Code is territory.

Open the machine behind a tax office, a hospital ward or a central bank and you will find the same thing: software written in public by people who were never paid to write it. 96% of commercial codebases contain open source²; Harvard Business School values it at $8.8 trillion¹. It is the largest public work of our century, and no parliament ever voted for it.

That makes open source a question of sovereignty. Whoever maintains the code decides what it does; whoever licenses it decides who may use it; whoever builds the companies around it decides who depends on whom. For thirty years the West left these questions to engineers. A backdoor, three relicensings and a sanctioned court have since shown they belong to states.

Pylon Partners works in the gap between the commons and the company. We find the projects the world already depends on and build the companies that keep them open, funded and defended. This is our case, in eight parts.

• The value is national in scale. Writing the open source the world uses from scratch would cost about $4.15 billion once; the firms that run on it would otherwise spend 3.5 times more on software than they do today¹. The gap between those two numbers is a subsidy paid by volunteers to every economy on earth.
• The labour is private and mostly unpaid. When Heartbleed broke in 2014, OpenSSL encrypted a large share of the web’s traffic and ran on roughly $2,000 a year in donations and one full-time developer³.
• The dependency stays invisible until it breaks. The famous cartoon of all modern digital infrastructure resting on “a project some random person in Nebraska has been thanklessly maintaining since 2003”⁴ is funny because it is accurate.

A country that would never leave its water supply to volunteers has left its software to them.

On 29 March 2024 Andres Freund, an engineer at Microsoft, noticed that SSH logins on a test machine were taking half a second longer than they should. He traced the delay to xz, a compression library shipped inside nearly every Linux distribution, and found a backdoor⁵. The attacker, writing as “Jia Tan”, had spent two years earning the trust of one exhausted maintainer before being handed the keys.

• The method is patient and cheap. No zero-day was bought and no server was breached; the attacker volunteered, and the project was too short of help to refuse.
• The blast radius is national. In December 2021 a flaw in Log4j, a logging library kept by volunteers, left hundreds of millions of devices exposed; the head of America’s cyber agency called it “one of the most serious I’ve seen in my entire career, if not the most serious”⁶.
• The pattern repeats until someone pays.

Burned-out maintainer → patient stranger offers help → commit access → backdoor in every state that runs Linux

A project with a company behind it has a payroll, a security team and someone who answers the phone at three in the morning. That is the cheapest defence a commons can buy.

The second failure is quieter. A company builds on an open project, the world standardises on it, and then the licence changes; the tax arrives after the dependency has formed.

• Elastic, 2021. Elasticsearch moved to a source-available licence in January; Amazon forked it as OpenSearch⁷ within three months.
• HashiCorp, 2023. Terraform moved to the Business Source License⁸ in August; the community forked it as OpenTofu⁹ and handed it to the Linux Foundation.
• Redis, 2024. Redis dropped its open licence in March; the Linux Foundation launched Valkey¹⁰ with AWS, Google Cloud and Oracle behind it inside a fortnight.

Elastic and Redis both came back to an open licence¹¹ within about eighteen months. The commons won each fight, and every user who had to pick a side paid for the war.

A proprietary service is a relationship with a company, and a company answers to a government. Open source code, once published, answers to whoever holds a copy.

• Huawei, 2019. When Washington put Huawei on its Entity List, Google withdrew its mobile services from new Huawei phones¹². Android itself, published as open source, stayed in Huawei’s hands; the company kept shipping phones and went on to build its own open operating system.
• The International Criminal Court, 2025. After American sanctions in February, the court’s chief prosecutor lost access to his Microsoft email in May. By October the court had confirmed it would move to openDesk¹³, an open source suite built by Germany’s Centre for Digital Sovereignty.
• Schleswig-Holstein, 2024. The German state began moving 30,000 government PCs to Linux and LibreOffice¹⁴ and named its reason plainly: digital sovereignty.
• Germany, since 2022. The federal government funds a Sovereign Tech Agency¹⁵ whose job is to pay maintainers of the open source the state runs on.

On 20 January 2025 a Chinese lab called DeepSeek published R1, a reasoning model competitive with the best closed systems, under the MIT licence. A week later Nvidia lost roughly $589 billion of market value in a single day¹⁶, the largest one-day loss in American market history.

• A closed model is a service that can be withdrawn. Its price, its rules and its availability are set by a foreign company and, behind it, a foreign government.
• An open model is a copy a country can keep. A state that cannot afford to train a frontier model can still download one, audit it, fine-tune it on its own language and law, and host it inside its own borders.
• Open networks push the idea one step further. On Bittensor¹⁷ the weights are open and the compute that produces them belongs to its participants; no single company can revoke the model or the machines.

Linux settled the question for operating systems a generation ago. Intelligence is being settled now, and the terms are the same.

In 2019 IBM paid $34 billion for Red Hat¹⁸, a company whose core product anyone can download for nothing. What IBM bought was accountability: certified releases, security patches on a schedule, and a name to call when something breaks. In 2025 it paid $6.4 billion for HashiCorp¹⁹ on the same logic.

The work that turns a project into that kind of company is operational: package the software so an enterprise can install it; settle the licence before a customer’s lawyers raise it; hire the first person whose job is a customer rather than a commit; price what has never been priced.

Paid maintainers → faster patches → enterprise trust → revenue → more paid maintainers

Relicensing is what a company does when it arrives late and panics. A company built in time can keep the code open for good, because its revenue comes from the service around the code.

• We look for solved coordination. A project qualifies once more people maintain it than any employer would staff. That signal is readable years before the market prices it, and the company usually does not exist yet.
• We do the operating work ourselves. We ran token foundation strategy at Immutable and fan token programmes at Chiliz before we backed anyone; commercialising open source is operating work, and we staff it.
• We stay. We are still with the first two projects we took on.

The truth is that the open stack already won the argument about quality; it runs the servers, the phones and now the models. What it has not won is the argument about ownership, and that one will be settled by whoever builds the companies. We would rather they were built by the people who wrote the code, with capital that stays, than by whoever arrives after the dependency has formed.

If you maintain a project the world depends on and you want it to outlive your free evenings, we want to hear from you.