{"id":1888,"date":"2026-08-07T13:03:40","date_gmt":"2026-08-07T13:03:40","guid":{"rendered":"https:\/\/cybercolombia.co\/index.php\/2026\/08\/07\/growing-up-the-hard-way-cyberdefensa-mx\/"},"modified":"2026-08-07T13:03:40","modified_gmt":"2026-08-07T13:03:40","slug":"growing-up-the-hard-way-cyberdefensa-mx","status":"publish","type":"post","link":"https:\/\/cybercolombia.co\/index.php\/2026\/08\/07\/growing-up-the-hard-way-cyberdefensa-mx\/","title":{"rendered":"Growing Up The Hard Way \u2013 CYBERDEFENSA.MX"},"content":{"rendered":"
\n

Open Source had a great childhood.<\/p>\n

For two decades it got to be a kid. It ran around barefoot, gave everything away, trusted strangers, and never once thought about who was watching. It ran the kind of lemonade stand that took IOUs from anyone who wandered up \u2014 take what you need, pay me back whenever, no need to leave a name. It was idyllic. It was also, in retrospect, a little feral.<\/p>\n

Then, somewhere around 2020, its voice started to crack. It tried to grow a beard. Acne everywhere. SolarWinds, then Log4Shell, then TeamPCP and Shai-Hulud \u2014 the supply chain woke up one morning like the end of Ender\u2019s Game<\/em>: the simulation had been real the whole time. Those were real battles. Real systems, real money, real people, all of it quietly leaning on code we\u2019d been treating like a practice round. And then the adults showed up with rules: executive orders, European regulations, permission slips for half the places it wanted to go.<\/p>\n

What it did not<\/em> get was a nice, slow, storybook coming-of-age. It got drafted. At eighteen, before it was ready, into an all-out war on two fronts: Mythos-class AI finding novel, chained zero-days faster than anyone can triage them, and that same malware problem, now industrialized \u2014 the distribution channels themselves poisoned at scale. Discovery weaponized on one side, delivery weaponized on the other. A pincer.<\/p>\n

I wrote a few months ago that open source died in March. I\u2019ll walk that back, slightly. It didn\u2019t die. It got conscripted. And it\u2019s about to grow up the hard way.<\/p>\n

Everything past this point is a forecast. I\u2019m going to tell you what I think happens next \u2014 not what ought to.<\/p>\n

What comes home (and what doesn\u2019t)<\/h2>\n

So what does that kid look like when it comes home? The shape is already clear enough to call.<\/p>\n

Start with the part people get wrong the second they read one of these posts and reach for their pitchforks: capital-O, capital-S Open Source isn\u2019t going anywhere, and it won\u2019t really change. Open Source is a license definition, stewarded by the OSI for decades \u2014 and their authority works the way all authority in open source works: it exists because everyone keeps choosing to recognize it. That\u2019s not a weakness. It\u2019s the whole model. The definition is fine. It\u2019ll come through all of this untouched. Nobody is going to come for the OSI.<\/p>\n

What will<\/em> change is what enterprises are willing \u2014 and very soon, permitted<\/em> \u2014 to consume. The war won\u2019t rewrite the definition. It\u2019ll split the population in two.<\/p>\n

On one side: the open source that plays by the terms enterprises need \u2014 reachable, patched, accountable, able to prove it\u2019s still there. That\u2019s the part a serious company will be able to build on. And here\u2019s the prediction, on the record: within a few years, regulated enterprises won\u2019t be choosing that bar \u2014 they\u2019ll be complying with it.<\/p>\n

On the other side: everything else. Every project that can\u2019t meet those terms, or won\u2019t, or was never trying to in the first place. And that is perfectly fine \u2014 nobody is forcing those projects to play along, and nobody could if they tried. That was never how open source worked, and it\u2019s not going to start now. That side doesn\u2019t go away. It keeps shipping, it keeps being open source, same as it ever was. It just stops being something a regulated enterprise can lean on without a plan.<\/p>\n

And it\u2019s worth flagging now who\u2019s going to look prescient when the dust settles: the capital-F Free Software crowd. The GPL true believers, the freedom-not-price people \u2014 the ones the rest of us wrote off as ideologues while we built businesses on top of the thing they kept telling us to take seriously. They never pretended any of this was free-as-in-beer. That was their entire point, stated plainly, for forty years. They were the conscientious objectors who looked at commercial open source twenty years ago and said, not my war.<\/em> Hold that thought. We\u2019ll come back to them.<\/p>\n

The thing I can\u2019t name<\/h2>\n

That first side \u2014 the part that\u2019s going to carry the enterprise world on its back \u2014 needs a name. And I don\u2019t have one. I\u2019ve tried; we\u2019ll get to that at the end. For now, call it the subset.<\/p>\n

So what does being on that side actually take? Nothing to do with the license, for starters. The terms are about whether anyone\u2019s home. Is the project reachable? Is there a disclosure path? Can it prove it\u2019s still alive? Will it be there to patch the thing the AI finds next Tuesday?<\/p>\n

And it\u2019ll come from everywhere. Single-maintainer projects, community projects, foundation projects, corporate projects \u2014 none of those labels decide it. Some of each will choose to meet the bar. Plenty of each won\u2019t. Again: that\u2019s perfectly fine.<\/p>\n

And to be clear, this is not a new license, and it is not a fork of the definition. It\u2019s a posture \u2014 something a project adopts, or doesn\u2019t. The ones that don\u2019t owe you nothing. They never did, and nobody should pretend otherwise. If you want to keep using software that opted out, you have two options: find a vendor who\u2019ll carry it for you, or use something else.<\/p>\n

Proof of life<\/h2>\n

The hard problem underneath all of this: you cannot tell whether a normal open source project is alive or dead until it\u2019s far too late. There\u2019s no heartbeat monitor. A project looks exactly the same the day before the maintainer walks away as the day after. You find out it was abandoned when you need a patch and nobody answers.<\/p>\n

So the subset needs a heartbeat. A proof of life. Some kind of keep-alive, a dead man\u2019s switch, a way to continuously demonstrate that someone is still there and will still be there when it matters. Probably a lot more than that, too \u2014 a real security policy, a way to handle disclosures, the kind of obligations the CRA is already starting to write down. The point is that membership isn\u2019t a badge you earn once and hang on the wall. It\u2019s current state, re-proven constantly.<\/p>\n

But a heartbeat requirement sounds cold, and it shouldn\u2019t be. Because the flip side of \u00abprove you\u2019re still here\u00bb has to be a way to step away with your dignity intact. Maintainers burn out. People move on. Someone who has carried a critical library for fifteen years is allowed to set it down. The xz-utils maintainer didn\u2019t have anywhere good to hand the keys \u2014 and we all saw how that went.<\/p>\n

So you need a retirement home. Something like EmeritOSS: a place a project goes when its maintainer is done but the people downstream aren\u2019t. A graceful way to hang it up. The code keeps getting looked after, the users stay safe, and nobody is expected to keep working forever. That\u2019s not the system failing. That\u2019s the system being humane.<\/p>\n

Free as in puppy<\/h2>\n

Now the part everyone misreads as a threat. You can run this entire subset for free. Forever. You will never have to pay anyone a cent.<\/p>\n

It\u2019s just that \u00abfree\u00bb was never the right word. This was always free as in puppy, not free as in beer.<\/p>\n

The puppy costs you nothing to adopt. What it costs you is the rest of your life in small daily increments. You have to feed it \u2014 which here means living at the bleeding edge, because the subset only ever patches latest<\/em>. There is no patch coming for the version you froze three years ago and stopped thinking about. You have to walk it \u2014 keep moving, keep upgrading, keep current. And you have to be willing to rehome it the day it stops being yours to keep \u2014 the day a project falls out of the subset, you need to already be ready to move off it.<\/p>\n

That\u2019s the deal. It\u2019s a fair deal. The cost was never the license fee. It was always the labor of ownership, and we just spent twenty years pretending the puppy raised itself.<\/p>\n

Who carries it for you<\/h2>\n

This is the part where it starts to look like a pitch for Chainguard and a plot to murder open source. I can already hear it: he\u2019s trying to sell you something.<\/em><\/p>\n

\u2026Kind of? I\u2019m trying to build something I think a lot of people are about to want to buy. To do that, I have to make a guess about what\u2019s coming and then be right about it. This post is the guess. And honestly, I\u2019m flattered you think my blog is influential enough to redirect the buying patterns of an entire industry and pull off what Microsoft spent two decades and untold billions failing to do \u2014 kill open source. I\u2019m not that good. Nobody is.<\/p>\n

The free path stays open. It does not close. Vendors aren\u2019t gatekeepers standing between you and the software \u2014 the software is right there, free, where it always was. What vendors actually sell is relief from the two costs you can\u2019t pay yourself.<\/p>\n

Don\u2019t want to live at the bleeding edge? That\u2019s a tax, and you can pay someone to carry it \u2014 LTS branches, backported fixes, somebody else absorbing the upgrade treadmill so your fleet doesn\u2019t have to live at head. Can\u2019t rip a project out of production the same afternoon it drops out of the subset? That\u2019s the other thing you\u2019re buying: a buffer. Someone to keep it safe while you migrate on a human timeline instead of a panic one.<\/p>\n

If proof-of-life and the retirement home are the planned, graceful exit, the vendor is the emergency room \u2014 the one you call when a project goes down without warning and you need it stabilized now<\/em>. Two different failures, two different answers.<\/p>\n

The honest framing: it\u2019s a dog-sitter and a trainer, on retainer. The dog is still yours. The dog is still free. You\u2019re paying so you don\u2019t personally have to do every walk, and so there\u2019s a professional on call for the day it bites someone.<\/p>\n

There are no contracts in open source. There is only current state. The vendor is the one place you can buy an actual contract, stretched over the top of a system that offers you none.<\/p>\n

\u00abJust pay the maintainers\u00bb<\/h2>\n

I know. I can hear the other half of the room. Or these greedy companies could just pay the maintainers.<\/em><\/p>\n

Yes. They could. They should, even. I am not the don\u2019t-pay-maintainers guy.<\/p>\n

But I\u2019ve said the same thing since 2021 and I\u2019ll say it again: this is a distribution problem, not a funding problem. The money isn\u2019t the hard part. Corporations have budget and are, mostly, willing to spend it. The hard part is connecting thousands of companies to thousands of dependencies, each with its own maintainer, its own wishes, its own appetite for being paid at all. Taking money is hard. Giving money away turns out to be even harder. Filippo wrote an excellent guide on how to do it well, and the length of his preconditions list is itself the proof \u2014 this does not scale by brute force.<\/p>\n

Maintainers absolutely can step into the commercial layer on their own terms. Sell a contract that promises you won\u2019t disappear. Sell backports under a different license. Become your own vendor. That option is real, and the right<\/em> to choose it is the entire point. It just doesn\u2019t, by itself, solve the matching problem for ten thousand companies at once.<\/p>\n

Who organizes it all (and no, this isn\u2019t a tragedy of the commons)<\/h2>\n

Let me kill one framing dead, because it\u2019s wrong and it keeps coming back. This is not a tragedy of the commons. A commons gets destroyed by overgrazing \u2014 by too many people consuming a finite, depletable thing. Code is not that. My using a library doesn\u2019t leave less of it for you. Nothing got overgrazed. What actually happened is that the maintenance-and-trust layer underneath everything was never funded and never structured to match how load-bearing the code quietly became. That\u2019s not depletion. That\u2019s a distribution problem wearing a bigger coat.<\/p>\n

And the answer to a distribution problem is aggregation. Foundations and large communities are how a sprawling volunteer effort gets structure. One counterparty to fund instead of ten thousand. One clear owner to sign with. Governance kept separate from the money, so maintainers never fear losing control of their own project. And a credible signal that yes, this thing is alive, and someone is accountable for it.<\/p>\n

The law is already converging on exactly this. The EU\u2019s Cyber Resilience Act invented a category called the steward<\/em> \u2014 a legal person who provides sustained support and ensures the viability of open source used commercially. That\u2019s the law putting the role on the books. I\u2019m not inventing the subset. I\u2019m watching it form in real time, from multiple directions at once, and trying to describe it clearly before someone else defines it badly.<\/p>\n

It grows up<\/h2>\n

So where does this land? Not in doom, and not in some open source utopia either. It lands somewhere more useful than both: honest.<\/p>\n

The childhood really was great. What came next was brutal and unfair \u2014 open source didn\u2019t choose any of this. But the thing walking out the other side is an adult. Hardened. Accountable. No longer convinced it\u2019s invincible. It grew up the hard way, which is the only way anyone actually grows up.<\/p>\n

Oh \u2014 and the conscientious objectors. The Free Software crowd we left a few sections back. The open-core founders and the VC-backed crowd, mid-security-audit and mid-CRA-filing, are going to glance over at the GPL diehards expecting to find them gloating. Expecting an I told you so.<\/em> But the purists were never keeping score. They never signed up, never entered the enterprise-adoption race, never measured themselves against any of it. Ask one of them what they make of the whole commercial reckoning and the honest answer is Don Draper\u2019s: I don\u2019t think about you at all.<\/em> We assumed we were the protagonists. They never even read the script.<\/p>\n

To be clear about what kind of confidence this is: I might be wrong about all of it. That\u2019s what a forecast is \u2014 a way to be wrong in public, on the record, with a date attached. But the shape of this one has been getting clearer for a year, and it hasn\u2019t blinked yet.<\/p>\n

Which brings me back to the name.<\/p>\n

I still don\u2019t have one. Enterprise Source<\/em> sounds like a sellout the moment you say it out loud. Resilient Source<\/em> is so soft it means nothing. Load-bearing Source<\/em> gets the weight right but says nothing about the deal. I\u2019ve tried a dozen others and hated all of them.<\/p>\n

But we need one, and we need it fast. Naming a thing is how you start taking it seriously \u2014 it\u2019s the first real act of stewardship. The category is already forming, already collecting members, and the regulators are already writing their own vocabulary for it into law. If the people who build and maintain this software don\u2019t name it, someone else will, and we\u2019ll spend the next decade living inside whatever term they pick.<\/p>\n

So that\u2019s the job of this post. Not to name the thing \u2014 to describe it. What it is, how it works, what it costs, what it promises. The name has to come from the people who\u2019ll live under it, the same way everything else in open source gets decided: by usage, not decree.<\/p>\n

It\u2019s sitting right there. Somebody name it.<\/p>\n

Further reading<\/strong><\/p>\n

Found this article interesting? This article is a contributed piece from one of our valued partners.<\/span> Follow us on Google News<\/a>, Twitter<\/a> and LinkedIn<\/a> to read more exclusive content we post.<\/div>\n<\/div>\n