none of it is something you can buy from a language model. It gets baked into how you operate, and into those peculiar ways of doing things, and no model can reproduce those intricacies unless you literally hand it the source.

Open source is more alive than ever, because it has never been easier to produce code or to take part. And that exact same ease is quietly killing whatever moat made open source worth doing in the first place. It is a bit of a Schrödinger thing, alive and not, depending on when you look. We already know stars and similar numbers are a poor proxy for anything real. We already watch big, energetic projects fade, with replacements arriving about as often as new models replace the old ones.

I love open source as much as the next person, and I will be forever grateful for the projects that still power everything we have built. But I cannot honestly treat it as something we can seriously contribute to right now. Not because we lack the ability, but because we do not have a project with a clear mission behind it, and because even if we did it purely for brand awareness, we would spend a lot of time for very little in return.

So, unfortunately, I do not think the future is open. I think it is closed. And I suspect this is just one of those cycles, closed for now, and maybe, once it has run its course, open again.