DARK

❯ Free Software Isn't Gratis

Why companies should treat
Open Source as part of their infrastructure

Christopher Tineo Senior DevOps Engineer @ Game Plan Tech

SRE Day NYC 2026 Q2

❯ whoami

Christopher Tineo

Senior DevOps Engineer · Game Plan Tech

GCP Pro Cloud Architect

CNCF Kubestronaut

CKA

Certified Kubernetes Security Specialist

CKS

Community Cloud Native SDQ · KCD New York · Cloud Native NYC

Upstream Kubernetes SIG Contributor Experience · Member

Sub-project Comms · Tech Lead

Release Kubernetes 1.37 · Release Comms Shadow

The five acts

Problem

The "free" in free software has a price someone pays.

Examples

What it looks like when the bill comes due.

Cost

To companies, to maintainers, to the ecosystem.

Solution

Treat open source like the infrastructure it is.

Action

What you do on Monday morning.

Act 01

The Problem

"Free" has a price. Someone always pays it.

Open source is everywhere

90% of modern applications contain open source code

In a typical enterprise codebase, somewhere between 70% and 90% of the lines of code come from public open source packages — not from the engineers who shipped the product.

Source: Synopsys Open Source Security and Risk Analysis (OSSRA) report, recent editions. The number moves around year to year, but the order of magnitude does not.

❯ clarification

Free software ≠ Open source

Two overlapping but distinct philosophies. Same code, different why.

Free software

A movement

User freedom as the goal
FSF · 1985 · Richard Stallman
Four freedoms (run, study, modify, share)
License ethos: copyleft

≠

Open source

A methodology

Practical benefits as the goal
OSI · 1998 · Raymond & Perens
10 Open Source Definition criteria
License ethos: permissive

Most projects are both. The difference is the why, not the what.

This is the intellectual setup for the rest of the talk. Two different terms, two different communities, two different values frames. They overlap on the code (most FLOSS is both), but diverge on the *why*. "Free software" is a moral stance: the user has rights. "Open source" is a practical stance: sharing the code makes better software. Both arrive at similar licenses, but the *conversation* about sustainability differs depending on which camp you came from. The talk title uses "Free Software" deliberately — the moral frame. The "Open source" frame comes in the cost sections. [TIMING: 90s. Don't dwell. Move on to the Stallman slide where the etymology actually lands.]

"Free" as in beer vs "free" as in speech

Portrait of Richard Stallman, founder of the GNU Project and the Free Software Foundation — Richard Stallman, founder of the GNU Project and the Free Software Foundation. His framing of "free software" — meaning freedom, not price — gave us this wordplay.

Stallman chose "free" to mean freedom (speech), not price (beer).

The English language has only one word for both, causing 40 years of etymological confusion.

This talk is about the gap between them — and who pays for it.

Act 02

The Examples

What it looks like when the bill comes due.

What is ingress-nginx?

The front door to your Kubernetes cluster.

Routes external traffic into your services.
Maintained by a handful of unpaid SIG Network volunteers.

~60%

Scope at end of 2025

of deployments relied on ingress-nginx as an ingress controller.

Source: CNCF End User TAB · Apr 2026

Scan to read CNCF report

Project kubernetes/ingress-nginx · Steward Kubernetes SIG Network

Set the stage. Ingress NGINX is not an obscure project — it's the default ingress controller most people reach for. By the end of this act, the audience should feel a small jolt of recognition: "I use this. And it's going away." The NGINX logo on the left is a quick visual anchor. Don't dwell on it — the audience knows the logo. The point of the slide is the recognition, not the brand. The bottom panel is the data the audience doesn't have. The "~60% of deployments" stat is from CERN's contribution to the CNCF End User TAB blog post (Apr 2, 2026), which also includes Boeing and a "large tech company" reporting on their migrations. This is the most recent and most authoritative public number — it's a real operator reporting from production, not a survey estimate. The number is a floor, not a ceiling. [TIMING: 60s. Less is more on this slide. The ~70% is the takeaway. Let the room absorb it before you advance.]

"In 9 years, ingress-nginx had exactly
one 'call for maintainers' issue."

It got 10 thank-you comments and 0 volunteers.

↳ @aledbf stepping down · kubernetes/ingress-nginx#4404

QR code pointing to ingress-nginx issue 4404

Scan to view issue

[TIMING: 90s. The number is the punch. Pause after "0 volunteers." Let the room feel the weight before you advance.] The link below the quote points to the actual GitHub issue (#4404, opened Aug 6, 2019 by @aledbf) so anyone in the room who doubts the receipt can verify it in real time. Worth pausing on the count: 10 thank-you comments (thanking him for his years of work, offering free drinks, etc.) and zero "I'll take it." Auto-closed as lifecycle/rotten on Feb 15, 2020 with no successor. [The ↳ symbol and the small mono caption under the quote are intentional. The quote lands; the receipt is there for anyone who wants to verify it later.] [This slide is now placed AFTER the ingress-nginx intro, so the audience has just seen what the project is and who uses it. The punch hits harder now: the project you just heard about had exactly one cry for help, and nobody came.]

The announcement → EOL

Mar 2025 Maintenance Mode: Entering security-only maintenance. No new features.

Mid 2025 Migration Scramble: Downstream projects begin coordinating emergency migrations.

Mar 2026 End of Life: Security updates stop. Production workloads are on borrowed time.

Now The Legacy Gap: Thousands of organizations are still running unsupported ingress controllers.

Source: Kubernetes project — Ingress NGINX retirement statement

QR code pointing to Ingress NGINX EOL statement

Scan to read statement

The humans behind the controller

14.7k total issues over 9 years

8 critical CVEs in 2 years

50+ issues permanently frozen

$0 compensation for maintenance

❯ what they actually do ($0 budget · after hours · on weekends)

Triage & Review · CVE Patching · Release Management · End-User Support

@rikatz · Dec 15, 2024 · kubernetes/org#5305

"I need some time for myself, and I am not really being able to take care of the project and my personal life together :)"

This is the human slide. The four stats are the receipts from the github research (docs/ingress-nginx-calls-for-help.md): 14,740 total issues, 8 significant CVEs in 2 years, 50+ frozen issues the maintainers literally could not triage (the frozen label was their escape hatch from the auto-stale bot), and $0 compensation for any of it. The rikatz quote at the bottom is verbatim from the kubernetes/org step-down PR. It's the most human line in the entire github record. Read it slowly. "I am not really being able to take care of the project and my personal life together." The smiley face is what makes it worse. [TIMING: 60s. Tighter than the rest. The stats and the quote do the work.]

Why it collapsed

The CVE mania

Eight significant CVEs and RCEs in two years — and the maintainers who had to fix them were not being paid to do it.

❯ 2022 · June

"we're drowning" mailing list call

❯ 2024 · May

CVE cascade forces emergency patches

❯ 2025 · March

CVE-2025-1974 RCE forces final EOL

CVE Overload: 2 maintainers fixing 8 CVEs without compensation. Unpaid labor scaled with security debt.

Triage Frozen: 50+ issues frozen because the queue became impossible to review.

Replacement Abandoned: InGate shipped and retired simultaneously. No volunteers for free work.

Corporate Rescue Declined: Steering declined last-minute takeover citing security trust risks.

"This is fine." 🔥

The CVE mania is the key insight. The maintainers weren't just overwhelmed by feature requests — they were being hit with a constant stream of security vulnerabilities that companies depended on them to fix, with no budget for the work. The three terminal blocks are the receipt: - Jun 2022: @strongjz's "we're drowning" mailing-list post - May 2024: CVE cascade forces 2-maintainer patching sprint - Mar 2025: CVE-2025-1974 RCE + pinned issue #13002 The "replacement project also failed" bullet is from the kubernetes/org research. InGate was the k8s-sigs successor with the same maintainer team. Nobody wanted to do the work for free. The BenTheElder quote in the research file is the kicker: "Nobody has been paying anyone to work on this software for some time, it has been entirely volunteer driven and they've been overwhelmed." That's the moral in one sentence. [TIMING: 90s. Read the bullets at a measured pace. Let the "This is fine." panel land silently for two beats before advancing.]

Act 03

The Cost

To companies. To maintainers. The AI threat.

Cost to companies

50% of cloud-native environments are affected, relying on ingress-nginx as critical infrastructure.

Zero direct 1-1 drop-in replacements exist. Every migration requires manual annotation translation.

Official Steering Committee Statement

"None of the available alternatives are direct drop-in replacements. This will require planning and engineering time."

Translate hundreds of custom Nginx annotations. Unplanned migrations are measured in engineer-months of lost roadmap velocity.

Source: Kubernetes Blog (Jan 2026) Read statement

Scan to read statement

Cost to maintainers

60% of open source maintainers are unpaid for their work Source: ByteIota / It's FOSS

@BenTheElder · Steering Committee · Jan 21, 2026

"Nobody has been paying anyone to work on this software for some time, it has been entirely volunteer driven and they've been overwhelmed."

The cost is the most expensive line item in this talk: time, health, and career impact. A salary or protected time would have changed the math.

The CVE cascade turned volunteer contributions into an unpaid second job with constant security liability.

This is the slide the SRE Day audience will feel in their chest. They're the people who would be maintainers if the economics were different. The "60%" number is supported by ByteIota's 2025 Open Source Analysis and It's FOSS, re-verifying that 60% of open-source maintainers are entirely uncompensated, despite 95% of enterprise software relying fundamentally on their code. The @BenTheElder quote on the right is the strongest single line in the entire kubernetes.org record. He's on the Steering Committee. The XZ Utils backdoor is what made the Steering Committee decline the last-minute corporate rescue — they didn't want to endorse a maintainer who hadn't gone through the contributor ladder. But the underlying problem was: nobody was paying anyone. The "CVE cascade" line at the bottom connects back to the "Why it collapsed" slide. The maintainers weren't just doing feature work for free — they were doing SECURITY work for free. That's the part that doesn't show up on a procurement report. [TIMING: 2 minutes. The number is the headline. The @BenTheElder quote is the moral. Let the room do the math.]

Vulnerabilities are becoming significantly more frequent and severe due to AI

Anthropic Project Glasswing / Claude Mythos Preview vulnerability detection visualization — Project Glasswing · Anthropic Mythos Preview

Black Duck 2026 OSSRA

Open source vulnerabilities doubled to 581 per codebase. 87% of codebases are at risk.

Anthropic Glasswing

Mythos Preview found 10k+ high/critical bugs. Open-source scan: 90.6% true positive rate (on track for 3,900 validated).

Threat Acceleration

Bad actors also have these AI models, accelerating zero-day discovery and exploitation.

Act 04

The Solution

Stop calling it free. Start treating it like infrastructure.

Open source is critical infrastructure

If 70–90% of your code is open source, dependencies are your infrastructure.

And we already know how to treat critical infrastructure:

Monitor

Watch for advisories, EOL announcements, maintainer health signals.

Set SLOs

Define what "healthy" means for each critical dependency.

Staff it

Assign owners. Budget time. Treat maintainer relationships as a critical asset.

What could I do?

01 · Discover

Discover

What are you actually depending on? Generate a complete SBOM. Know your transitive graph.

02 · Assess

Assess

For each critical dependency: how many maintainers? Who funds it? Is there a lottery factor of one?

03 · Fund

Fund

Direct sponsorship, GitHub Sponsors, Open Collective, foundation dues, LF Foundations, Whatever works.

04 · Contribute

Contribute

Time, code, reviews, documentation, security disclosures. The most valuable currency isn't money; it's attention.

❯ the new reality

The build-vs-buy equation has flipped

AI is driving down development costs, flipping the build-vs-buy equation. Traditional SaaS margins are eroding.

$1T+ SaaS market cap lost in a single month

+15% US engineering job growth (BLS 2034)

Scan to watch talk

Source: "Build vs. Buy Is Dead" (YouTube)

OSS is the Engine

We build on open source, and now we must pay our share by contributing fixes upstream.

Game Plan Tech · case study

Added GCS Workload Identity support to Percona MongoDB Operator for a federal compliance workload.

Rather than maintaining a private fork, contributing upstream solved it for us and the community.

Upstream Pull Request percona-operator#2315

Scan to view PR

[TIMING: 2 minutes. This is the bridge between the framework and the action. The video argues AI makes build cheaper than buy — but the corollary is that your CUSTOMERS can now use AI to build against your APIs, so the vendor business model breaks. The flip side: we don't write MongoDB operators from scratch, we use Percona's. When we needed a feature (Workload Identity for IL4/FedRAMP), we contributed it upstream as PR #2315. That contribution is how we "pay" for what we use. Same logic as the framework, but grounded in a real example from my own work.] [The two stats are the receipts: $1T+ SaaS market cap lost in a single month (the "SaaSpocalypse" frame the video uses) and +15% US engineering job growth through 2034 per the Bureau of Labor Statistics. The juxtaposition is the point — companies bleeding, engineers hiring.] [The Game Plan Tech example is the concrete instance. IL4 is a federal compliance level where you can't export service account JSON keys. Workload Identity is Google's recommended approach for GKE service-to-service auth. The operator didn't support it. Rather than fork, we contributed it upstream. Every GKE customer got the feature, not just us.]

Act 05

The Action

What you do on Monday morning.

What you do on Monday

Leaders & SRE Teams

Before adding a new dependency to your tech stack:

"If the core maintainer for this project won the lottery, what's the worst thing that could happen to your project?"

Individual Contributors

Have you ever thought, "Ugh, this project is great but if it had this X feature it would fit my needs perfectly"?

Open a Github Issue and contribute back!

❯ terminal

Tagging & tracking with gh / glab

GitHub CLI (gh)

# Loop all repos & fetch transitives (Free)
$ for repo in $(gh repo list --limit 100 \
    --json nameWithOwner -q '.[].nameWithOwner'); do
    gh api repos/$repo/contents/package-lock.json \
      -H "Accept: application/vnd.github.raw" | \
      jq -r '.packages | keys[] | select(. != "")'
  done

# Bulk check Lottery Factor (>10 contributors)
$ for repo in $(gh repo list --limit 100 \
    --json nameWithOwner -q '.[].nameWithOwner'); do
    gh api repos/$repo/contributors \
      --jq '[.[] | select(.contributions > 10)] | length'
  done

# Bulk Tag / Star dependency repos
$ for repo in $deps; do
    gh repo edit $repo --add-topic "critical-dep"
    gh api -X PUT user/starred/$repo
  done

GitLab CLI (glab)

# Loop all projects & fetch transitives (Free)
$ for repo in $(glab repo list -F json | \
    jq -r '.[].path_with_namespace'); do
    enc="${repo//\//%2F}"
    glab api projects/$enc/repository/files/package-lock.json/raw | \
      jq -r '.packages | keys[] | select(. != "")'
  done

# Bulk check Lottery Factor (>10 commits)
$ for repo in $(glab repo list -F json | \
    jq -r '.[].path_with_namespace'); do
    enc="${repo//\//%2F}"
    glab api projects/$enc/repository/contributors | \
      jq 'map(select(.commits > 10)) | length'
  done

# Bulk Tag / Star GitLab projects
$ for repo in $deps; do
    enc="${repo//\//%2F}"
    glab api -X PUT projects/$enc -F "topics=critical-dep"
    glab api -X POST projects/$enc/star
  done

❯ enterprise-tools

Automating with OSS Review Toolkit (ORT)

GitHub Action

- name: Run ORT Analyzer
  uses: oss-review-toolkit/ort-ci-github-action@v1
  with:
    vcs-url: "https://github.com/TineoC/contributor-site"
    output-dir: "ort-output"

GitLab CI/CD

ort_analyzer:
  image: ghcr.io/oss-review-toolkit/ort:latest
  script:
    - ort analyze -i . -o ort-output

Explore compliance tools: ORT · Snyk · GitHub Dependency Graph

Report: github.com/tineoc

This is fine.

It's only fine if we pay for it.

Thank you · Christopher Tineo · Game Plan Tech

kubernetes.io/blog/2026/01/29/ingress-nginx-statement · gnu.org/philosophy/free-sw

Happy 12th Anniversary, Kubernetes!

12 Years of Cloud-Native Innovation (2014 – 2026)

One more thing

Celebrating 12 years of Kubernetes:
Your free ticket to KCD New York 2026

QR code linking to KCD New York ticket redemption

tickets.kcdnewyork.com/redeem

June 10, 2026

Voucher: KCDNY26-CHRIS-ORGANIZER-FREE

Scan the QR code or enter the voucher at checkout. One ticket per attendee.

Find me · take the slides

Let's keep in touch

QR code linking to https://www.linkedin.com/in/christopher-tineo/ — LinkedIn

QR code linking to the slide deck on GitHub — Slides