Open Source Is Under Attack & AI Made It Worse • Steve Poole & Olimpiu Pop • GOTO 2026

Value of the Information & Strength of the Argument

The value of this interview lies in its candid, expert perspective on the intersection of AI, regulation, and open-source sustainability. Poole’s argumentation is coherent and grounded in his extensive experience at Sonatype and HeroDevs. He identifies a plausible threat model: AI makes vulnerability discovery cheaper and broader, while the maintenance burden remains concentrated on a few volunteers. This asymmetry is persuasively linked to potential outcomes such as maintainer burnout and the commercialization of security fixes. The discussion is strengthened by concrete examples of attack techniques and practical advice (e.g., reducing dependencies, staying on maintained releases). However, the arguments are primarily anecdotal and lack empirical data or citations to studies, which limits their evidential weight. The interview does not engage with counterarguments or alternative viewpoints, and the reliance on ‘worst-case scenarios’ introduces a speculative element. Nonetheless, the clarity of reasoning and the insider perspective make it a useful contribution to the discourse on software supply chain security.

Scientific Rigor, Source Quality, Title Accuracy

The video is well-structured, with clear chapters and a focused topic. The rigor is moderate: while the speaker cites concepts like the CRA and Kubernetes AI policy, no primary sources are explicitly referenced within the conversation. The description provides links to social profiles, the GOTO site, and an article (gotopia.tech/articles/457) that may serve as further reading, but these are not formally cited during the discussion. The title accurately summarizes the content: the video does argue that open source is under attack and that AI has exacerbated the situation. There is no evident mismatch between title and content. The absence of peer-reviewed references and reliance on personal experience lowers the scientific rigor, but the interview is transparent about its nature as expert commentary. The video does not claim to present original research, so the adequacy is acceptable for an opinion piece. No comment data was provided, so audience reception cannot be assessed.

The title accurately reflects the discussion on open source vulnerability and AI's role.

7/10

Expert speaker with extensive industry experience in software supply chain security, but the content is opinion-based without cited studies.

• 00:00Intro
• 01:30A watershed moment for software supply chains
• 04:50How attackers actually get in
• 08:59The CRA, regulators & a surprise enforcer: Insurers
• 11:58Maintainers are walking away
• 19:41Vibe coding brings 3x more dependencies
• 24:09AI-generated code is still your responsibility
• 27:46Outro

• GOTO Conference website — Official GOTO conference platform, likely where the interview is hosted.
• GOTO Unscripted article (related content) — Potential article accompanying the video, possibly elaborating on the topics discussed.
• Steve Poole's GitHub — GitHub profile of guest Steve Poole, possibly containing projects and resources.
• Olimpiu Pop's GitHub — GitHub profile of host Olimpiu Pop.
• Steve Poole's LinkedIn — LinkedIn profile of Steve Poole, providing professional background.
• Olimpiu Pop's LinkedIn — LinkedIn profile of Olimpiu Pop.
• GOTO on Bluesky — GOTO's official Bluesky account.
• GOTO on LinkedIn — GOTO conference company page on LinkedIn.
• GOTO YouTube channel subscription — Subscription link for GOTO Conferences channel.