Open source grew up in a hurry, and the security bill is coming due

Key points

• Open source software, meaning code that anyone can read, use and change for free, now sits inside almost every business app and cloud service.
• The trust-based way maintainers hand out that code was designed for a hobbyist era, not for supply-chain attacks by organised criminals and nation states.
• Recent incidents like the XZ Utils backdoor in 2024 showed attackers are willing to spend years posing as helpful volunteers to plant hidden doors into widely used software.
• Companies that depend on open source rarely know who wrote the code running their systems, or whether that person is still alive, let alone paid.
• The fix is boring but urgent: proper inventories of what code you use, and money flowing to the people maintaining it.

Open source had a long, lucky childhood.

For about twenty years, the volunteers who write free software could operate like a lemonade stand on a quiet street. Take what you need. Pay me back whenever. Don't worry about leaving your name. It worked because nobody with real money or real malice was paying attention.

That era is over. The Hacker News framed it as growing up the hard way, and that is about right. The failure mode here is that the same trust that made open source thrive is now the attack surface.

What is open source, and why should a normal person care?

Open source is software whose recipe is published for anyone to read, copy, and improve. Think of it as the free flour and yeast that almost every bakery uses. Your bank's mobile app, your hospital's booking system, the streaming service you watched last night: all of it sits on top of thousands of these free ingredients, maintained by volunteers who often have never met each other.

In practice, most companies do not know the full list of ingredients in their own software. That is the problem.

How did the trust model break?

It broke because attackers realised the volunteers were the soft target.

The clearest example was the XZ Utils backdoor discovered in March 2024, where someone spent nearly three years pretending to be a helpful contributor on a tiny compression tool used inside Linux, the operating system that runs most of the internet's servers. They earned trust. They got commit rights. Then they slipped in a hidden door that would have let them log into millions of machines. A Microsoft engineer caught it by accident because his database was running half a second slow.

Half a second. That was the margin.

One thing the post-mortem will say, over and over, is that nobody was actually watching the henhouse. The maintainer of XZ was a burnt-out volunteer who welcomed the help.

Who is exposed?

Everyone who uses cloud services, which is everyone. Amazon Web Services, Microsoft Azure and Google Cloud all ship customer workloads that pull in hundreds of open source packages behind the scenes. When one of those packages goes bad, the blast radius reaches from a hospital's patient records to a supermarket's till system.

Here is the shape of the problem in plain numbers.

Fact	Figure
Share of modern codebases made of open source	Roughly 70 to 90 percent
Time the XZ attacker spent building trust	About 3 years
Detection method for XZ	Accidental, by one engineer
Typical funding for a critical maintainer	Often zero

What should ordinary people do?

Honestly, not much directly. You cannot audit the code inside your banking app. What you can do is notice which of your suppliers, your employer, your children's school, your GP surgery, actually answer questions about how they check their software. Silence is the answer you should worry about.

For companies, the operational takeaway is unglamorous: know what is in your software, and pay the people keeping it alive.

The lemonade stand is now a utility. Time to act like it.