How to keep Open Source open without leaving our communities open to threats

<p>The state of the internet, c 1990:</p> <ul> <li>Limited, opt-in connectivity: people had to both have access to a computer and that computer had to have access to the internet.</li> <li>Tooling required some in-industry knowledge to be able to run and use, not only for development but also for communication. </li> <li>Open source was a young movement. The "common source" was proprietary.</li> </ul> <p>The state of the internet, c 2025:</p> <ul> <li>Always online, might-not-even-be-to-opt-out connectivity: devices are almost always collecting and transmitting data, including audio/visual, in some cases even if "turned off".</li> <li>Easy to use tooling has made it easier for everyone to come together. The pervasiveness of technology also means that most people, of any background, can easily access other people in the thousands or even millions.</li> <li>Open source is common, accessible, and matured. A $9 <strong><em>trillion</em></strong> resource. Yes, <strong><em>trillion</em></strong>.</li> </ul> <p>These three significant changes drastically change the threat model for OSS communities. In the beginning, someone had to have both knowledge and resources to harm or otherwise compromise a community of developers. Now, anyone with a grudge can make a bot army with seamless integrations and gracious freemium tiers for AI/LLMs. Likewise, when open source was small, the "who" who would be motivated to harm and otherwise disrupt those communities was limited. Now there is both massive social and economic benefit to harm and disrupt. This means that risks and threats now still include the motivated and resourced <strong><em>with the addition of</em></strong> those who are scarce in both.</p> <p>We need to come together to build new organizational threat models that account for how this consequence has posed new risks to our communities. With care and attention to detail, we can introduce responsible friction that will protect our communication infrastructure, the lifeblood of what allows open source to grow.</p> <p>There will also be a workshop with this presentation, with the outcome of creating an ongoing working group dedicated to helping OSS Foundations of all sizes protect their communities.</p>