Open Source Doesn't Care About You, But You Should Care About It
summary
Open source often has no support contract and rarely matches vendor release schedules; expect to inherit responsibility for long-term patches and coordination. Robinson cites studies showing 80–91% of commercial software uses OSS and warns many ecosystems are single-maintainer packages with minimal processes. Example: Apache fixes Log4j within six hours but the first patch is incomplete and two followup CVEs appear. Practical fixes emphasized: inventory dependencies, demand SBOMs, contribute code or tooling, and adopt sigstore and OpenSSF’s 10‑point plan.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 1:11Who's in the room
- 2:36Open source indifference
- 4:02Commercial reliance on open source
- 6:27Why open source doesn’t align with business needs
- 8:35What open source lacks
- 10:43How open source projects work
- 12:50Why commercial suppliers rarely contribute back
- 14:14Open source threat model
- 15:58Lack of consistency in open source projects
- 16:42Community security practices
- 21:17How security vulnerabilities get addressed in open source
- 22:23Support models compared
- 24:08Security reporting processes
- 25:51Open source threats list
- 26:12Better supplier support
- 27:58Log4j case study
- 30:50Log4j lessons
- 31:32Fixing open source
- 31:52OpenSSF 10-point plan
- 33:19Q&A
related talks
36mSOS Sustainable Open Source
47mThe TRUE Cost of Open Source
39mSOS: Sustainable Open Source
49mOpen Source is Broken, and it’s Our Fault
34mConsumers To Contributors: Open Source As a Competitive Advantage
33mThe Cathedral, the Bazaar, and the Coffee House
30mNo OSS, No Users: Why Investing in Open Source Matters
29mSustaining Open Source Software: Tools for Change