Open Source Is Infrastructure: Why we must treat it that way

In 2024, a near supply chain attack on XZ Utils exposed a critical weakness in the global software ecosystem: widely used infrastructure depended on a single, under-supported maintainer. This was not an isolated incident. From the Log4j vulnerability to Heartbleed, systemic risks continue to emerge from underfunded and overstretched Open Source projects. In the Python ecosystem, this dependency is even more pronounced. Modern applications often rely on hundreds of packages from PyPI, many of which are maintained by a small number of contributors. These packages power everything from fintech systems to machine learning pipelines, yet their sustainability is rarely considered. This talk reframes Open Source as critical infrastructure rather than community goodwill. It explores the security, economic, and governance implications of this shift, with particular attention to how contributors in Africa are affected by limited resources, funding, and access. Attendees will gain a deeper understanding of the risks in the Open Source supply chain, why these issues matter to Python developers, and how both individuals and organizations can contribute to building a more secure and sustainable ecosystem. OutlineOpen Source Is Infrastructure: Why We Must Treat It That Way 1. Introduction: The Wake-Up Call (3 mins)a) Opening story: the XZ Utils near–backdoor incident (2024)b) The uncomfortable truth: critical systems rely on unpaid maintainers.c) Framing the talk: this is not hypothetical risk, it is a governance failure.d) What the audience should expect 2. Open Source as Invisible Infrastructure (5 mins)a) Where Open Source shows up in real systems b) Dependency reality c) Case study: Log4jOne library, global impactWhy this exposed a systemic issue, not a one-off 3. The Human Layer: Who Maintains This Infrastructure? a) Maintainer reality b) Case study: HeartbleedGlobal impact from under-resourced maintenance c) Structural issuesBurnout and unpaid labourSingle points of failure d) Global inequalityBarriers for contributors in Africa and the Global SouthWhy maintainership is not evenly distributed 4. When Policy Fails, Systems Break a) Security risksWhy attackers target Open Source dependenciesRise of supply chain attacks b) AI governance gapPolicy focuses on models, ignores infrastructureWhy this is incomplete without Open Source c) Digital public infrastructureGovernments relying on Open Source for identity and servicesRisk of fragile foundations d) Innovation inequalityMaintainer sustainability tied to personal financial stabilityHow this shapes who gets to build and maintain 5. What Needs to Change a) Reframing Open SourceFrom “community effort” to critical infrastructure b) Policy-level solutionsPublic funding models (e.g. Sovereign Tech Fund concept)Procurement that includes maintenance and securityRegulation that reflects Open Source realities c) Industry responsibilityOpen Source Program Offices (OSPOs)Paying maintainers, not just consuming code d) Developer responsibility Understanding your dependenciesContributing beyond code (docs, funding, advocacy)Making sustainability part of engineering decisions 6. The Global-South Opportunity a) Growing reliance on Open Source in fintech, AI, and cloud across Africa b) Opportunity to shape a more equitable ecosystem early c) Why investing in contributors and maintainers locally matters 7. Closing: The Reality We Must Accept a) Recap:Open Source is infrastructureThe system is underfunded and fragilePolicy has not caught up b) Final thought c) Call to actionBuild, contribute, advocate, and fund with intention. d) Q&A