CPUG.org: The risks of centralized open-source