What big tech gives to open source, and what it takes

The Short Version

Large technology companies stand on both sides of open source, sometimes at once. Mark Zuckerberg and Yann LeCun describe a company that gives: Meta releases AI models, server designs and speech tools, and argues that this makes the technology safer, more diverse and less concentrated [1][3]. Jean-Baptiste Kempf of VLC and Kieran Kunhya of FFmpeg describe companies that take: trillion-dollar firms whose video runs on code written by a few volunteers, and who send those volunteers machine-generated bug reports with deadlines and requests marked high priority [2]. The two accounts are not really in conflict, because they describe different halves of one relationship. Giving is real and it is also in the giver's interest. Meta's own models became cheaper to run because outsiders rewrote them [1]. Taking is real and it is mostly careless, not hostile; the same company criticized over its bug reports is acknowledged as a major open source supporter and began sending fixes after the row [2]. The two sides never address each other in these conversations, so the debate here has to be assembled from what each says.

Table of contents

What They Said

Mark Zuckerberg: why Meta gives its models away

Zuckerberg presents openness as part of how Meta does AI research. "Meta has taken the approach of being quite open and academic in our development of AI," he says, and the first reason he gives is recruitment: "A lot of the best people want to know that they're going to be able to share their work." [1] The offer to a top researcher is industry-scale infrastructure plus the freedom to publish, and "part of our ethos is that we want to share what's invented broadly." [1]

His second reason is access. Training a state-of-the-art model, he says, "just takes hundreds of millions of dollars of infrastructure," so very few organizations can do it, and he thinks it would be good if many different people could build with the results [1]. He expects Meta to learn from what students, hackers and startups make [1].

His third reason is security and safety. Nobody, he argues, looks at today's models and thinks they are superintelligence: "I don't think anyone looks at the current state of things and thinks that this is super intelligence." [1] They are powerful but basic tools, comparable to databases or web servers, and open-source software tends to be more secure because more people scrutinize it [1]. He thinks the community is more likely to reach good alignment in the open [1].

His fourth is about power. Asked whether building advanced AI might corrupt him, he returns to open source: "I don't think that the world will be best served by any small number of organizations having this" without it being broadly available, and he notes that lopsided concentrations of power have historically ended badly [1]. His summary judgment is "I feel quite confident in the assessment that open sourcing models now is net positive," [1].

He points to precedent. Meta published its data center and server designs through the Open Compute Project, on the theory that "if we make it so that more people can use this server design, then that'll enable more innovation." [1] He mentions a caching tool for quick data retrieval, one of the last things he coded himself, as the kind of software that is "broadly useful across anything that you want to build." [1] Lex Fridman adds Meta's speech models, which extended speech-to-text and text-to-speech from around 100 languages to more than 1,100 [1].

Zuckerberg is also candid about the limits, and they matter for anyone weighing how generous this is.

The first Llama model was not open in the sense that FFmpeg is. "we did a limited open source release for it," he says, intended for researchers, with commercial use held back while safety questions were worked out [1]. He acknowledges the practical effect: "Obviously, by releasing it for research, it's out there." [1] Reputable companies, he says, have respected the non-commercial terms [1].

Meta does not open everything. "we probably do more open source work than most of the other big tech companies, but we also don't open source everything," he says, and the core code of WhatsApp or Instagram stays closed [1]. His stated reason is that it is not general enough to be useful to others [1].

The policy is not permanent. If something were closer to superintelligence, he says, the question would need much more thought: "We haven't made a decision yet as to what we would do if we were in that position" [1].

And Meta benefits directly. He praises the community's work on Llama, including versions that run on a laptop and a more efficient reimplementation called llama.cpp, and then states the return: "So now even when we run our own versions of it, we can do it on way less compute," which saves money for everyone who uses it, Meta included [1].

Yann LeCun: open source as a free press for AI

LeCun, Meta's chief AI scientist, makes the argument on political grounds. An unbiased AI system is impossible, he says, less for technical reasons than because bias is in the eye of the beholder [3]. Liberal democracies solved the same problem for the press by making it free and diverse. Soon, he expects, every interaction with the digital world will pass through AI assistants, which will become the repository of human knowledge, and those cannot come from a handful of companies on the US West Coast [3]. Open-source base models let anyone build their own. As he and Fridman agree, "open source enables diversity," [3].

He gives examples of what that makes possible: the French government's refusal to let a few companies control its citizens' information diet, an Infosys founder funding a version of Llama 2 for all 22 official languages of India, and a startup in Senegal building models that speak local languages to give people access to medical information [3]. He says Llama 2 has been downloaded millions of times, with thousands of people contributing ideas [3].

LeCun is unusually direct about why Meta can afford this. The company already has a huge user base and earns its money through advertising and business customers, so releasing the base model does not hurt it [3]. In other words, the gift is possible because the business is somewhere else. He also argues that openness is the safer course, since the real danger in his view is AI concentrated in proprietary hands, and since breakthroughs spread quickly in any case [3]. If a bad actor builds a hostile system, it will meet other people's systems: "my good AI against your bad AI." [3]

Jean-Baptiste Kempf and Kieran Kunhya: what it is like underneath

Kempf, the president of VideoLAN and longtime lead of VLC, and Kunhya, a codec engineer and FFmpeg contributor, describe open source from the position of the people being relied on.

The scale of the reliance is the starting point. Fridman introduces FFmpeg as the invisible backbone behind YouTube, Netflix, Chrome and nearly every platform that touches video, and adds, "it's all done by volunteers." [2] Kunhya notes that home videos and trillion-dollar companies run on the same stack [2]. He puts a "finger in the air" estimate that more than 80 percent of FFmpeg pipelines depend on x264, a VideoLAN project, and describes the two projects as a "binary-star system" that feed each other [2]. The core group is small. Kempf says a project like FFmpeg or VLC has a community of 10 to 15 core developers, and that these are not the worst case: other libraries used everywhere are maintained by one person [2].

Against that background they describe three kinds of taking.

Bug reports without fixes. Kunhya describes a dispute with Google, which used AI to generate security reports against FFmpeg, applied the standard 90-day disclosure deadline, and promoted its AI in the media before fixes were ready. One vulnerability was in an obscure game codec from the 1990s [2]. He compares it to using industrial-scale lock-picking on someone's garden shed and then announcing that the padlock is unsafe [2]. In the transcript the underlying problem is stated in one line: "The problem here is a disproportion of means on discovery compared to patching it" [2]. A company with vast resources can now find flaws far faster than a handful of volunteers can repair them.

Support demands without contracts. Fridman reads out an FFmpeg post: "A trillion dollar corporations expect free and urgent support from volunteers." [2] The case behind it was Microsoft Teams, which marked a bug as high priority on FFmpeg's volunteer-run tracker and then offered a one-time payment of a few thousand dollars [2]. Kempf's diagnosis is ignorance more than malice. The person involved was a manager on one project who had never dealt with an open source community and, as Kempf puts it, "he had no idea" [2]. Fridman suggests such companies simply assume FFmpeg is a vendor being paid a great deal of money [2]. Large companies do have offices meant to manage relations with open source projects, Kempf says, but they often fail to explain things internally [2]. His answer is blunt: "we are not your supplier." If a company wants a supplier, he is happy to send a contract with service-level terms, and he has founded several companies that do exactly that [2].

Attention only under pressure. Kempf says public pressure on social media is often the only way a small project gets a big company to listen. Threatening to pull VLC from the Play Store, where it has around 100 million users, finally got an Android bug addressed [2]. A fake VLC installer that carries adware, he says, has been reported to Google for 12 years [2].

They connect this to burnout. They cite the xz incident, in which a lone maintainer was worn down by attackers, and a widely used XML library that lost its maintainer [2]. Kempf's conclusion: "the mental health of the open source maintainers is something that large corporations don't care or don't see" [2].

They are fair about the other column. Kunhya acknowledges that Google is a major open source supporter [2]. After the dispute, the transcript records, Google changed its practice: "They are now starting to send patches" and reward fixes [2]. Fridman notes that the public rows produced results: donations have increased substantially, though "They're still not enough to cover even a single full-time developer" [2]. And one of the codecs VideoLAN is proudest of supporting exists because of big companies. Licensing for an earlier video standard grew so costly, Kempf says, that large platforms built their own royalty-free codec, AV1; VideoLAN wrote its decoder, and YouTube re-encodes popular videos with it [2].

Kempf's own choices show what the maintainers give, and to whom. He calls a license "a social contract" with the community [2]. He moved the core of VLC's library from one license to a more permissive one precisely so that companies such as game studios could embed it without opening their whole product, and to do it he had to track down more than 350 past contributors, including the father of a contributor who had died [2]. Over the years he refused offers worth tens of millions of dollars to bundle toolbars, change users' search engines or insert ads, because the only people offering were shady advertising companies [2]. His test is that he wants to go to bed proud of what he has done [2]. He also argues that selling out would have caused a fork and killed the project within years [2].

Their sharpest line about who does the work is a tweet from the FFmpeg account: "teenagers have written more assembly in FFMPEG than Google engineers." [2]

Where They Agree, and Where They Don't

Both sides believe open source creates value that closed development would not. Zuckerberg points to the innovation that followed Open Compute and Llama [1]. LeCun points to local-language models nobody at Meta would have built [3]. Kempf and Kunhya describe a "virtuous cycle" between their projects that underlies most video on the internet [2].

Both sides say concentration is the thing to avoid. Zuckerberg and LeCun fear a few organizations controlling AI [1][3]. Kempf refused money and, he says, requests from two intelligence agencies for backdoors, to keep VLC independent [2].

They disagree, implicitly, about what scrutiny does. Zuckerberg's security argument is that more eyes make software safer [1]. The FFmpeg experience is that eyes without hands make things worse: discovery has been industrialized and patching has not [2]. The two are compatible only if the scrutineers also contribute fixes, which is what Google began doing after the dispute [2].

They are describing different directions of flow. Meta's story is a company releasing its own work to the public. The FFmpeg story is companies consuming the public's work. Neither conversation examines the other direction closely. Zuckerberg does mention what flows back to Meta, the efficiency gains from llama.cpp, and treats it as a happy result [1]. From the maintainers' side the same thing, a company saving money through unpaid outside work, is the source of the grievance when it comes with demands [2]. Nothing in these sources accuses Meta of the conduct Kempf and Kunhya describe; their examples are Google and Microsoft [2].

They mean different things by "open". Kempf's licenses are a social contract in which contributors keep their copyright and anyone may use and modify the code on stated terms [2]. The first Llama was released under a non-commercial research license, which Zuckerberg himself calls a limited release [1]. The later Llama 2 is the one LeCun describes people fine-tuning freely [3].

They differ on who pays. Meta funds its openness from advertising revenue, by LeCun's account [3]. FFmpeg and VLC run on volunteers and donations that do not cover one full-time salary [2]. Kempf's alternative is commercial: companies around the project that sell contracts, and dual licensing for his new venture [2].

They differ on motive, and are frank about it. Zuckerberg's reasons include principle, recruitment, learning from the community and strategy [1]. Kempf's are ethical and personal [2]. Neither claims pure altruism. Kempf says he is not against money [2].

Why It Works

Why a company gives. The sources name five mechanisms. Researchers want to publish, so openness recruits them [1]. Outside developers improve the work for free, as with llama.cpp [1]. A shared design becomes a standard that others build on, as with Open Compute [1]. A company whose revenue comes from something else loses little by giving away a base technology [3]. And spreading a technology prevents rivals from monopolizing it [1][3].

Why a company takes without giving back. The FFmpeg account points to structure. The employee filing the bug does not know the project is run by volunteers [2]. The office that does know has not told the rest of the company [2]. There is no contract, so there is no invoice and no budget line. And automated tools have made finding problems cheap while fixing them remains expensive human work [2].

Why the projects survive anyway. Kempf and Kunhya describe people obsessed with the craft. Their AV1 decoder has roughly 30,000 lines of C and 240,000 lines of handwritten assembly, written under the motto "every cycle matters." [2] The threat of a fork disciplines anyone tempted to sell out [2]. And permissive licensing choices, made on purpose, keep companies using the code instead of replacing it [2].

Why pressure works. A project with 100 million users on a platform has leverage it can use once, publicly [2]. Embarrassment moved Google to send patches and raised donations [2].

Where It Applies, and Where It Doesn't

The generous account applies when the giver's interests and the public's line up. That is the case for a base AI model at a company that sells advertising, or a server design that benefits from a wider supplier base [1][3]. Zuckerberg says plainly that it does not extend to core product code, and that it may not extend to much more powerful models [1].

The exploitative account applies to infrastructure nobody owns. Codecs, parsers and compression libraries are used by everyone and are no single company's product, so supporting them is nobody's job [2].

Neither account is the whole of any one company. Google appears in the FFmpeg story as the sender of burdensome reports, as a major supporter, and as part of the group that created a royalty-free codec [2].

"Open" has to be read from the license. A research-only release and a copyleft library are both called open source in these conversations, and they permit very different things [1][2].

The safety argument for openness is conditional. Zuckerberg ties it to today's models being far from superintelligence [1]. LeCun says studies increasingly suggest language models give no real advantage over a search engine to someone seeking to cause harm [3]. Both are claims about the present.

What To Do With It

1. If your company depends on an open source project, find out who maintains it. Assume it may be a few volunteers and not a vendor [2].

2. Send a fix with the report. The complaint about AI-generated security reports was the imbalance between finding and patching, and the remedy Google adopted was to send patches and reward fixes [2].

3. Do not set priorities on a volunteer tracker. If something is urgent for your product, pay for it. Kempf's offer stands for the whole sector: a contract with service terms [2].

4. Fund the things you run on. Donations to FFmpeg rose after public attention and still do not pay for one full-time developer [2].

5. Read the license before calling something open. Check whether commercial use is allowed and what must be shared back [1][2].

6. When a company releases something, ask what it keeps and what it gains. Zuckerberg lists both: the core apps stay closed, and community improvements lower Meta's costs [1].

7. If you maintain a project, choose the license as a deliberate bargain. Kempf relicensed so that companies could embed his library, and uses dual licensing where he wants commercial users to pay [2].

8. Use public leverage sparingly and specifically. It got an Android bug fixed and changed a large company's reporting practice [2].

9. Refuse money that changes what the software does to its users. Kempf's refusal of bundling and advertising deals is the reason VLC has no ads or tracking [2].

10. Thank the maintainers, and support them. That is the closing message of the FFmpeg conversation [2].

Sources

1. Mark Zuckerberg on Open-Source AI, Llama, Moderation, Layoffs, Quest 3 and Jiu-Jitsu · Lex Fridman Podcast
2. FFmpeg and VLC with Jean-Baptiste Kempf and Kieran Kunhya: Codecs, Assembly, and the Volunteers Behind Internet Video · Lex Fridman Podcast
3. Yann LeCun: Meta AI, Open Source, Limits of LLMs, AGI & the Future of AI · Lex Fridman Podcast