Maintaining open-source at the age of AI - François Best
summary
Open source is not dead but faces weekly supply‑chain attacks that already exploit npm and GitHub Actions; AI floods produce drive‑by PRs and noisy issue spam while agents handle routine tasks. Specific defenses include using pnpm with safe defaults, consulting scanners like socket.dev before installs, enabling npm staged publishing, pinning Actions with git SHA via pinact, and relying on deterministic OSS tools — TypeScript, Jest, KNIP (which can delete ~10,000 lines), TanStack Query — rather than vendoring fragile AI‑generated code.
AI-written summary · about
chapters (18)
- 0:00Introduction and background
- 1:52Is open source really dead?
- 3:17When to vendor vs depend
- 5:03Quality gates in open source
- 7:10AI agentic loop and tools
- 8:38Open source under attack
- 11:28Defense against supply chain attacks
- 13:35Modern package manager security
- 14:41Staging publishing in npm
- 15:42GitHub Actions workflow analysis
- 17:06Best uses of AI in OSS
- 18:07Contributing to open source
- 19:31AI for code review and triage
- 20:35AI for onboarding and side quests
- 22:01AI slop and its dangers
- 23:46Social impact of AI in OSS
- 25:10Open source is about people
- 26:59Closing remarks
related talks
26mOpen Source is Dead
21mNavigating the Intersection: AI’s Role in Shaping the Secure Open Source Software Ecos...
25mHow AI Is Changing Open Source Communities: Lessons From openEuler
38mThe Cognitive Cost of AI-Assisted Open Source
26mSmarter Code, Sneakier Risks: Supply Chain Security in the Age of AI
21mSupply Chain Attacks on Open Source: What's Happening, What...
10mThe Next Era Of Open Source: Humans + AI, Not Humans vs AI
17mLightning Talk: Navigating the Intersection: AI’s Role in Shaping the Secure Open Sour...