The Attestation Was Valid. The Source Wasn't.
A valid npm provenance attestation proves which pipeline built a package, not that its source was honest. What the tensorlake and GHAPPIER attacks show, and the check that failed my test....
Open Source Maintainer Burnout (Infrastructure Cost)
Kubernetes Ingress NGINX gets no security patches after March 2026 because a maintainer burned out. 60% of OSS maintainers work unpaid. The blast radius is real....
Open Source Isn't Free
Open source software has a price tag of $0 and a total cost of ownership that can dwarf commercial alternatives....
Documentation as Product: What Open Source Gets Right
Documentation quality determines adoption more than feature completeness....