The Cathedral, the Megachurch, and the Bazaar

https://opensourcesecurity.io/2026/01-cathedral-megachurch-bazaar/

by todsacerdoti • 6 months ago

178 114 6 months ago

mkoubaa• 6 months ago

There's a other group besides these: the secret society, who infiltrate the cathedrals, the megachurches and the bazaar. They are quite cultish, but thankfully the "Data Primacy Lodge" is gaining more initiates than the old guard "Order of Objects"

sowbug• 6 months ago

I stalled on Which is an acronym for “Gnu’s not Linux” and can't recover from the spin.

tormeh• 6 months ago

It's excellent. I grinned ear to ear.

k3nsa1• 6 months ago

It's actually "Gnu's Not Unix", the original article got it wrong too

karel-3d• 6 months ago

It's a joke. I think.

nextaccountic2• 6 months ago

It's just harmless trolling

z3512• 6 months ago

Given the tone of the article I’m sure it was tongue-in-cheek humor and not an error.

jbggs• 6 months ago

the article also says the creator of Linux is LTT

It's a joke

faxmeyourcode• 6 months ago

The TL;DR was that old open source was the cathedral of exclusive developers and groups. Then the Bazaar showed up (which was the Linux Kernel for example) and that freed us from the shackles of the cathedral.

I didn't make it past the tldr lol is this some kind of poisoned data for GPT 6?

pipo234• 6 months ago

Not sure if GPT played a role, but for one the editor did a poor job. Very sloppy writing indeed

mkesper• 6 months ago

It might be a reference to the GNU HURD: https://www.gnu.org/software/hurd/hurd/documentation.html

There's also an article about HURD vs Linux by RMS (origin seems to be 1996, last update 2009/2012): https://www.gnu.org/software/hurd/hurd-and-linux.html

zahlman3• 6 months ago

Big companies will often tithe to these megachurches. Some churches are bigger than others. The Linux Foundation makes hundreds of millions of dollars. Smaller foundations like the Python Software Foundation have to make do with only a few million.

This hides essential detail that would seem to very much weaken the argument. You have the Linux Foundation and the Mozilla Foundation that "make hundreds of millions of dollars", and then everyone else is orders of magnitude smaller. Python might be in third place, for all I know (or maybe it's Apache).

It shows how most open source projects aren’t some giant megachurch like group. These projects are one person.
It’s easy to assume everyone else is also a megachurch member, even if they are not. The church members are pretty noisy and get a lot of attention.

I suspect most of those random bazaar vendors would like to have a respectable church-sized building. Or at least a proper stall.

If you look at modern day open source, it sometimes feels like the megachurch open source is better because they have a nice parking lot, give out donation receipts, and it doesn’t smell like kabobs.

Well, no; it has more to do with the sense that outsiders are taking the bazaar seriously.

rectang• 6 months ago

The ASF, chartered as a 501(c)(3) nonprofit charity which serves the public good, has a budget a fraction the size of those of orgs chartered as 501(c)(6) nonprofits which serve the common business interests of members.

zahlman3• 6 months ago

The PSF is also 501(c)(3) (https://www.python.org/psf/mission/).

A quick check implies Apache is on the order of half the size, though. When I wrote the other comment it was just the only other name that came to mind.

einpoklum3• 6 months ago

those random bazaar vendors would like to have a respectable church-sized building.

I believe the analogy breaks down here some. That is, actual bazaar vendors may want this (I suppose), but FOSS maintainers may or may not want an organization to form around them. They may be content with the way things are; or they may just want a co-maintainer.

zahlman3• 6 months ago

I think most of them want some measure of success and notoriety. I'd imagine the large majority never even get a PR from a stranger. Long tail, you know.

xg15• 6 months ago

If we're working with those metaphors, I think it's useful to read up on how actual, real-life bazaars are operating.

In particular:

A bazaar or souk is a marketplace consisting of multiple small stalls or shops [...] They are traditionally located in vaulted or covered streets that have doors on each end and served as a city's central marketplace.
Merchants specialized in each trade were also organized into guilds, which provided support to merchants but also to clients. The exact details of the organizations varied from region to region. Each guild had rules that members were expected to follow, but they were loose enough to allow for competition. Guilds also fulfilled some functions similar to trade unions and were able to negotiate with the government on behalf of merchants or represent their interests when needed.
Historically, in Islamic cities, the muḥtasib was the official in charge of regulating and policing the bazaar and other aspects of urban life. They monitored things such as weights and measures, pricing, cleanliness, noise, and traffic circulation, as well as being responsible for other issues of public morality. They also investigated complaints about cheating or the quality of goods.

( https://en.wikipedia.org/wiki/Bazaar )

So not quite the anarchocapitalist, self-organizing utopia that tech people seem to imagine there - in fact, they have a lot of organization, both between merchants as well as on the bazaar as a whole.

Seems to me, this model is more similar to the "privately-owned marketplaces" we see increasingly in the digital world: App stores, merchant sites like Amazon, etc.

In that sense, "most of open-source" being on Github which is now owned by Microsoft is ironically more similar to a real bazaar.

With one difference: At least the administrators of real bazaars were public officials with a mandate to keep the market fair - and there was organization among the vendors in form of guilds. With digital marketplaces, the markets themselves are private assets and the administrators are blatantly self-interested. And there doesn't seem to be any kind if higher-order organization across different open source projects, everyone is fighting on their own.

So maybe it would do the open source community good to become more like an actual bazaar.

rzerowan2• 6 months ago

Seems to me, this model is more similar to the "privately-owned marketplaces" we see increasingly in the digital world: App stores, merchant sites like Amazon, etc.
In that sense, "most of open-source" being on Github which is now owned by Microsoft is ironically more similar to a real bazaar.

Id put it that this is incorrect insofar - as the bazaar was/is a public commons with a dual regulatory environment city(state) and the guilds , which would enforce/regulate as needed.

The digital marketplaces we have would be more anologous to feudal plantations ,where each coder(sharecropper) survives at the whim of their particluar feudal lord , who have total control within that space and the state via lobbying mostly keeps off.Theer are no guild equivalent so when Playstore/Github makes a ruling like the recent hike of dev fees or ci runner. Theres no state or user leverage that can force a reversal other than complaints.

Paradoxically id say they are more megachurch than bazaars.

wahnfrieden• 6 months ago

Guilds are now scorned as communism

attila-lendvai• 6 months ago

re anarchocapitalism: it doesn't imply lack of organization, nor how the organazitional structure gets formed.

its essence is a perspective on the legitimate use of force, on what principles should govern the use of force. and your quotes don't discuss any of that in the context of the bazaar prior to your offhand dismissal of the concept.

i.e. we don't know how close the organization and enforcement of the bazaar was to ancap priciples.

if e.g. all the enforcement were that you were simply not allowed to enter the bazaar until you complied, then it's fully compatible.

jhatemyjob• 6 months ago

Kind of offtopic but fun fact I didn't know until recently, the Moldbug definition of Cathedral is based (lol) on the Eric Raymond definition

ThrowawayB72• 6 months ago

"...Microsoft. Who we haven’t mentioned in this story, but they hated Linux more than a toddler hates naps."

A lot of FOSS people think this but it's not really true. It was a thorn in the side of MS executives as a competitor, sure, but I never met anyone in the rank and file that could be bothered to hate Linux. More than a few of my colleagues played with Linux at home in the '00s. I cut my teeth on the commercial UNIXes so there wasn't anything interesting about Linux to me until it had caught up with them around 2010 or so.

ronsor• 6 months ago

People mean Microsoft, the corporation, as a policy. Not every employee there literally.

sunsetSamurai• 6 months ago

you're trying to rewrite history here, Microsoft used to be a well known linux hater, but linux became popular and they had no choice but to accept it. Remember the "linux is cancer" years...

ThrowawayB72• 6 months ago

I was there a couple decades and you weren't.

canadaduane• 6 months ago

"Don't look him up, he's not exactly role model material." I don't admire the ethos of putting people in bad boxes.

nilamo• 6 months ago

On the otherhand, I greatly appreciate that we don't pretend everyone is 100% awesome all the time. We shouldn't hold people up as role models that we don't want to emulate, and whatnot.

philipallstar• 6 months ago

If we're not pretending everyone is awesome then why permanently deselect certain people as role models?

Brian_K_White2• 6 months ago

One of them is legit a saint and the other almost as much. They absolutely are role models, and the way they are talked about now is exactly a lesson in the problem. If more people emulated them, the world would be a much better place.

gwbas1c• 6 months ago

I think enough of us have imperfections that we can appreciate that people who've done wonderful things have also done some very $#!tty things. Someone doesn't need to be a saint to still have a wide, positive influence.

tptacek11• 6 months ago

Which wonderful things are you referring to?

jwrallie• 6 months ago

It also instigates people to look at the worst in others. Don't think about pink elephants!

brid• 6 months ago

The Cathedral metaphor doesn't make any sense since the point of the Cathedral is simultaneously to revere God and to be able to take in as many "unwashed masses" as possible. Only by self-exclusion (explicit external irreverence/scandal) can you be excluded.

larrydag• 6 months ago

It works for me. Cathedral is analogous to free software being a religion. It is a theocratic worldview that has a zealous following that must apply the rituals of old. Bazaar is the marketplace. It is supposed to be a efficient market metaphor for software being transactional and not relational.

Is this a perfect metaphor? I think its a rigid way of looking at software on either side. I think it is more grey. I like the merits of both sides.

asveikau2• 6 months ago

But ESR believed in right wing, libertarian adjacent politics. He's advocating for deregulated, free market ideas in the form of criticizing GNU. In doing this, he was seeking out the preferred metaphor and working backwards, rather than describing what is.

jt2190• 6 months ago

That is not what Eric S. Raymond (esr) was describing.

GNUnix was developed using the Cathedral-style, Linux was developed using the bazaar-style. How Linux development was coordinated was thought to be impossible for something that had to be as solid as an operating system. The essay is a deep dive, exploring the conditions that the Linux project needed to ship an OS.

afiori• 6 months ago

The metaphor does not refer to the finished building but to the building process

yellowapple3• 6 months ago

The “unwashed masses” are the end users; both “cathedrals” and “bazaars” welcome all users to partake without demanding an entry fee. The difference between a “cathedral” v. a “bazaar” is whether or not those “unwashed masses” are easily able to become the “staff”; the analogy hinges on the relative difficulty required to join the “clergy” v. become a “merchant”.

jrowen2• 6 months ago

The author links to another article of theirs called "Open Source is Bigger Than You Can Imagine," which hinges on the size of the npm registry. npm says "open source" on their landing page, and has an "npm Open Source" section of their policies, which places no restrictions on how you license your npm package (save for a special license to them).

This does seem very bazaar to me, but this would all be deemed Not Open Source by the [cathedral/megachurch?] community, correct? Do people take issue with npm using the term open source?

yellowapple3• 6 months ago

Why would that all be deemed “Not Open Source”?

jrowen2• 6 months ago

My understanding is that something can only be called Open Source (vs. Source Available) if it uses one of the approved licenses that uphold the GNU Four Freedoms of Software. Which isn't a requirement of npm.

dfajgljsldkjag• 6 months ago

I like the idea that we moved from cathedrals to megachurches because it explains why everything feels so corporate now. It is easy to forget that the messy bazaar is still underneath all the shiny tools we use.

rbanffy• 6 months ago

Large endeavours require some level of “megachurchness”. Linux back then was tiny in comparison with what it is today. So was Python. Nowadays we have much larger projects that encompass a much larger space than we had in the 1990s. You can’t make things consistent at these sizes without some governance in place.

There are still a lot of space for projects without much structure- if you have NSA codenames that aren’t public yet (and you are not subject to US laws) you can contribute with the nsaname tool and have cool names for your servers and containers. If you want to help adding glyphs to my 3278 font, you can. You can do that to millions of small projects that are small enough to not require much structure.

emchammer• 6 months ago

It's a great phrase which explains how a company like Apple can take good ideas, implement the parts they like, and not give back.

uncletaco• 6 months ago

History will probably remember him as LTT, “Linus The Torvalds”

This is trolling right?

pstuart• 6 months ago

This is trolling right?

Yes, and well done as well. Unlike the other two unmentionables, Linus very much worthy of remembrance. Sure he was extra grumpy for a long time but that's about the only bad thing you can say about the man.

asveikau2• 6 months ago

There are a lot of tangential, one-liner, throwaway jokes in this article.

stronglikedan• 6 months ago

Yes, everyone knows LTT is Linus Tech Tips!

yxhuvud2• 6 months ago

It is a reference to Torvalds making an appearance on the LTT youtube channel, intentionally getting the LTT meaning wrong.

tptacek11• 6 months ago

It was a bad essay at the time and I don't think you can make a good essay by trying to build off it. Adding "megachurch" to the already strained metaphor didn't improve it.

https://news.ycombinator.com/item?id=35939383

sethev3• 6 months ago

As you point out in your linked comment, the original essay captured the zeitgeist of the time. It also influenced and inspired many people. From that perspective, it's hard for me to agree that it was bad. However, I don't think the content was original at the time (perhaps that's what you mean by bad?) - in the sense that ESR wasn't out ahead of people blazing some new trail and it also didn't hold up very well factually.

Taniwha2• 6 months ago

Yeah, it's worth remembering that at the time a compiler cost $10k+, an OS $1000s/year - you couldn't work on OS or compiler work unless you worked for a big hardware company - a whole lot of interesting work was locked away from most programmers

tptacek11• 6 months ago

It was certainly influential. It's just bad on its own merits.

renewiltord2• 6 months ago

The latest thing though is that the megachurches send out these evangelist priests who run an inquisition into your amounts tithed. These people then go around trying to co-opt the machinery of the state to redirect money to the megachurches.

“We should tax everyone to fund open source” they say

“Google should pay a percentage of their gross revenue to the Rust Software Foundation” they say

All this is because it’s enough for the bazaar to create but the author has correctly identified that the purpose of the megachurches is to receive tithes.

The Rust megachurch is one of the biggest proponents of this and its adherents are always trying to take our money by force because we won’t give it by will https://news.ycombinator.com/item?id=46048954

Rust delenda est.

kiba2• 6 months ago

Free and open source software provide a ton of value to businesses and consumers. It's right that tax dollars is used to fund what effectively is a public good so that we can all benefit from it even more.

renewiltord2• 6 months ago

[flagged]

shiroiuma• 6 months ago

I can see a government requiring itself to provide some funding to open-source projects that it actually makes a lot of use of. But not just open-source in general; no one needs to get funding for some pet project that only that one person cares about and isn't very good anyway: putting some crappy chatGPT-generated code on GitHub should not qualify you for government funding.

dgreensp• 6 months ago

I always interpreted cathedral vs bazaar as being about the architecture of large things. Do you build to a master plan? Or does everyone do whatever they want? (Within some kind of framework, of course.) Like the cathedral of the Java SDKs vs the flea market of NPM.

This author seems to have some kind of attitude about organization in general—anything with people and process, that happens to exist around some project, that might require at least a small commitment to be a part of. Like complaining that a flea market has a form to sign.

The ability for people to functionally collaborate, with some kind of structure, is the key thing that enables building large things together.

TZubiri• 6 months ago

With that title, I'm clicking and reading all the way through.

I'm writing an article on a similar topic, but it's a critique on a popular development style that imports a huge dependency supply chain (without concern on if they are cathedral, bazaar, or megachurches), and what the benefits of building your thing bottom-up has.

If this sounds interesting to you, hacker news reader, you can leave a comment and I'll reply with a link once it's published.

emanueleo• 6 months ago

The article says "GNU's not Linux". No, it's "GNU's not Unix".

robocat• 6 months ago

You can't correct humour.

When something is obviously wrong, perhaps learn to ask yourself if it's trying to be funny. Is dead Python funny?

singpolyma3• 6 months ago

It's so confidently written too, lol. Like. Think about what an acronym is and if it could possibly stand for something with an L...

Kholin• 6 months ago

To be fair, there is nothing wrong with either of them.

femto• 6 months ago

The post referred to the Sovereign Tech Agency (https://www.sovereign.tech). The problem that the Sovereign Tech Agency is trying to solve seems to be a hard one.

OpenPrinting is listed as a funded project:

https://www.sovereign.tech/tech/openprinting

yet 7 days ago someone who works on OpenPrinting was here and stated:

"The whole printing stack is supported by 4 people, 2 of whom are doing that since the inception of CUPS in 1999. Scanning is maintained by a single person."

https://news.ycombinator.com/item?id=46579361

Isn't this the situation the Sovereign Tech Agency is trying to avoid?

luplex• 6 months ago

idk, without the sovereign tech agency it would be fewer people, or they would have less time to work on the project. You can't expect the German government to completely fill any need for resources in open source software.

einpoklum3• 6 months ago

Yikes :-(

This makes me wonder - is there some platform on which people who maintain important (or arguably-important) facilities can post Wanted ads for volunteer co-maintainers?

I realize that the number of people who would actually be crazy enough to browse that platform and answer such ads is pretty small... but - it may be noticeably above Zero.

marcus_holmes• 6 months ago

Who's going to vet the applicants to ensure that they're not secretly working for bad people, and that as soon as they have sufficient permissions/lack of oversight they'll inject malware into the project and ship it?

We're seeing ever-increasing supply chain attacks. All these bazaar projects are vulnerable to that.

It's going to take some serious funding to get the kind of oversight we actually need to secure this stuff properly.

And the clock's ticking - those maintainers from the 90's are going to retire, and we need to have some way of replacing them

queenkjuul5• 6 months ago

Back in the early days there was a person named esr. Don’t look him up, he’s not exactly role model material.

Love it

bigpeopleareold• 6 months ago

Whoops, looked him up. Growing a big moustache out and changing my political affiliations as I write this.

queenkjuul5• 6 months ago

I warned you

deadbabe• 6 months ago

Cathedral, Megachurch, Bazaar, and now in the age of AI: The Chinese Room.

yxhuvud2• 6 months ago

If nothing else, the history recap is absolutely brilliant.

utopiah• 6 months ago

To the author :

"Sovereign Tech Agency. They are funding open source with no strings attached. It’s likely there are other things similar I don’t know about yet (do let me know)." checkout NLNet

zjaffee• 6 months ago

One thing that is repeatedly underdiscussed about open source is that every time you have a major open source project become successful, be that anything from Linux to Apache Spark, you have private companies who come in, build something that can very reasonably still be called Linux or Apache Spark, but underneath has tons and tons of extra stuff that they never feed back into the open source community.

Hell, I think with the later (since all major cloud providers deploy their own version of spark on their respective data processing cluster services), people don't even know that they aren't in fact using open source software. Hell, eventually you get to a point where companies that choose not to use these third party services eventually just open source their own improvements or abstractions as again separate open source projects that never make it into the upstream project (which are often times heavily influenced by profit making entities).

This has been the model for a very long time, going back to at least the likes of redhat. And certainly will be going forward with countless future projects. Maybe there needs to be new models of open source governance, but I have no clue how successful such a thing would even be.

ekianjo• 6 months ago

but underneath has tons and tons of extra stuff that they never feed back into the open source community.

Very unlikely for GPL2 projects

pjmlp3• 6 months ago

See cloud provider specific distros, or Android Linux kernel.

Thing is, when they misbehave, someone has to have the money to bring them to court.

Projectiboga• 6 months ago

This essay's main point was to wander thr Bazaar and rummage around the wares on their tables. He suggests to find some places to contribute. Not in a brash self serving way but looking to make things and one's self better.

kazinator• 6 months ago

The only flaw in the introduction of the megachurch to the analogy is that cathedrals were large projects built by megachurches.

The Cathedral, the Megachurch, and the Bazaar

Related Stories