The Bike Shed
July 13, 2026
Volume 24, issue 3
Please make my predictions come out wrong
Poul-Henning Kamp
Almost 20 years ago, my friend George (aka Kode Vicious) casually mentioned in an email that acmqueue was looking for articles about flash memory. Not thinking through the consequences, I asked, “How many words?”
Careless questions cause homework, and thus started the “Bikeshed” column, if one can call something a column when it appears only about once per year.
When I was a young man, I rapidly tired of old men who had no idea what I was talking about but were 100 percent certain that they had the infallible answer, and I promised myself I would never join their ranks.
So, I will see myself out now.
In this last Bikeshed in acmqueue, I will ponder the far future of free and open source software (FOSS), hoping to upset so many readers that my name will become an obvious addition to the “list of IT people who have predicted something utterly wrong and obviously silly about the distant future.”
There are two hot envelopes in the FOSS inbox right now: LLM-assisted code reviews and age verification.
The LLM-assisted code reviews are causing a lot of headlines because this comes out of one of those economic bubbles that seem to automatically inflate as soon as most people have forgotten how utterly stupid and predictable the previous bubble was.
I’m not particularly worried about this.
I have never felt particularly confident in myself as a programmer, so I have always applied all the “code-quality” tools I could lay my hands on, and the pattern has always been the same:
— Day 1-2. Tried $tool out. Oh boy! We have some work to do.
— Day 3-5. OK, there were a couple of solid bugs there, and a fair number of what were technically bugs, but not actually all that bad.
— Week 2. I guess that was it?
This pattern first manifested when I read the Zilog Zeus reference manual from cover to cover in 1984 (while walking barefoot in the snow on the freeway, etc.) and read about lint(``1).
I saw the pattern most recently with Clang’s quite impressive static analysis facilities.
Just on that repeated experience, I suspect we have already seen more than half of the “worst software bugs found with LLM-tools” list.
Supporting that suspicion is that it would beggar belief that AI bros so desperate to blow hot air into their bubbles would not try to make as big a splash as possible, as soon as possible.
(May I kindly suggest that they give their next LLM model the entire design and as-built documentation for a nuclear power plant? That is guaranteed to give them a lot of publicity and will maybe teach us something about the limits of human engineering complexity.)
When I look at the nature of the bugs found by LLM tools, I see clear parallels to computers playing chess: The LLMs are able and willing to explore the tree both wider and deeper in detail than human brains evolved to economize energy and time, by probabilistically and heuristically searching for food, sex, and comfort only where the odds look most promising.
That’s good.
Cyberattacks and defense are by nature a chesslike game, and we also badly need better tools to write the programs that we will increasingly trust with our lives in the future.
The only real question for me is: Are the LLM-code-review tools economically viable outside the bubble?
All the work, and all the cost, comes up front, during “training” of the model. But the resulting artifact, the weights of the model—which you have to sell many million times over before you turn a profit—easily fits on contemporary pocket-sized storage devices.
This is not unlike a major film or video production where millions are spent on sets, actors, costumes, special effects, and marketing to create a 4K video stream that fits on pocket-sized storage devices, and profit is made in increments of fractions of a teenager’s allowance.
Where [H/B]ollywood has somewhat successfully managed to wrap itself in a righteous cloak of copyright protections, the LLM industry may have trouble doing that, given how religiously they recite “fair use” in the many lawsuits where they are accused of infringement of copyrights.
So, it is not obvious to me who will be training new iterations of these models once the current bubble explodes, in particular if the returns are diminishing the way I have experienced.
In contrast to the LLMs, I think age verification is going to be a really big deal for the FOSS world. And, spoiler alert: I think we are at the beginning of the end for FOSS as we know it.
Quick recap: In the beginning, nobody important cared about the early store-and-forward communication systems, and the open source phenomena that it begat.
Then some money could be made on store-and-forward, and that funded further development, which gave us online digital communications—where the real money was.
FOSS hitched along for the ride, and, because FOSS is nothing if not unselfishly helpful, that accelerated both the technological development and the moneymaking.
When Edward Snowden revealed that Somebody Important had been taking an interest after all, the tech bros, who had grown up free of adult supervision, felt betrayed and started a campaign to encrypt everything and anything so that prying eyes could never again look them in the cards.
And thus, we find ourselves in the present situation where it is trivial for any criminal to cover their online tracks well enough that only the most incompetent criminals and most economically consequential online crimes are prosecuted, while most digital crimes are not even reported to the police because everybody knows the police can’t do anything about them.
I can never remember if it was Sun Tzu or Clausewitz who cautioned not to back your enemy into a corner from which the only way out is over your own corpse, but that is precisely what the tech bros did to nation-states with encryption, and now the nation-states are making their way out of that corner.
Right now, there is a LOT of shrill propaganda from the tech bros, who call themselves “privacy advocates,” about how mandatory age checking is the gateway drug to comprehensive identity checks on the entire Internet, and ridiculing the valid civic concerns governments are trying to address as merely “think of the children” strawman arguments.
In comparison, tech sisters advocating for an absolute right to privacy seem to be a very rare, and maybe mythical, species.
It may not quite be a law of nature, but my personal guess is that the opportunities for anonymity on the Internet will shrink until mothers no longer are forced to have “the talk” when their daughters get their first mobile phone. As the parent of a daughter, I am totally on board with that.
And before you ask: Yes, I’m laying this one squarely down before (and partly on the toes of) the tech bros: We could have designed our protocols to be minimally compatible with “a nation of laws,” but the tech bros insisted that compromise was treason, and, as a result, we will lose more privacy than necessary.
But how can age verification even work with FOSS? What’s to prevent the kids from changing the source code and recompiling once a fake mustache is no longer enough?
Cryptographically attested software integrity is the only possible answer: Somebody will have to sign on the dotted line to verify that this operating system can be trusted, and nobody is going to do that if the user can change it and recompile it.
The Internet is already fractioning into ever-smaller parts you can access with any browser, on any device, running any software you want. And a growing part of that can be accessed only from an “attested computing platform,” which you may or may not have the source code for but surely won’t be able to hack.
That brings me to the biggest force of change to FOSS as we know it: accountability.
During the past couple of decades, rampant neoliberalism and “globalism” allowed the U.S. tech industry to capture almost the entire European IT market, including all “social media.” This has recently proved to be a ghastly mistake, and now the EU, along with its member states and companies, are scrambling to claw back their digital sovereignty.
If the EU had grown its own tech-bro–infected online monopolies, that would be as easy as changing a few laws. And, in that situation, the EU wouldn’t have cared about FOSS any more than the EU cares about any other people’s hobbies.
But there is no such thing as a European alternative to Google, Apple, Oracle, Microsoft, Facebook, or Twitter, and therefore you can hear European CIOs wander around at night muttering:
— Is this an IT solution I see before me?
— The source code toward my hand?
— Come, let me clutch thee!
But when, like Macbeth, they reach out, they grasp only the thin air, because there is no supplier to negotiate with, nobody to sign a contract with, and when they wake from their nightmare, they can still hear the voice of Groucho Marx mocking them: “The party of the first part shall be known in this contract as the party of the first part,” because almost everybody currently in a position of power grew up in a culture where “blame allocation” was comme il faut because it was seen as more profitable, and therefore obviously better to deflect blame to somebody else, rather than to solve the actual problem.
It’s hard enough for them to pretend that blame allocation can work with “The buck stops here” problems such as digital sovereignty, but it clearly won’t work with FOSS because if there is one thing FOSS licenses all agree on, it is the “Don’t blame me” clause.
So, a bit of a paradigm shift there, and they don’t know how to drive stick, because nobody ever got fired for buying Microsoft before.
As the only realistic hope for digital sovereignty, the EU made huge carveouts for FOSS in recent legislation, most notably in the Cyber Resilience Act, but the EU is not stupid: The carveouts end the moment you make a profit. And since it does look like there will be a lot of profit to be made from FOSS in the EU in the coming decade, that is also going to hasten the end of FOSS as we know it.
Even if you give up blame allocation as “methodology,” FOSS as we know it is not a particularly solid foundation to build civic society upon because a lot of FOSS exists at the pleasure of a single person, who may not know, and may not care, how much infrastructure other people have stacked on top of it.
Maintainer burnout is already a thing, and maintainer death will increase in frequency since FOSS looks more and more like it was a generational thing, like bell-bottom jeans and flower power.
Attempting to lure in apprentice maintainers to replace my generation of do-gooders is already a losing proposition, and it is not going to happen at all if the role of maintainer is pro bono, while the paint-on-the-sign-is-still-wet “FOSS stewards” and “FOSS manufacturers” rake in the dough from that very same software.
The era of “Benevolent Dictator for Life” FOSS maintainers like myself is coming to an end. In the future, all consequential FOSS projects will be maintained by committees appointed by a FOSS steward or by a FOSS company.
Between the need for an “Attested Computing Platform” to fire the weapons against the crime-enabling “privacy advocacy” tech bros, and the need to have something more legally substantial than “some dude” maintain the IT foundations of EU’s digital sovereignty, the wide open spaces my generation roamed over, playing with FOSS as if the sun would never set, are rapidly being replaced by properly fenced, only-as-big-as-the-taxpayers-will-pay-for, health-and-safety-approved, sterile, and uninspiring urban playgrounds in a soundscape free of important commercial traffic.
The only bit left of FOSS as we know it will be that users will be able to read the source code. As reproducible builds catch on, they might even be able to compile that, as long as they make no modifications.
I fear that the path of least resistance to accountability for FOSS will be the “walled-garden-app-store” model, where only cryptographically attested genuine kernels are able to offer the necessary age verification and other legal attestations required to surf the web, and only unmodified programs, downloaded from the FOSS-stewards-approved app store can run outside the sandbox of the browser.
And why would I even think that?
It’s because a friend of more than 40 years recently needed my help to install Ubuntu on his new laptop, and as much as I appreciate what Ubuntu has done for the adoption of FOSS, I really hate how much that looked like the future.
Please make my predictions come out wrong.
Related Material
Quality Software Costs Money - Heartbleed Was Free
How to generate funding for FOSS
Poul-Henning Kamp
https://queue.acm.org/detail.cfm?id=2636165
Open Source and the Iceberg Theory
Why “dependency management” isn’t enough anymore
Alyssa Wright and Stephen Augustus
https://queue.acm.org/detail.cfm?id=3799738
Kode Vicious: Forked Over
Shortchanged by open source
https://queue.acm.org/detail.cfm?id=2611431
Poul-Henning Kamp has haunted the Unix world for 40 years and written a lot of widely used open-source software, including bits of FreeBSD and the Varnish HTTP Cache. Living in Denmark with his wife, two cats, and three lawn-mower robots, he remains unconvinced that an older/wiser correlation exists.
Copyright © 2026 held by the owner/author(s). Publication rights licensed to ACM.
Originally published in Queue vol. 24, no. 3
More related articles:
Alyssa Wright, Stephen Augustus - Open Source and the Iceberg Theory
The traditional model of passive consumption is fundamentally unsustainable. In an era of AI-generated code and increasing supply-chain attacks, stewardship is now a fiduciary and societal imperative. Embedding a stewardship mindset into core strategy is not a matter of goodwill; it is an investment in the resilience and long-term viability of the systems your company relies on.
Josie Anugerah, Caleb Brown, Elitsa Bankova, Eve Martin-Jones, Nicky Ringland - Modeling Version Requirements in Open Source Packaging
We propose a universal model of requirement actions. While the concept of requirements is the same across packaging ecosystems, the syntax used to represent them is not, creating unnecessary confusion. The proposed model does not provide a new syntax for adoption but offers a precise way for ecosystems to define the meaning of their requirement operators. All ecosystem-specific requirements can be translated into the model as well as being defined within it, and dependency-resolution tools need not be specific to a requirement syntax.
Russ Cox - Fifty Years of Open Source Software Supply Chain Security
The xz attack seems to be the first major attack on the open source software supply chain. The event-stream attack was similar but not major, and Heartbleed and Log4j were vulnerabilities, not attacks. But the xz attack was discovered essentially by accident because it made sshd just a bit too slow at startup. Attacks, by their nature, try to remain hidden. What are the chances we would accidentally discover the very first major attack on the open source software supply chain in just a few weeks? Perhaps we were extremely lucky, or perhaps we have missed others.
Josie Anugerah, Eve Martin-Jones - The Surprise of Multiple Dependency Graphs
It seems like it should be easy to avoid installing vulnerable open source software, but dependency graphs are surprisingly complex. At the time of writing, the latest version of the popular npm tool webpack has millions of potential dependency graphs depending on circumstances during its resolution. The exact graph chosen for a given package can depend on what other software is being built, what kind of system is building it, and even the state of the ecosystem on a given day.
© ACM, Inc. All Rights Reserved.