Podcast and blog by Josh Bressers and Kurt Seifried on open source security, CVEs, supply chains, and maintainers.
HN commenters cite it on topics like single-maintainer open source projects, ineffective old security practices, and CVE problems, using its episodes as supporting references.
My experience has been quite the opposite. Like OP, I am a middle aged developer. I have decades of experience in the industry and with open source/side projects. I think there is so much good new software being developed by single developers (https://opensourcesecurity.io/2025/08-oss-one-person/). When there is one person its an itch to scratch, not a business plan.
I do think the type of projects have indeed changed however, so maybe OP is looking in the wrong place, or has become steeped in the corporate world (see Middle Aged).
Look at app stores, f-droid, vscode plugins, github repos, frontend frameworks, distributed databases, Linux desktops, TUI apps, text editors. There are more projects than ever. They may not be as low level or as widely used as system kernels or programming languages, but there is so much code being written for personal needs.
I actually think the fact that these are not widely used is important. Higher level constructs and AI have made programming much more accessible. Non-devs are making one off apps just for their family. Or using LLMs to quickly churn out scripts to automate home assistant or common desktop tasks.
I personally have built several projects from my long-running ideas list that I never would have had time to do before without the help of AI. Savr is one (https://github.com/jonocodes/savr). For someone like me who has built that same CRUD interface for every company, AI has been an amazing motivator to work on new interesting…
Posted on December 8, 2025 | Greg K-H
It’s been almost 2 full years since Linux became a CNA⁰ (Certificate Numbering Authority) which meant that we (i.e. the kernel.org community) are now responsible for issuing all CVEs for the Linux kernel. During this time, we’ve become one of the largest creators of CVEs by quantity, going from nothing to number 3 in 2024 to number 1 in 2025. Naturally, this has caused some questions about how we are both doing all of this work, and how people can keep track of it.
I’ve given a number of talks over the past years about this, starting with the Open Source security podcast right after we became¹ a CNA and then the Kernel Recipes 2024 talk, “CVEs are alive, but do not panic”² and then a talk³ at OSS Hong Kong 2024 about the same topic with updated numbers and later a talk at OSS Japan⁴ 2024 with more info about the same topic and finally for 2024 a talk with more detail⁵ that I can’t find the online version.
In 2025 I did lots of work on the CRA⁶ so most of my speaking⁷ over this year has been about that topic , but the CVE assignment work continued on, evolving to meet many of the issues we had in our first year of being a CNA. As that work is not part of the Linux kernel source directly, it’s not all that visable to the normal development process, except for the constant feed on the linux-cve-announce mailing list⁸ I figured it was time to write down how this is all now working, as well a bunch of background information about how…
> It seems that what they are saying is: In a free hosting platform where we share all the resources, it's not fair that some people using LLMs are using up disproportionately huge hosting resources to handle the unnaturally large amounts of resources they can churn out with these tools.
Then instead of addressing the excessive resource usage problem indirectly via banning AI-assisted apps, they could've addressed it directly by imposing limits/quotas.
It's abundantly clear (and not that they are hiding it either) that their issue is with AI itself so anything else is just a secondary concern if not even a smokescreen.
---
> I'm a solo dev, and I couldn't find the judgement against solo developers or any slight against people who don't have a team.
Quoting their blogpost [0]:
> ## The development team of none
> Using LLMs to work with your code gives you a kick of adrenaline. You can develop at a rapid pace, build things as if you had a large team. Only that you have none. In fact, you are (often) alone, working with a statistical machine that turns energy into code.
I couldn't care less about what they think about solo developers, but it's just one bad excuse after another and that's what people are criticising. Open Source is one person. [1]
---
[0] https://blog.codeberg.org/protecting-our-floss-commons-from-llms.html
[1] https://opensourcesecurity.io/2025/08-oss-one-person/
That the FOSS bazaar broke off into megachurches while still maintaining a healthy small scale and independent bazaar [0]. That FOSS sustainability is much more complicated than just "throw money at it".
That there's "metal paste" [1].
That the zodiac killer's messages have been cracked for five years now (I didn't know they were cracked to begin with) and that it was a shift and substitution cypher [2]. The telltale clue was that the symbol frequency was uniform but under shift it become non-uniform.
How to solder those pesky connectors that come on the tiny servo motors you can get from Aliexpress [3].
That Firefox only has 2.3% market share [4].
Multiscale 3d truchet patterns are freakin complicated [5].
That prioritizing tasks by the linear combination of priority and effort remains a good strategy.
[0] https://opensourcesecurity.io/2026/01-cathedral-megachurch-bazaar/
[1] https://www.youtube.com/watch?v=Ys-RMVJ89dk
[2] https://www.youtube.com/watch?v=3CJsKJ0XKP4
[3] https://www.youtube.com/watch?v=KHulZtR2Qkg
[4] https://gs.statcounter.com/browser-market-share
[5] https://archive.bridgesmathart.org/2018/bridges2018-39.html#gsc.tab=0
He was not wrong. Microsoft has been "activists" that have been actively lobbying multitudes of states for years pushing for consumer privacy protection laws that really do meaningfully improve peoples privacy.
Of course, that's only technically correct. The bills they have been pushing for are terrible, they improve consumer privacy status quo in the worst way possible, by taking one step forward and building a wall that prevents any further steps.
The reason for this is mostly because they hate the idea a GDPR-esq law in the US and hope if they pass enough shitty laws in the states they can forestall federal legislation.
https://www.eff.org/deeplinks/2020/03/tech-lobbyists-are-pushing-bad-privacy-bills-washington-state-can-and-must-do
Interview with the author of the above piece on the topic: https://opensourcesecurity.io/2022/02/13/episode-310-hayley-tsukayama-from-the-eff-talks-about-privacy/
https://opensourcesecurity.io/2022/10/16/episode-345-cheap-hacking-devices-turn-security-upside-down/
Josh and Kurt talk about ineffective security from the past we still use today. There has been a great deal of progress in the last few decades bringing us amazing products like the Flipper Zero, cameras that can peer inside locks, and even software defined radio. A great deal of security relies on people not having easy access to these cheap devices. What does this mean for the future of security?