A 30-minute talk by Ruben van der Linde, October 2026. We have thousands of angry citizens, and the only thing we need to do is empower them: with trust, and with a store. Can open source do to business software what WordPress did to publishing? Hit Present (bottom-right) for fullscreen. Open this page with ?notes to read the speaker notes under every slide. The sources are listed below the deck.
Who here writes code?
Hands up. Keep it up if you patched something last week.
How was your last week? WordPress had 497 new holes.
497
new vulnerabilities
In one week, across 327 plugins and 23 themes.
176
high or critical
19 of them scored 9.8 out of 10.
69
with no fix at all
No patch existed when the hole went public.
The week before was worse: 654 vulnerabilities, and 44% had no fix at disclosure (Wordfence).
And then the rest of the week happened.
Rank Math SEO Pro: the update itself shipped a backdoor, through the normal update channel (15 to 16 Oct).
Duplicator, over a million installs: a high-severity flaw needing no login (20 Oct).
PHP2Shell: a hole in PHP itself, with over 74,000 attack attempts in a day (21 to 22 Oct).
The core is safe. The ecosystem is not.
6
holes in core
In all of 2025, and all of them low priority.
11,334
holes in total
91% in plugins, up 42% on 2024. Almost half had no fix at disclosure.
5 hrs
to the first attack
Median, for the flaws attackers want most (Patchstack).
We cannot expect citizen coders to patch every week. The platform has to do it for them.
Business software is next.
We have thousands of angry citizens. The only thing we need to do is empower them.
WhenOctober 2026FormatTalk + three questions for youByRuben van der Linde
RvdL
Conduction
Who is talking.
Ruben van der Lindeco-founder and CTO · Conduction
background:Twelve years building open-source software for Dutch municipalities and ministries.
now:21 Nextcloud apps on one shared data layer, and a builder so people who don't code can make their own.
ask me about:
Why a workspace beats a suite.
Letting AI build apps without writing code.
Rewarding contributors who aren't developers.
WordPress won the web without a plan. Now it is slowly losing it.
39.6%
of all websites
Down from 43.6% in January 2025: four points in 22 months (W3Techs).
60,000
free plugins
Roughly. The core stays small, and the ecosystem does the rest.
921
people on one release
Contributors to WordPress 6.8 alone, the largest group so far.
Small core, large ecosystem, zero barrier. The ecosystem won it the web, and the ecosystem is now its weak spot.
Every few years, something gets handed to everyone.
11991 · 1995
The server
Linux and Apache. The web runs on software nobody owns.
22001
Knowledge
Wikipedia. Anyone can write the encyclopedia.
32003
Publishing
WordPress. Anyone can run a website.
42004
The browser
Firefox. The window onto the web opens up.
5Now?
Business software
CRM, bookkeeping, cases, forms. Still sold in boxes.
This talk asks whether the fifth step can happen, and what it would take.
01
A suite is not a workspace.
The distinction sounds subtle. It decides who can win.
You buy a suite. You build on a workspace.
A workspace
One identity layer: log in once.
One permission model across every app.
One data layer underneath.
The apps can come from anywhere.
Each app keeps its own community and roadmap.
A suite
A box of predetermined tools.
One vendor builds every one of them.
The same vendor wires them together.
You pay for the bundle.
Whatever is missing waits in their backlog.
The second model is where open source has an advantage no closed vendor can match.
A platform is when the economic value of everybody that uses it exceeds the value of the company that creates it.
Bill Gates, as recalled by Chamath Palihapitiya · via Ben Thompson, Stratechery, 2018
The open workspace already exists.
OpenProject
Project management
Its own community and roadmap
Linked to Nextcloud files
XWiki
Knowledge and documentation
Its own community and roadmap
Twenty years in production
Matrix
Federated chat
Its own community and roadmap
Runs the Bundeswehr messenger
Germany's openDesk ships Nextcloud, OpenProject, XWiki and Element on Matrix as one government workspace (release 1.18, August 2026).
02
The math just changed.
Tomorrow's business software will not be built by product teams in Redmond. It will be built by the people who use it, with AI.
Microsoft is betting on the people who use the software.
33M
monthly users, 2023
Power Platform, as reported on Microsoft's earnings call in April 2023.
56M
monthly users, 2025
Up from 48 million a year earlier. Low code, now with Copilot inside.
500M
the stated ambition
Charles Lamanna, Power Platform Community Conference, October 2025.
In that world the side with the largest citizen-developer pool wins. Not the largest engineering team.
This week Microsoft offered 30% of its staff money to leave.
Its reasoning: AI builds the software now. Ours: so do your users. They are already angry, they work for free, and none of them asked for a buyout.
The door is closing on the fastest-moving segment.
Under the US CLOUD Act a US provider can be compelled to hand over data, wherever it is stored. That legal risk keeps sensitive government work off US clouds.
Microsoft France, under oath in the French Senate, June 2025: it "cannot guarantee" otherwise.
The Dutch parliament asked in March 2025 for a government cloud and an exit strategy.
Schleswig-Holstein moved 40,000 mailboxes off Exchange in October 2025.
The International Criminal Court's prosecutor lost his Microsoft mailbox after US sanctions.
Nextcloud cannot out-hire Microsoft. It doesn't need to.
2M+
new professional users
Added in 2025 alone, according to Nextcloud (March 2026).
1.2M
planned at one ministry
The French Ministry of Education, with 400,000 users already live.
~170
people at Nextcloud
Against about 223,000 at Microsoft. The users will have to do the building.
The users are arriving. The question is whether they will build, or only consume.
We have thousands of angry citizens. The only thing we need to do is empower them.
The one line to take home
Two angry citizens. One afternoon each.
Small business
Sanne runs a 12-person installation company
Today she types each accepted quote into her bookkeeping by hand.
She wants quote to invoice across mail, files and her data.
The hours her team logs should become the invoice.
No integrator, no second platform.
Civil servant
Yusuf is an HR advisor at a municipality
Today leave requests arrive by email and land in a spreadsheet.
He wants to build a leave-request app by describing it.
It should run next to Files and Mail, under the same login.
No code, no consultant, no vendor holding the strings.
What stops them is not the idea. It is trust, and somewhere to find and share what they build.
Empowering them takes two things.
03 · so they can start
Trust and security
A framework that handles the basics, so no app gets them wrong.
Apps as configuration, not code.
So an AI can build an app safely.
And IT dares to say yes.
04 · so it is worth finishing
A platform and a store
Organisations can actually find the apps.
One good app gets reused, not rebuilt.
Developers get paid for what they make.
And the people with the idea get a stake.
Trust lets them start. The store makes it worth finishing.
03
Trust and security.
IT will only say yes when a citizen-built app cannot break the basics.
The basics come from the framework, not from each app.
Every citizen-built app gets the hard parts for free, built once and tested once.
Login, permissions and the audit trail come from the workspace.
Every write is validated against the data model, in the form and again in the API.
Lists, forms, search and filters are shared components, accessible by default.
A security fix in the framework reaches every app at once.
An app is data, so anyone who can edit data can build one.
1
Describe it
Tell the assistant what you need. It drafts the data model and the pages.
→
2
Review the change
You see exactly what changes, and you approve it before anything runs.
→
3
Use it
Your app appears next to Files and Mail, with your permissions, logged.
The AI writes a manifest, not code. A wrong manifest fails validation. Wrong code fails in production.
Buildiq
Let's build one.
Describe a small app, add a list and a detail page, open it next to Files. Three minutes, no code.
Same pages, a fraction of the code.
−1,742
lines of Vue, Pipelinq
Client and contact pages, replaced by 178 lines of manifest.
−1,901
lines of Vue, Larpinq
The whole app shell, replaced by 288 lines. The app now has 6 .vue files.
−541
lines of Vue, Stackiq
One organisations list, replaced by 16 lines of manifest.
Real migration commits in our own repositories, not estimates.
Tailor any app, keep a common core.
Common core
From the app store
Maintained once, for everyone
Updates and security fixes
Your changes
Extra fields, pages and rules
Made by admins and users
Stored as the difference only
Your app
Fits your organisation exactly
Keeps receiving updates
No fork to maintain
This is the WordPress move again: a small common core, and everyone's own layer on top.
Where it stops, honestly.
Kanban boards, checkout screens and wizards are still custom code.
Our own CRM still has 53 custom pages out of 104.
Integrations and heavy business logic stay in PHP.
We hold ourselves to one rule: the number of custom pages per app may only go down.
04
A platform and a store.
An app nobody can find helps one organisation. An app in a store helps all of them, and pays the people who made it.
Organisations need to find what others already built.
600
apps in the store today
The Nextcloud app store, roughly. Install in two minutes from inside Nextcloud.
6,000
apps, the store's goal
Ten times more, through the partner programme Nextcloud launched in July 2026.
1
place to look
Find it, install it, tailor it, and keep receiving its updates.
Today a good municipal app stays in a drawer, and the next municipality builds it again.
The store pays developers. Who pays the idea?
The developer
Sells, hosts or supports apps
Finally a market for open-source apps
A model that works
The idea
A feature idea, a workflow design
Often the most valuable part
Almost no model at all
The citizen coder
A working prototype, built with AI
Not traditional code
No model either
Users are the moat. If the citizen-developer wave means anything, they need a reason to contribute.
IP
A stake, not a donation.
Assign the IP of a contributed feature to the people who submit it, developer or not.
A feature idea, a workflow design or an AI-built prototype all count.
The contributor holds a stake in what they brought.
The software stays open source for everyone.
This is a test, not a policy. Tell us where it breaks.
Now you.
1
What really stops them?
What is the threshold that keeps a small business owner or civil servant from building their first app on open infrastructure?
2
What would make them try?
One thing, this year, that gets them over that threshold.
3
Is IP the right incentive?
Is ownership what makes non-developers contribute, or is there a better one?
Thousands of angry citizens. Let's empower them.
The browser, the web and publishing all opened up because a community decided they should belong to everyone. Business software is next, if we are willing to do it.
01 · this week
Build one app
Pick the most annoying spreadsheet in your organisation and turn it into an app.
02 · after this talk
Tell us what stopped you
Your answer to question one is our roadmap.
03 · any time
Contribute something that isn't code
An idea, a workflow, a prototype. That is the contribution we want to reward.
RvdL
Ruben van der Linde
co-founder and CTO · Conduction
ruben@conduction.nl · conduction.nl
Sources
Wordfence Intelligence weekly reports: 5 to 11 Oct 2026 (654 vulnerabilities, 285 unpatched) and 12 to 18 Oct 2026 (497, 176 high or critical, 69 unpatched): 5 to 11 Oct, 12 to 18 Oct.
Wordfence on Rank Math SEO Pro 3.0.123 (post), UpdraftCentral (post), Duplicator (post) and PHP2Shell (post).
Patchstack, State of WordPress Security in 2026 (2025 data): patchstack.com.
W3Techs, usage of WordPress (39.6% of all websites, 27 Oct 2026) and the yearly history (peak 43.6%, 1 Jan 2025): w3techs.com, history.
WordPress.org, State of the Word 2025 (921 contributors to 6.8): wordpress.org. Plugin count: the live directory at wordpress.org/plugins.
Ben Thompson, "The Bill Gates line", Stratechery, 23 May 2018: stratechery.com.
openDesk 1.18 components (Nextcloud, OpenProject, XWiki, Element): docs.opendesk.eu. Matrix at the Bundeswehr: element.io.
Power Platform monthly users: 33M (Microsoft FY23 Q3 earnings call, April 2023), 48M (late 2024) and 56M (FY25 Q3, reported by Practical365, May 2025). The 500M ambition: Charles Lamanna at the Power Platform Community Conference, October 2025.
Microsoft France before the French Senate, 10 June 2025: sdxcentral.com.
Tweede Kamer, Kathmann motions on a government cloud and exit strategies, 18 March 2025: dutchitchannel.nl.
Schleswig-Holstein completes the move off Exchange, October 2025: theregister.com.
ICC prosecutor's mailbox and the move to openDesk: heise.de.
Nextcloud, more than two million new enterprise users in 2025, 24 March 2026: nextcloud.com.
Nextcloud ISV partner programme, from about 600 to 6,000 apps, 2 July 2026: nextcloud.com.
Microsoft voluntary buyouts for about 60,000 staff, 26 October 2026: fortune.com, cnbc.com.
Nextcloud at around 170 staff, no venture capital: cloudmagazin, 25 September 2026.
Manifest migrations: commits in the ConductionNL repositories, September 2026, as presented in "Manifesting your app" (Nextcloud, Berlin 2026).