we keep calling AI models "open" but the entire ecosystem depends on one company's servers. does that bother anyone else here

been thinking about this a lot and it feels like exactly the kind of thing this sub usually catches early. we celebrate open weights as a win for open source, and it is. but the openness stops at the license. the actual distribution, the versioning, the metadata, the discovery, the thing that makes any of it usable, almost all of it runs through a single company. every tutorial, every from_pretrained, every CI pipeline quietly assumes it is up, still free, aligned with the community, and not about to gate or relicense the thing you depend on. that is the same centralization and single-vendor risk we would roast any other project for. the weights being Apache licensed does not help much at 2am when the hub is down, or when a repo your workflow depends on gets restricted, or when the terms shift. and we have already seen bits of that drift. the usual answer is "just mirror it" or "torrents exist," but that only saves the weights, not the catalog, the provenance, or the trust that a given checkpoint is actually what it claims and not a poisoned reupload. that metadata layer is the hard part and nobody hobbyist-side really has it. so two honest questions for the sub. first, do you actually see this as a real risk or am i overthinking a convenience we will always have? and second, for those who do worry about it, what is your actual continuity plan? are you pinning and hashing checkpoints yourself, keeping local archives, something smarter, or is it just "it will probably be fine forever." genuinely want to know how people who take open infrastructure seriously are thinking about this one.