Open source sustainability is getting more organized, but trust is fraying

A post titled 'We All Depend on Open Source. We Will Defend It Together' announced a new effort including something called Akrites, which would serve as a 'maintainer of last resort' for critical packages with no active maintainer. The thread engaged seriously with the ambition.

But the more interesting signal was a comment expressing deep concern about the gamification of open source, specifically that people good at gaming metrics like devstats are rising in visibility over people who do the actual work. This is a structural problem that no 'maintainer of last resort' initiative fixes.

The npm supply chain security thread from earlier in the week reinforces the same anxiety. The open source ecosystem is load-bearing for almost every startup, and the trust model underneath it is under stress from multiple directions: abandoned maintainers, metric gaming, and now well-intentioned but centralized 'defense' efforts that may introduce their own governance risks.