Open Source, Licensing and Exam Technique

Munich's LiMux project was the most high-profile open source migration in government history. Between 2004 and 2013, the city migrated 14,000 computers from Windows XP to a customised version of Ubuntu Linux called LiMux, replacing Microsoft Office with LibreOffice. The project saved an estimated 11 million euros.

But staff complaints accumulated: LiMux struggled with compatibility issues when exchanging documents with other organisations using Microsoft Office. Certain specialised government software only ran on Windows. The user experience was different enough to require retraining. In 2017, the new city council voted to return to Windows 10 and Microsoft Office, at a cost the city estimated at 49 million euros. Critics pointed out that Microsoft had moved its German headquarters to Munich in 2016, and questioned whether the reversal was technically necessary or commercially influenced.

The real lesson is not that open source is bad or good, but that migration requires whole-systems thinking: compatibility with external partners, training, specialist software dependencies, and long-term maintenance all matter as much as licensing costs.

OpenSSL is an open source cryptographic library used by approximately two-thirds of all websites to secure HTTPS connections. In April 2014, a vulnerability called "Heartbleed" was publicly disclosed. The bug had existed in the code for two years, allowing attackers to read the memory of servers running the vulnerable version, potentially exposing encryption keys and user passwords.

Heartbleed affected an estimated 17% of all "secure" websites on the internet. Companies including Yahoo, Tumblr, and the Canadian Revenue Agency were all affected. The Canadian Revenue Agency had 900 social insurance numbers stolen as a direct result.

The case illustrates the complexity of open source security: the code was transparent and could have been audited at any time, but the critical OpenSSL library was maintained by just four people, two of whom were volunteers, on a budget of $2,000 per year - despite being relied upon by most of the internet. After Heartbleed, the Core Infrastructure Initiative was established to fund critical open source security projects.

In March 2024, a Microsoft engineer named Andres Freund discovered, almost by accident, that XZ Utils - a widely used open source data compression library present in millions of Linux servers - had been deliberately sabotaged. A malicious backdoor had been carefully inserted into the software over the course of two years.

The attacker, operating under the pseudonym "Jia Tan," had spent nearly three years building a reputation as a legitimate contributor to the XZ Utils project. They submitted useful bug fixes, built trust with the single overworked volunteer maintainer, gradually took on more responsibility, and eventually gained commit access to the codebase. They then inserted a deeply obfuscated backdoor that would have allowed remote unauthorised access to any system running the affected versions, potentially affecting millions of servers worldwide. The backdoor was discovered just days before it would have been included in stable releases of major Linux distributions, making it one of the most significant near-misses in software security history.

The case raised profound questions about the open source model: critical infrastructure relied on by almost every internet-connected organisation was being maintained by a single unpaid volunteer. The vulnerability of the open source supply chain - where any contributor can potentially insert malicious code - was dramatically exposed. Several technology companies pledged increased funding for open source maintenance following the discovery.