The open source stories enterprise IT leaders actually read.
Volume 342, Issue 4 · 6 articles from 3 issues
A developer's perspective on how open source helps avoid vendor lock-in and preserve architectural flexibility.
This New Stack piece, by Andreas Prins, looks at how adopting an open-source approach helps developers avoid vendor lock-in. It argues that open source protects digital sovereignty and keeps software architectures flexible rather than tied to a single proprietary vendor's roadmap.
When business conditions inevitably change, those accumulated choices and their consequences will determine whether a team can pivot accordingly. Limits on flexibility rarely trace back to a single vendor; more often, they hinge on how reversible the team’s past decisions are.
AI-generated code is overwhelming unpaid open-source maintainers, and only 6-7% of software is cryptographically signed.
The article argues open source maintainers have become the critical weak point in enterprise software supply chains, as AI-generated code dramatically increases pull-request volumes for understaffed, largely volunteer maintainers who end up skipping security reviews or abandoning packages.
It notes enterprises lack cryptographic provenance infrastructure to verify package origins, with only 6-7% of open source software signed.
The piece frames this as an economic problem - maintainers run critical infrastructure without adequate compensation while absorbing added AI inference costs - and urges enterprises to invest in provenance validation and maintainer funding.
How-To Geek recommends Bitwarden, LibreOffice, Kdenlive, GIMP, and Audacity as free alternatives to paid apps.
The author recommends five free, open-source desktop apps over paid rivals, noting they avoid subscriptions, licensing changes, and account requirements.
Bitwarden is a capable password manager with a generous free tier, LibreOffice replaces Microsoft Office for most documents and spreadsheets, and Kdenlive offers timeline-based video editing.
GIMP 3.x has improved usability with non-destructive effects and plugins as a Photoshop alternative, and Audacity handles common audio editing tasks. Readers are advised to download these tools only from official sources to avoid adware-bundled repackages.
Tencent's open-source AI-Infra-Guard scans AI services, MCP servers, and agent skills, but lacks built-in authentication.
Tencent Zhuque Lab's AI-Infra-Guard fingerprints AI services such as Ollama, vLLM, and ComfyUI against more than 1,600 CVEs, inspects MCP servers and agent skills across 14 risk categories, and runs jailbreak evaluations.
Its LLM-based skill checks show false positive rates from 1.20% to 18.67% on SkillTrustBench, depending on the judging model. Release 4.1.9 hardened scanning agents against indirect prompt injection, though the team calls it a mitigation, not a guarantee.
The tool has no login or RBAC, so the team recommends a reverse proxy and firewall rules.
FreeCORE, an independent fork of TrueNAS CORE, keeps a FreeBSD and OpenZFS path alive for users avoiding Linux.
After iXsystems ended TrueNAS CORE development and moved to the Debian-based TrueNAS Community Edition, FreeCORE emerged as a one-person, AI-assisted fork for FreeBSD holdouts.
Built on FreeBSD 15, its 15.0-U1.3 release upgrades OpenZFS to 2.4.2 and Python to 3.11, adds WebAuthn and OTP login factors, GPU sharing for jails, and removes vendor telemetry.
TrueNAS CORE 13.3 users can migrate by running a script that switches the update train, though OpenVPN is replaced by WireGuard and enterprise features don't carry over. Source code is hosted on Codeberg.
Registry operators should charge companies for open source and distribute royalties to maintainers automatically.
The author argues that open source has reached a stable equilibrium where free code wins market share but maintainers burn out unpaid.
While companies already spend billions on supply chain infrastructure around open source, that money bypasses the developers who create it.
The proposal: registries meter corporate usage and distribute a fixed revenue percentage to packages based on their presence in paying customers' dependency trees, automatically and without application.
This approach differs from past failed initiatives by operating at the chokepoint of supply rather than relying on voluntary charity or licensing restrictions.