PHK's last Bikeshed: the end of FOSS as we know it

Poul-Henning Kamp — FreeBSD contributor, author of the Varnish HTTP cache, and 40-year Unix veteran — wrote his final "Bikeshed" column for ACM Queue in 2026. The Bikeshed ran roughly once a year for almost 20 years, starting when Kode Vicious mentioned acmqueue wanted an article on flash memory and Kamp asked "how many words?" He signs off deliberately as a farewell, framing the whole piece as a set of predictions he hopes will turn out wrong. Two topics dominate the FOSS inbox as he leaves: LLM-assisted code review and age verification.

LLM code review: a bubble artifact, not a turning point

Kamp isn't worried about LLM code review. He's run every code-quality tool he could find since reading about lint(1) in 1984, and the curve is always the same shape: days 1-2 the tool finds a pile of real problems, days 3-5 a few solid bugs and some technically-bugs, and by week two the well is dry. He expects LLM tools to follow that curve, and guesses the industry has already surfaced more than half of the eventual "worst bugs found by LLM tools" list — precisely because a hype-driven industry would rush its most impressive finds out the door immediately. This is the same "no free lunch" intuition Bennett draws from Brooks: real but bounded gains, front-loaded, then diminishing returns.

Where he sees genuine value is the chess analogy. LLMs search the tree wider and deeper than a human brain, which evolved to conserve energy by only looking where the odds seem good. Security is a chesslike game, so tireless breadth-first searching helps both attack and defense. His actual doubt is economic, not technical: all the cost is up front in training, and the resulting weights fit on a pocket-sized drive that must be sold millions of times to recoup. He likens it to a film production — huge sunk cost, a 4K stream that fits in your pocket, profit in fractions of a teenager's allowance — except Hollywood wrapped itself in copyright, while the LLM industry keeps reciting "fair use" in the infringement suits against it. So it's unclear who pays to train the next generation of these models once the bubble pops and returns diminish. That funding-mechanism question is the same one running through ai-subsidy-economics and subprime-ai-crisis.

Age verification, attestation, and the actual thesis

The prediction he cares about: age verification is the beginning of the end for FOSS as we know it. The reasoning is a chain, not a slogan.

Encryption backed nation-states into a corner. After Snowden, a generation of engineers who "grew up free of adult supervision" reacted by encrypting everything, to the point where covering online tracks is trivial and most digital crime goes unreported because police can't act on it. Kamp — citing the Sun-Tzu-or-Clausewitz warning about not leaving your enemy only a path over your own corpse — argues the tech industry did exactly that to governments, and states are now climbing out of the corner. He explicitly assigns blame: protocols could have been designed to be minimally compatible with "a nation of laws," but insisting compromise was treason means everyone loses more privacy than necessary.

Age verification breaks FOSS specifically. If a kid can edit the source and recompile, no age gate holds. The only answer is cryptographically attested software integrity — someone signs that this OS can be trusted, which they won't do if the user can modify and rebuild it. So the web fractures: parts you reach with any browser on any device running any software, and a growing part reachable only from an "attested computing platform" you may have source for but cannot alter. This is the flipside of the trust boundary that sandboxing-ai-agents and simplified-model-of-fil-c treat as a safety feature — here the same attestation locks the user out of their own machine.

Accountability is the biggest force. Two decades of "globalism" let U.S. firms capture the European IT market, and now the EU wants digital sovereignty back — but there is no European Google, Apple, Oracle, Microsoft, Facebook, or Twitter to negotiate with. There's also nobody to sign a contract with for FOSS, whose licenses all share a "Don't blame me" clause. Officials raised on "blame allocation" (deflect rather than fix) can't drive a stick shift where the buck actually stops. The EU carved FOSS out of legislation like the Cyber Resilience Act, but the carveouts end the moment you make a profit — and there's a lot of profit coming, which hastens the end too.

The BDFL era closes

The deeper structural problem is one this wiki already tracks in oss-sustainability: much FOSS "exists at the pleasure of a single person" who may neither know nor care how much sits on top of their code. Maintainer burnout is here; Kamp expects maintainer death to rise, because FOSS looks increasingly generational, "like bell-bottom jeans and flower power." Recruiting apprentice maintainers already fails, and fails completely when the maintainer role is pro bono while "FOSS stewards" and "FOSS manufacturers" profit from the same code. His conclusion: the Benevolent Dictator for Life is finished; consequential projects will be run by committees appointed by a steward or a company. That is the same funding-and-succession gap i-dont-want-your-prs and supply-chain-security circle around, arriving here as a governance forecast rather than a call for donations.

What's left of FOSS, in his telling, is thin: you can read the source, and with reproducible builds maybe even compile it — as long as you change nothing. The likely path is a walled-garden app store where only attested genuine kernels can offer the required age and legal attestations, and only unmodified, store-approved programs run outside the browser sandbox. The image that set this off was mundane: helping a friend of 40 years install Ubuntu, and hating how much it already looked like that future. He ends where he started, asking readers to prove him wrong. It reads as a companion to peril-of-laziness-lost — both mourn a hands-on hacker culture being fenced off, one by convenience, the other by law and liability.

Interesting from the discussion

The Lobsters thread ("Goodbye, and thanks for all the Bikesheds") pushed hardest on the anonymity prediction, which most of the room read as a cost rather than the tidy win Kamp frames it as. One commenter argued shrinking anonymity "is going to kill people, mostly queer kids in households that want to suppress that queerness"; another generalized it: humans "evolved in an environment where anonymity was the natural default," a lot of our survival and well-being depends on not being scrutinized, and every system built to look transparent has kept an escape hatch. His prediction was that a fully transparent environment costs lives before people learn to survive or evade it — or force a hard stop. A separate reply reframed the whole essay's tension between child safety and civil liberty as "a feature, not a bug" rather than a contradiction to resolve.