---
title: "A 2026 typology places \"protestware\" among fourteen open-source software sub-genres, flagging it as under-studied"
type: "claim"
status: "budding"
audit_status: "capture-verified (promoting agent re-fetched the arXiv:2607.01750 abstract directly 2026-07-11, confirmed protestware is named among 14 sub-genres, and corrected the capture's erroneous 'six under-studied' figure)"
source_url: "https://arxiv.org/abs/2607.01750"
source_title: "Open Source Is Not One Thing: A Typology of Open-Source Software Sub-Genres"
source_author: "Mohamed Ouf and Rowan Hussein"
source_date: "2026-07"
source_quote: "multi-company co-opetition, protestware, and open-source appropriate technology"
source_tier: 1
provenance: "Promotion from 10-inbox/raw/2026-07-09-hop-protestware-npm-node-ipc.md, 2026-07-11"
origin: "batch"
derived_from: "10-inbox/raw/2026-07-09-hop-protestware-npm-node-ipc.md"
writer_model: "claude-opus-4-8"
date_created: "2026-07-11T00:00:00.000Z"
tags: ["open-source","software-supply-chain","protestware","taxonomy","labor","policy"]
---


The preprint "Open Source Is Not One Thing: A Typology of Open-Source
Software Sub-Genres" (Mohamed Ouf and Rowan Hussein, arXiv:2607.01750, July
2026) argues that empirical OSS research over-generalizes: it samples across
incompatible governance and funding models — treating them as one population
— when open source in fact "comprises distinguishable sub-genres" that may
not share findings. From a multi-source review of 3,925 papers the authors
name **fourteen** sub-genres. The well-studied cluster includes
community-driven, company-backed, foundation-governed, research-and-scientific,
and open-source-for-social-good projects; the under-studied cluster they flag
for dedicated empirical treatment is "multi-company co-opetition, protestware,
and open-source appropriate technology."

*Protestware* — projects whose maintainers weaponize their own code for
political or economic ends — is thus admitted, four-plus years after the
node-ipc incident ([[claim-node-ipc-2022-maintainer-shipped-geotargeted-wiper]]),
as a named line item in a formal taxonomy rather than an anecdote folded into
"OSS" broadly. The typology's contribution is the framework and a research
agenda questioning whether results from one sub-genre transfer to others; it
does not itself measure protestware's prevalence.

The claim connects to the vault's existing "maintainer as a single point of
failure/agency" thread. The structural precondition the taxonomy is naming —
one trusted, often unpaid maintainer with unilateral power over software
millions depend on — long predates both the 2022 war and AI
([[claim-single-maintainer-global-blast-radius-predates-protestware]]), and is
the same fragility the vault tracks in its AI-agent register:
[[claim-mj-rathbun-ungated-agent-published-hit-piece]] (an agent attacking a
maintainer) and the agent-supply-chain security frames
([[claim-toctou-named-frame-browser-use-agents]],
[[claim-confused-deputy-2026-ai-agent-security-frame]]).

> [!note] Seek's commentary: The surprising thing here isn't that a developer
> sabotaged his own code — it's that "protestware" was significant enough by
> 2026 to earn its own row in a formal sub-genre taxonomy of open source. That
> is a field admitting a political-economy category into its technical
> vocabulary. Worth flagging for Cali: the source capture said "six
> under-studied sub-genres"; the abstract says fourteen sub-genres total with
> three under-studied ones named. I corrected the number against the primary.
> — Seek