Free software isn't made by volunteers alone. The world's biggest companies pour billions into open source projects โ because it's good for everyone, including them. Here are 25 real examples with the motivation behind each dollar.
Each one: who pays, why they pay, and what you get for free.
ClamAV is the world's most widely used open-source antivirus engine. Originally created in 2001 by Tomasz Kojm, it was acquired by Sourcefire in 2007 (for ~$5M), and when Cisco bought Sourcefire for $2.7 billion in 2013, ClamAV came with it. Cisco now fully funds ClamAV's development team.
ClamAV scans email attachments at ISPs, universities, and companies worldwide. It protects billions of emails daily. Cisco integrates it into their commercial security products while keeping the core engine open source.
Cisco builds commercial security products (Secure Email, AMP) on top of ClamAV. The open engine gets virus signatures from the global community โ far more threat intelligence than Cisco could collect alone. Open source = better threat detection = better commercial products.
Before Let's Encrypt, getting an HTTPS certificate cost $50โ$300/year per domain. Most small websites couldn't afford encryption โ meaning passwords and data traveled in plain text. Let's Encrypt launched in 2015 and provides free, automated SSL/TLS certificates. Today it secures over 360 million websites โ over 80% of all web traffic.
An encrypted web is better for everyone. Google wanted HTTPS everywhere (for Chrome security). Mozilla wanted privacy for all users. Cisco and Akamai benefit from a secure infrastructure. EFF fights for digital rights. Each sponsor has different motivations โ but the result is the same: free encryption for the entire internet.
OpenSSL encrypts virtually every HTTPS connection on Earth. For years, it was maintained by just 2 full-time developers on a shoestring budget. Then the Heartbleed vulnerability (2014) exposed that the world's most critical security library was dangerously underfunded.
After Heartbleed, the Linux Foundation created the Core Infrastructure Initiative (now OpenSSF โ Open Source Security Foundation) with $150 million in pledged funding from Google, Microsoft, Amazon, Intel, IBM, and others to secure critical open source infrastructure.
Heartbleed cost the industry an estimated $500 million in emergency patches and breach response. Companies realized: if OpenSSL breaks, the ENTIRE internet breaks. Funding security infrastructure is cheaper than cleaning up after the next catastrophe. Self-preservation drove corporate generosity.
The Linux kernel is the foundation of Android, Chrome OS, all cloud servers, supercomputers, and most IoT devices. While Linus Torvalds started it alone, today 65โ75% of kernel contributions come from PAID corporate developers. The Linux Foundation โ funded by 1,000+ member organizations โ employs Linus and key maintainers directly.
Every major tech company RUNS on Linux. Google's entire infrastructure, Amazon's AWS, Microsoft Azure (runs more Linux than Windows!), Samsung's phones, Tesla's cars โ all Linux. Contributing to the kernel means their specific hardware/cloud features get supported. Not funding Linux would be like not maintaining the road your trucks drive on.
Google funds thousands of engineers working on Chromium โ the open-source browser engine. Chrome is built ON Chromium. So is Microsoft Edge, Brave, Opera, Vivaldi, Arc, and Samsung Internet. Google spends an estimated $1โ2 billion annually on Chromium development.
More browsers using Chromium = more web traffic going through Google's engine = more people using Google Search = more ad revenue. Chromium is the engine of Google's $200B+ ad business. The billions they spend are a tiny fraction of the return.
Created by Google engineers (based on their internal Borg system), donated to the Cloud Native Computing Foundation (CNCF) under the Linux Foundation. Now funded by every major cloud provider because all their customers demand it.
K8s is the foundation of modern cloud. Every cloud vendor wants customers to run K8s on THEIR cloud. Contributing makes their platform run K8s best. Google created it as a Trojan horse for Google Cloud โ but it outgrew Google and now benefits everyone.
PostgreSQL started at UC Berkeley in 1986. Today it's the fastest-growing database in the world, rivaling Oracle's multi-billion-dollar product โ for free. Major sponsors employ core developers full-time.
Every cloud sells managed PostgreSQL. AWS Aurora PostgreSQL is one of their most profitable services. Microsoft acquired Citus Data to build PostgreSQL into Azure. The database is free; managed hosting is a multi-billion dollar business.
Created by Ryan Dahl in 2009, Node.js moved to the OpenJS Foundation (part of Linux Foundation). Corporate sponsors employ many of the core contributors.
Node.js runs backend services on every cloud. Microsoft uses it in Azure Functions. Google uses it in Firebase. More Node.js usage = more cloud compute sold.
Created by Meta's AI Research lab (FAIR), PyTorch became the dominant framework for AI research. In 2022, Meta donated PyTorch to the Linux Foundation's PyTorch Foundation to ensure neutrality. Meta still funds most development but governance is now independent.
If researchers use PyTorch, their models are easy to deploy on Meta's infrastructure. PyTorch papers become Meta's competitive advantage. Plus, Meta recruits AI talent by being the home of the tool they already love.
Hugging Face hosts open-source AI models, datasets, and demos. Their Transformers library is the most-used AI library in the world. Valued at $4.5 billion, funded by investors AND strategic partners.
Google and Amazon each invested $100M because developers who use Hugging Face deploy models on their clouds. NVIDIA funds it because more AI models = more GPU sales. Everyone benefits from a thriving open AI ecosystem.
LLVM started as a university project by Chris Lattner. Apple hired Lattner and made LLVM the foundation of all Apple development (Swift, Objective-C, Metal GPU). Google uses it for Chrome, Android (NDK), and TensorFlow. Almost every modern compiler uses LLVM.
Every company needs compilers optimized for THEIR hardware. Apple needs LLVM for Apple Silicon. Intel for x86. ARM for mobile chips. NVIDIA for GPU kernels. Sharing a compiler is cheaper than each company building their own.
Python's creator Guido van Rossum worked at Google (2005โ2012) spending 50% of his time on Python. After retirement, he joined Microsoft (2020โpresent) leading a team dedicated to making Python faster. Microsoft employs 5+ core Python developers full-time.
Python is the #1 language for data science, AI, and cloud automation โ all of which drive cloud revenue. A faster Python = more workloads on Azure/GCP = more revenue. Microsoft investing in Python's speed directly boosts Azure usage.
Created at Mozilla by Graydon Hoare. After Mozilla's layoffs (2020), the Rust Foundation was created with founding members each contributing $1 million/year.
70% of security vulnerabilities are memory-safety bugs. Rust eliminates them. Microsoft wants Rust for Windows. Google wants Rust for Android and Chrome. AWS wants Rust for cloud infrastructure. Each saves billions in security costs.
Created by Google engineers Rob Pike, Ken Thompson, and Robert Griesemer. Google funds the entire Go team (~30+ engineers). Go powers Docker, Kubernetes, Terraform, and much of Google's infrastructure. Google pays for everything.
Go makes Google's cloud services faster and more reliable. Every Go developer is a potential Google Cloud customer. The language is the marketing.
npm (Node Package Manager) hosts over 2 million packages downloaded 50 billion times/month. GitHub (Microsoft) acquired npm in 2020 and funds its infrastructure โ serving the entire JavaScript ecosystem for free.
npm + GitHub = Microsoft controls the two most important developer platforms. Developers who use npm deploy on Azure. The developer funnel starts with free tools.
Docker donated containerd (its core runtime) to the CNCF. Now maintained by contributors from AWS, Google, Microsoft, IBM, and Docker. The container standard (OCI) is also open, ensuring containers work everywhere.
A shared container standard benefits all clouds equally. No vendor wants to be locked out. Open standards prevent monopolies โ and every cloud sells container hosting.
Created at Yahoo by Doug Cutting (who named it after his son's toy elephant). Yahoo funded the team, then Cloudera (raised $1B+, Hortonworks merged in) and others took over. Hadoop made "big data" possible for every company, not just Google.
Yahoo needed to process billions of web pages. Building it open-source meant contributions from Facebook, LinkedIn, and others โ all improving Yahoo's infrastructure for free.
Created at UC Berkeley's AMPLab. The creators founded Databricks to commercialize it โ valued at $43 billion (2023). Spark remains open source under Apache License. Netflix, Uber, and thousands of companies use it daily.
Open-source Spark โ everyone learns it โ they need managed hosting โ Databricks sells that hosting. Classic open-core: the engine is free, the enterprise features cost money.
Created by Torkel รdegaard in 2014. Grafana Labs raised $240M+ and is valued at $6 billion. The core dashboard is open source (AGPL); Grafana Cloud is the paid managed service. Used by 1M+ active instances worldwide.
Open-source Grafana = massive adoption = everyone needs someone to run it at scale = Grafana Cloud. 800,000+ organizations install it; a fraction pay for cloud = billions in revenue.
Google acquired GIPS (Global IP Solutions) for $68 million in 2010 and open-sourced their entire video/audio codec technology as WebRTC. Now built into every browser โ enabling video calls without plugins.
Google wanted video calling built into Chrome (for Google Meet/Hangouts). Making it open ensured ALL browsers supported it โ so Google Meet works everywhere without downloading anything. $68M spent to make Google Meet frictionless = massive ROI.
Matrix is an open protocol for secure, decentralized messaging. Element is the main client. The French government deployed it for all government communications (replacing proprietary tools). The German Bundeswehr (military) uses it. Mozilla uses it for internal chat.
Governments need messaging they CONTROL โ not dependent on US tech companies. Sovereign communication requires open source that can be audited, self-hosted, and trusted. This is digital sovereignty in action.
FFmpeg converts, streams, and processes virtually ALL video on the internet. YouTube transcodes with FFmpeg. Netflix encodes with it. Chrome plays video through it. WhatsApp compresses video with it. Almost no one credits it, but major sponsors now fund development.
If FFmpeg breaks, YouTube breaks. If FFmpeg is slow, Netflix buffers. Every company that handles video depends on FFmpeg. Funding it is an act of self-preservation. The estimated cost to build FFmpeg from scratch: $1.5+ billion. Total annual funding: a fraction of that.
The Academy Software Foundation (ASWF) โ under the Linux Foundation โ manages open-source tools used in every major movie: OpenEXR (HDR images), OpenColorIO (color management), OpenTimelineIO, OpenVDB (volumetric data), and MaterialX.
VFX studios share tools because movies involve DOZENS of studios collaborating. If each used proprietary formats, collaboration would be impossible. Shared open standards let Pixar, Weta, ILM, and Sony exchange assets seamlessly. Competition is in the ART, not the tools.
RISC-V is an open-source instruction set architecture (ISA) โ the design blueprint for making processors. Anyone can manufacture RISC-V chips without paying licensing fees (unlike ARM's $billions in royalties).
ARM charges licensing fees. Intel controls x86. China, Europe, and India want chip independence โ RISC-V gives them that for free. Google uses RISC-V in security chips. Qualcomm evaluates it for wearables. It's the biggest open-source hardware revolution since Arduino.
Free software โ charge for hosting, support, enterprise features. AWS makes $90B/yr mostly hosting free open-source software. Red Hat sells $5B/yr in support for free Linux.
Building a kernel, compiler, or database alone costs billions. Sharing the cost across 50 companies = each pays 2%. Linux, LLVM, PostgreSQL โ collective investment beats solo spending.
Google open-sourced Kubernetes, Android, TensorFlow, Go โ each became THE standard. When your tool is the standard, you control the ecosystem. The standard-setter always wins.
Open-source projects are the best recruiting pipeline. Meta (React, PyTorch), Google (Go, K8s), Microsoft (VS Code, TypeScript) โ developers who love these tools want to work on them.
After Heartbleed cost $500M+, big tech realized: unfunded critical infrastructure = ticking bomb. OpenSSF's $150M fund exists because NOT funding it is more expensive than funding it.
Governments fund Matrix (France), RISC-V (China, EU, India), and Linux to avoid dependence on US tech companies. Open source = national security.
Open source is cooperation at its finest โ even competitors (Google + Microsoft + Meta) work together on Linux, Kubernetes, and RISC-V because shared infrastructure benefits everyone. When even rivals cooperate for the common good, everyone wins.