Synthèse
Open source comes up in the context of underfunded teams that cannot afford premium tooling. Bob agrees the constraint is real, but he pushes back on the industry habit of outsourcing responsibility. Constraints don’t remove accountability when insecure or unmaintained components make their way into customer-facing products. If a defect ships in your product, it’s yours, even if it came from upstream. He also calls out a common failure pattern: vendors using unmaintained dependencies for years,
Open source comes up in the context of underfunded teams that cannot afford premium tooling. Bob agrees the constraint is real, but he pushes back on the industry habit of outsourcing responsibility. Constraints don’t remove accountability when insecure or unmaintained components make their way into customer-facing products. If a defect ships in your product, it’s yours, even if it came from upstream. He also calls out a common failure pattern: vendors using unmaintained dependencies for years, sometimes far longer, and not giving customers visibility into what is actually inside the product.
SBOM practices exist. Some companies do this well. Many do not. Whether the issue is insecure defaults, overpowered AI systems, or vulnerable dependencies, the pattern is the same: organizations cannot keep pushing security outcomes downstream and expect users, customers, or open-source maintainers to absorb the risk.