The Burden of Knowledge: Dealing With Open Source Risks

At FOSS Backstage 2025 in Berlin, I explored a critical challenge facing OSPOs and development teams: as we increase analysis of our software supply chains, tools and scorecards reveal potential risks in Open Source projects like low maintenance, lack of community, or poor security practices. But this data alone doesn’t help if it merely points out potential problems without offering solutions. The question is: how should we handle this burden of knowledge? Through manual reviews? Questionnaires? Funding? Or should we look away?

In this session, I focused on the strategic decisions organizations need to make when assessing risk in Open Source dependencies. Drawing from my experience at an organization using a six-digit number of Open Source packages, I explored the options between the extremes of “Let’s measure everything”, “Let’s avoid all risky Open Source”, and “Let’s not look at the data because it might scare off management”. I discussed how to decide whether to use a project, invest resources to support it, or move away from a dependency, and when it makes sense to actively engage with or withdraw from an Open Source project.

This talk provided an overview of feasible options and the foundation for a more informed discussion on managing Open Source risks strategically – without ignorance or fear.