Post by @joshbressers@infosec.exchange

2026-03-25 08:37 UTC

I love the hot takes that this Trivy debacle will be the end of open source Heartbleed didn&#39;t kill open source Log4Shell couldn&#39;t get the job done xz tried and failed This won&#39;t kill it either Free is too good of a deal

Replies (4)

@joshbressers@infosec.exchange 2026-03-25 10:36

I wrote this up in a bit more detail in a clickbait titled article https://opensourcesecurity.io/2026/03-open-source-eulogy/

Open ##2433214
@frank@frankwiles.social 2026-03-25 09:11

@joshbressers@infosec.exchange yeah those issues aren’t going to kill OSS but slop PRs and security reports just might burn out the maintainers. I think that is far more likely.

Open ##2433220
@fersman@mastodonczech.cz 2026-03-25 09:18

@joshbressers@infosec.exchange to me is this discussion funny. Open source was never stronger. Everything is based on opensource. Browsers (chrome, safari), servers (aws, gcp, azure), cell phone (android), network devices. Open source is getting so strong that we realize that it is underfunded and that brings some weakness. All the companies using it should give more back (either money or pay developers).

Open ##2433221
@madduci@mastodon.social 2026-03-25 11:21

@joshbressers@infosec.exchange the golden rule has always been: "never rely on 'latest'" without checking

Open ##2433230