Anonymous 0-day dump shakes open source security assumptions

An anonymous GitHub account dropped a large batch of undisclosed vulnerabilities today, most of them targeting open source and free software. The HN thread is a mix of alarm and skepticism, with commenters questioning whether these are genuine 0-days or repackaged, already-patched CVEs. The signal is real either way: someone is weaponizing the openness of open source codebases at scale.

The pattern here is uncomfortable. Open source wins on auditability in theory, but in practice most projects are audited by nobody. When a single anonymous actor can mass-harvest exploits from publicly visible code, the 'security through obscurity is bad' orthodoxy starts to feel like a luxury that only well-resourced projects can afford. Several commenters pushed back on the 0-day label, arguing the term has been diluted beyond usefulness, but that deflection misses the real concern: the attack surface is enormous and largely undefended.

The deeper fear, surfaced in comments, is systemic. People are nervous about sensitive data, bank accounts, SSNs, living on networked systems built on software that nobody is actively watching. That fear is not irrational.