open-source software maintainers

Greg Kroah-Hartman, the longtime maintainer of the Linux kernel's stable branch, is featured discussing what large language models mean for software and kernel security. The talk examines how AI-generated code affects maintenance, review practices, and vulnerability risks in widely used open-source infrastructure, and it is drawing attention among developers weighing the benefits and dangers of AI-assisted programming.

A widely shared tech commentary argues that open-source software underpins far more of the modern internet than most people realize, from servers and cloud infrastructure to everyday apps and development tools. The piece walks through how much of the online world runs on free, community-maintained code, prompting discussion about how dependent the digital economy is on volunteer-driven projects.

A widely shared article highlights how billions of phones and everyday services rely on critical open-source code maintained by just a handful of often unpaid volunteers. From phone alarms to boarding passes and banking, essential digital infrastructure rests on a tiny group of maintainers, prompting renewed debate about the fragility of the software underpinning daily life and the lack of funding and support for the people who keep it running.

A new data visualisation from Sheets.works highlights the small teams and individual volunteers behind critical open-source software the internet depends on, including OpenSSL, SQLite, zlib, curl, sudo, ffmpeg, Linux and core-js. The piece, being shared widely in open-source and developer circles, underscores how few maintainers keep essential infrastructure running, renewing debate about underfunding and burnout in the volunteer-run software ecosystem.

Anthropic has launched a program giving open-source maintainers free AI-powered security scans of their code. The offer is aimed at under-resourced projects whose software underpins much of the internet's infrastructure but often lacks dedicated security review. It signals growing efforts by AI companies to court the developer community and address software supply-chain vulnerabilities.

OSS Scanner is offering free security checks for eligible open-source projects. The service aims to help maintainers identify vulnerabilities without cost, part of a broader push to improve the security of widely used open-source software. Details on eligibility criteria and who is behind the tool were not immediately available.

Anthropic has released a free, AI-powered security scanner for open-source software projects. The tool is intended to help volunteer maintainers find vulnerabilities in widely used code that often lacks dedicated security auditing resources. Coverage so far is limited to the announcement itself, and it is drawing attention as AI companies expand free tooling into software supply-chain security, a growing concern after a string of attacks on open-source dependencies.

Anthropic has launched a free service that uses its AI to scan open-source software for security vulnerabilities. The move is being discussed as a potentially significant boost for under-resourced open-source maintainers, who often lack dedicated security auditing, while also raising questions about the growing role of AI companies in software infrastructure and security.

Anthropic has introduced OSS Scanner, a free service that helps open-source software projects find security vulnerabilities. Open-source maintainers can now use the company's AI tools to check their code for weaknesses at no cost. The move comes amid growing concern over the security of widely used open-source dependencies, which are often maintained by small teams with limited resources.

A new data project by Data Drop, 'The people holding up the internet', examines open-source software and finds that billions of phones run on code maintained by only a handful of people. The team counted maintainers directly from the code itself, highlighting how heavily the world's digital infrastructure depends on a very small group of often unpaid developers. Readers are sharing the findings and discussing the fragility of open-source maintenance.

The BBC maintains its own fork of dash.js, the open-source JavaScript library for adaptive video streaming via MPEG-DASH. A report examines why the broadcaster diverged from the upstream project and what its changes involve. The story is being discussed among developers interested in streaming media technology and the BBC's engineering practices.

Sentry, the open-source error tracking and performance monitoring platform maintained by Sentry, is seeing fresh attention among developers. The tool helps engineering teams catch, prioritise and fix crashes and performance problems in production software, and its Python-based repository remains a widely used reference project in the monitoring space.

A new visualization project spotlights open-source maintainers, described as the people holding up the internet yet largely unpaid despite their work being essential to Linux, browsers, servers and web infrastructure. Developers and tech commentators are sharing the piece, echoing long-standing concerns that critical software everyone depends on is sustained by a small number of under-resourced volunteers.

Gentoo Linux has declared 'last rites' for its Chromium package, a step in Gentoo's process that marks software for removal from the distribution's repositories. The move signals that the package is no longer being properly maintained. Linux and open-source communities are discussing what the loss of packaged Chromium means for Gentoo users who rely on it.

A profile of the OpenSSH project and its creator is drawing attention across the tech community. OpenSSH underpins secure remote access on virtually every Mac, Linux server and Windows machine, yet is maintained with a deliberately paranoid approach: its code is written to trust no input, no system and no contributor. The piece highlights how this rigour has kept the critical open-source tool safe for decades, prompting discussion about whether other widely used software should adopt similar discipline.

System76, the Linux hardware and software company, will no longer accept LLM-generated content in pull requests for its COSMIC desktop environment project. The move means code submissions flagged as AI-generated will be rejected. The decision reflects a broader debate in open-source development, where maintainers are increasingly pushing back on low-quality or unreviewable AI-generated contributions flooding their queues.

Jarkko Sakkinen, a Linux kernel developer, says he sees no risk in continuing to maintain Landstrip, explaining that he uses the service himself and considers it the best available option. He also criticises GitHub contributors he describes as manager or architect types who arrive with open-ended suggestions such as conformance tests rather than practical contributions.

A software developer has added a continuous integration workflow to their open-source project that automatically rejects pull requests containing commits signed by major AI agents or marked as AI-assisted. The check is shared as a reusable workflow in a separate repository so the blocklists and regex patterns can be updated centrally across projects.