Ep 50 - Open Source Got Drafted, and Nobody Can Define What Maintained Actually Means Now

🎙️ Coffee, Chaos and ProdSec, Ep 50

Open source didn't die. It got conscripted. That's Chainguard CEO Dan Lorenc's framing, and Cameron and Kurt spend this episode picking it apart: a two front war where AI finds zero days faster than any triage queue can absorb them, and package poisoning hits at industrial scale.

The real fight is over the word "maintained." Nobody has a working definition. A project looks the same the day before a maintainer walks away as the day after. Cameron coins a term live on air (MOSS, Maintained Open Source Software), Kurt counters with load bearing source, and they get into what a proof of life requirement would actually take.

Then the puppy metaphor. Open source is free like a puppy is free, the adoption isn't the cost, the daily walking and feeding is. That leads into why paying maintainers is a distribution problem and not a funding problem, plus a long overdue rant about SBOMs that has been building for weeks.

If you work in Product Security, DevSecOps, or Cybersecurity and you've ever had to explain to an auditor what "maintained" means, this one's for you.

☕ New episodes every Wednesday. Coffee, Chaos and ProdSec -> strong coffee, stronger opinions.