Enterprises have been drinking the free beer of open source for decades, and most of the people maintaining it are volunteers who can’t keep up with this, so I think it’s time to start paying for the beer. Here’s the case Oren and I make:
- AI models can now turn a published fix into a working exploit within hours, and find new vulnerabilities at a scale human teams can’t match.
- “Patchmageddon” – the median time from disclosure to first exploitation went from about a year in 2021 to about a day in 2026, with one minute projected by 2027.
- Open source takes the first hit. Of 530 high- and critical-severity findings Anthropic reported to maintainers by May 2026, 75 had been patched.
- Enterprises should rely on professional open source, backed by a vendor or foundation with funded maintainers, staffed security response and an SLA, and move off dependencies with no identifiable maintainer.
- With exploits arriving within a day, the unpatched system is a bigger risk to keeping the business running than the patch.
- Pointing an existing artifact proxy at a supported source changes where open source comes from without changing build files, pipelines or developer habits. The proxy can also serve the nearest patched version automatically.
- Measure the time from disclosure to a deployed fix for your top 50 dependencies, record who maintains each critical one, and use AI to propose fixes while people review the merge.
We’ve seen this over the past year, first in Spring, and then over everything. And thanks to our long history with Bitnami, and some new work, we’ve got something to offer, some better beer than free beer. TrueSource Beer! (Also see the docs on it if you prefer that.)
Leave a Reply