Open Source Powers Everything, but Who Is Responsible for Security?
IT DAILY ·
✦ AI Summary
Nicholson said governments should consider taking responsibility for the safety and security of their countries' programming resources and tools, given concerns about the sustainability of a structure in which nonprofit foundations and a small number of sponsors bear the cost of maintaining open source infrastructure.
The PSF operates PyPI and handles its security, with more than 750,000 registered libraries, but it has 11 employees and only 2 staff dedicated to security.
The government is reviewing ways to assess domestic dependence on open source and provide financial, personnel, and technical support when key projects lack maintenance capacity, and Germany's Sovereign Tech Agency was cited as an example.
At an interview with Deb Nicholson, executive director of the Python Software Foundation (PSF), at PyCon Korea 2026, held from August 15 to 17, the question was raised of whether it is sustainable for nonprofit foundations and a small number of sponsors to bear the cost of maintaining open source infrastructure. In response, Nicholson said governments should consider taking responsibility for the safety and security of their countries' programming resources and tools.
He emphasized that safety and security need to be viewed as part of public infrastructure. That also became the focal point of this article: 'public infrastructure' and 'security.'
It also highlighted that the issue of sustaining the open source ecosystem is not limited to developer treatment or funding. When multiple industries and services rely on the same code, weakened maintenance capacity can create gaps in vulnerability response, and problems in a small open source project can spread across many pieces of software. That led to the point that the issue is connected to supply chain security risks.
The PSF case shows the imbalance between a very large open source ecosystem and the people protecting it. The PSF operates PyPI, the official Python repository, and PyPI hosts more than 750,000 registered libraries. Security management for PyPI also falls to the PSF. Yet even amid the rapid growth of the Python ecosystem fueled by the AI boom, the PSF has 11 employees, and it currently has 2 staff dedicated to security.
This does not mean open source itself is inherently insecure; rather, it shows that the core problem lies in the gap between the number of people who use it and the number of people who protect it. While many companies and institutions use open source, the burden of code review and vulnerability remediation is concentrated on a small number of developers and nonprofit foundations. User growth does not automatically translate into increases in security personnel or maintenance costs.
This problem space also applies to the public sector in South Korea. According to an NIA announcement, the open source-based e-Government Standard Framework is applied to about 66% of software development projects ordered by the Public Procurement Service in 2025. Open source has become established not just as a cost-cutting alternative, but as a foundational technology for information systems.
As the government begins work on managing open source supply chain security, the Korea Internet & Security Agency (KISA) is promoting this year's project, 'Support for Open Source Security Vulnerability Analysis and Management System Operations Based on Developer Companies' SBOM.' The project will identify the open source components used by developer companies through a software bill of materials (SBOM) and support vulnerability analysis and management for the identified components.
SBOM serves to identify the components an organization depends on and carries significance in supply chain security. However, because SBOM has the limitation of not showing who will continuously modify or maintain the components, response may become difficult if a widely used project is at risk of development suspension or a reduction in maintenance staff and a serious vulnerability is discovered during a suspension or scaling back of maintenance.
Accordingly, there are calls for a review of response measures when security problems arise in open source that the public sector depends on. Since there are limits to shifting the burden of open source security onto a small number of companies and nonprofit foundations, there is also a need to consider the government's role from the perspective of public infrastructure.
The government's intent is not to control open source development, but to understand how much domestic institutions depend on which open source projects and to provide financial, personnel, and technical support when key projects lack the capacity for maintenance and support. A supporting example cited is Germany's federal government-backed Sovereign Tech Agency.
The Sovereign Tech Agency was launched with backing from the German federal government, and its roots lie in the Sovereign Tech Fund, which began in 2022. Over roughly 2 years after launch, that predecessor fund invested 23 million euros in more than 60 core open source technologies, or about KRW 37.1 billion. After the transition to an agency, it has been running the Sovereign Tech Fellowship, which supports salaries so individual developers can devote themselves to open source maintenance.
Open source is easy for anyone to use, but it is not easy to protect, and right now someone is investing time and money to maintain it. Because the IT industry across both the public and private sectors depends on open source, the question is no longer just how much it is used, but who ultimately bears responsibility. The government is no exception to that debate.
Source: IT DAILY · Kim Ho-jun
Original: https://www.itdaily.kr/news/articleView.html?idxno=241200
References
This article was produced with the help of an automated content generation algorithm.
Source: IT DAILY
View originalThis article was summarized and organized by BizCrush based on the original article from IT DAILY. For exact quotations and full details, please refer to the original article.