Open source registries don't have enough money to implement basic security
(2026/02/16)
- Reference: 1771254009
- News link: https://www.theregister.co.uk/2026/02/16/open_source_registries_fund_security/
- Source link:
fosdem 2026 Open source registries are in financial peril, a co-founder of an open source security foundation warned after inspecting their books. And it's not just the bandwidth costs that are killing them.
"The problem is they don't have enough money to spend on the very security features that we all desperately need to stop being a bunch of idiots and installing fu when it's malware," said Michael Winser, a co-founder of [1]Alpha-Omega , a Linux Foundation project to help secure the open source supply chain.
Winser spoke at FOSDEM this year, in [2]a talk we dropped in on virtually.
[3]
Trusted registries are widely treated as a key component of Software Bill of Materials (SBOM) - driven supply chain security efforts, one of the main approaches promoted for securing open source software. Rule one: Get your open source packages from a trusted source.
[4]
[5]
Yet many of these registries operate on razor-thin margins, relying on non-continuous funding from grants, donations, and in-kind resources.
Google and Microsoft kicked in an initial $5 million to launch Alpha-Omega in 2022 under the Open Source Security Foundation.
[6]
And the first thing Winser noticed when he ramped up operations was that open source registries are all dirt poor. All the major registries are facing the same issue: They're experiencing exponential growth, even though their investment in infrastructure and people remains flat.
"We're living on borrowed time," he warned.
Scant money for security
"One of the problems that people have is they actually conflate open source software and open source infrastructure," Winser said.
Open source software itself is free to use, and its costs don't increase the more people use it. The costs of registries to hold all open source applications and libraries, however, do indeed keep increasing with greater usage.
Packages don't go away. Collections just grow larger and larger. And AI is now adding to the pile at a considerable clip.
[7]
In 2025, Alpha-Omega took a [8]deep dive into the operations of some of the largest registries, including PyPI, Node.js's npm, Rust's Crates.io, RubyGems, and Maven Central for the Java folks.
Winser ginned up a mock version of Family Feud ( [9]play here ) to help FOSDEMers guess the 10 biggest expenses for these registries.
Bandwidth naturally turned out to be the #1 cost, about 25% of the total expenses. Storage (18%), compute (15%) and battling malware (12%) all followed. New feature development barely registers at 2% and documentation wasn't even in the top 10.
Winser estimated it would cost $1 million in talent and $2 million in infrastructure to run a registry the size of [10]Crates.io , which gets about 240 million downloads a year. And that cost may double by 2030.
Adding to that bill is the growing cost of identifying malware, the proliferation of which has been amplified through the use of AI and scripts. These repositories have detected 845,000 malware packages from 2019 to January 2025 (the vast majority of those nasty packages came to npm).
It now takes a median of 39 hours to remove malicious packages — more than enough time for a self-propagating worm to spread through an ecosystem, as the [11]Shai-Hulud outbreak did across npm in September.
Secure that bag
The good news may be that "Registries are effective monopolies. They own the name space," as Winser put it.
But as monopolies, their hold is tenuous at best, because "the cost of spinning up an alternative, crappy registry, is effectively zero," he added.
Winser went through the various ways of covering expenses, though none, he calculated, could fully defray expenses.
The obvious solution would be to start charging for bandwidth. Caching and mirroring, though they lower bandwidth costs, do not solve the problem. As soon as a registry starts charging, other entities will most likely start caching the artefacts, offering them gratis.
And they should be doing this anyway, Winser noted, for the benefit of the registry. "If you're not caching you're a goddamn idiot," Winser said.
In some cases benevolent parties can cover these bills: [12]Python's PyPI registry bandwidth needs for shipping copies of its 700,000+ packages (amounting to 747PB annually at a sustained rate of 189 Gbps) are underwritten by Fastly, for instance. Otherwise, the project would have to pony up about $1.8 million a month.
Yet the costs Winser was most concerned about are not bandwidth or hosting; they are the security features needed to ensure the integrity of containers and packages.
Alpha-Omega underwrites a "distressingly" large amount of security work around registries, he said. It's distressing because if Alpha-Omega itself were to miss a funding round, a lot of registries would be screwed.
Alpha-Omega's recipients [13]include the Python Software Foundation, Rust Foundation, Eclipse Foundation, OpenJS Foundation for Node.js and jQuery, and Ruby Central.
Donations and memberships certainly help defray costs. Volunteers do a lot of what otherwise would be very expensive work. And there are grants about.
Winser churned through other ways to pay the bills. How about running an app store? Charging $0.99 per package seems pretty reasonable, yes?
Yet this approach faces several immediate challenges. For starters, the package maintainers will want a cut of that. Setting up and maintaining payment infrastructure would incur additional costs.
Plus, open source developers probably would not be okay with any form of digital rights management, so the containers they will download will be unencumbered and easy to copy around.
Any attempt to monetize a monopoly will immediately result in people routing around it. "They've done this time and time again," Winser said.
Back to square one.
[14]Another open source project dies of neglect, leaving thousands scrambling
[15]Open-source AI is a global security nightmare waiting to happen, say researchers
[16]Open source's superior security is a matter of eyeballs: Be kind to the brains behind them
[17]OpenSSF warns that open source infrastructure doesn't run on thoughts and prayers
The same problems would apply to a subscription model, in Winser's view. One person buys a subscription to the registry then shares the log-in with his friends, like you do with your streaming accounts.
How about charging the producers of the open source software? In effect, the registry becomes the publisher. This, Winser argued, would cause a fair number of projects, or companies with open source projects, to set up their own registry sites, fragmenting the community. And who knows what their security posture will be.
Another approach: Add enterprise features, then charge for them. This has worked for some service providers – such as GitHub – so perhaps it could work for registries as well.
Still, corporations aren't exactly clamoring for enterprise registries, Winser noted. And if they want to pay for security features, it will probably be through a security vendor.
"Anybody have any better ideas?" Winser asked the crowd, rhetorically. One audience member suggested ads.
Winser did not offer a solution, though he suggested the key is to convince the corporate bean counters to consider paid registries as "a normal cost of doing business and have it show up in their opex as opposed to their [open source program office] donation budget."
"I don't have the answers," he admitted.
The cost of free beer
Money is a rarely discussed aspect of open source. The software is just supposed to be like free beer, right?
Hospitals, universities, and museums are all nonprofits, yet they still charge for services. In fact it is good practice; otherwise people will abuse the system. But in open source, the idea of payment remains taboo.
Open source may indeed be like free beer, but no one enjoys their frothy lager served chock full of parasites and bacteria. So maybe we all should get used to ponying up at the bar. ®
Get our [18]Tech Resources
[1] https://alpha-omega.dev/about/about-alpha-omega/
[2] https://fosdem.org/2026/schedule/event/8WJKEH-package-registry-economics/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aZNNMQAQanmuuJtwtrKz_gAAAZg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aZNNMQAQanmuuJtwtrKz_gAAAZg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aZNNMQAQanmuuJtwtrKz_gAAAZg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aZNNMQAQanmuuJtwtrKz_gAAAZg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aZNNMQAQanmuuJtwtrKz_gAAAZg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://michaelwinser.github.io/package-registry-sustainability-research/
[9] https://michaelwinser.github.io/registry-cost-survey-says/
[10] http://crates.io
[11] https://www.theregister.com/2025/09/16/npm_under_attack_again
[12] https://pypi.org/
[13] https://alpha-omega.dev/grants/grantrecipients/
[14] https://www.theregister.com/2025/12/02/ingress_nginx_opinion/
[15] https://www.theregister.com/2026/02/01/opensource_ai_is_a_global/
[16] https://www.theregister.com/2025/07/22/open_source_windows_security_opinion_column/
[17] https://www.theregister.com/2025/09/23/openssf_open_source_infrastructure/
[18] https://whitepapers.theregister.com/
"The problem is they don't have enough money to spend on the very security features that we all desperately need to stop being a bunch of idiots and installing fu when it's malware," said Michael Winser, a co-founder of [1]Alpha-Omega , a Linux Foundation project to help secure the open source supply chain.
Winser spoke at FOSDEM this year, in [2]a talk we dropped in on virtually.
[3]
Trusted registries are widely treated as a key component of Software Bill of Materials (SBOM) - driven supply chain security efforts, one of the main approaches promoted for securing open source software. Rule one: Get your open source packages from a trusted source.
[4]
[5]
Yet many of these registries operate on razor-thin margins, relying on non-continuous funding from grants, donations, and in-kind resources.
Google and Microsoft kicked in an initial $5 million to launch Alpha-Omega in 2022 under the Open Source Security Foundation.
[6]
And the first thing Winser noticed when he ramped up operations was that open source registries are all dirt poor. All the major registries are facing the same issue: They're experiencing exponential growth, even though their investment in infrastructure and people remains flat.
"We're living on borrowed time," he warned.
Scant money for security
"One of the problems that people have is they actually conflate open source software and open source infrastructure," Winser said.
Open source software itself is free to use, and its costs don't increase the more people use it. The costs of registries to hold all open source applications and libraries, however, do indeed keep increasing with greater usage.
Packages don't go away. Collections just grow larger and larger. And AI is now adding to the pile at a considerable clip.
[7]
In 2025, Alpha-Omega took a [8]deep dive into the operations of some of the largest registries, including PyPI, Node.js's npm, Rust's Crates.io, RubyGems, and Maven Central for the Java folks.
Winser ginned up a mock version of Family Feud ( [9]play here ) to help FOSDEMers guess the 10 biggest expenses for these registries.
Bandwidth naturally turned out to be the #1 cost, about 25% of the total expenses. Storage (18%), compute (15%) and battling malware (12%) all followed. New feature development barely registers at 2% and documentation wasn't even in the top 10.
Winser estimated it would cost $1 million in talent and $2 million in infrastructure to run a registry the size of [10]Crates.io , which gets about 240 million downloads a year. And that cost may double by 2030.
Adding to that bill is the growing cost of identifying malware, the proliferation of which has been amplified through the use of AI and scripts. These repositories have detected 845,000 malware packages from 2019 to January 2025 (the vast majority of those nasty packages came to npm).
It now takes a median of 39 hours to remove malicious packages — more than enough time for a self-propagating worm to spread through an ecosystem, as the [11]Shai-Hulud outbreak did across npm in September.
Secure that bag
The good news may be that "Registries are effective monopolies. They own the name space," as Winser put it.
But as monopolies, their hold is tenuous at best, because "the cost of spinning up an alternative, crappy registry, is effectively zero," he added.
Winser went through the various ways of covering expenses, though none, he calculated, could fully defray expenses.
The obvious solution would be to start charging for bandwidth. Caching and mirroring, though they lower bandwidth costs, do not solve the problem. As soon as a registry starts charging, other entities will most likely start caching the artefacts, offering them gratis.
And they should be doing this anyway, Winser noted, for the benefit of the registry. "If you're not caching you're a goddamn idiot," Winser said.
In some cases benevolent parties can cover these bills: [12]Python's PyPI registry bandwidth needs for shipping copies of its 700,000+ packages (amounting to 747PB annually at a sustained rate of 189 Gbps) are underwritten by Fastly, for instance. Otherwise, the project would have to pony up about $1.8 million a month.
Yet the costs Winser was most concerned about are not bandwidth or hosting; they are the security features needed to ensure the integrity of containers and packages.
Alpha-Omega underwrites a "distressingly" large amount of security work around registries, he said. It's distressing because if Alpha-Omega itself were to miss a funding round, a lot of registries would be screwed.
Alpha-Omega's recipients [13]include the Python Software Foundation, Rust Foundation, Eclipse Foundation, OpenJS Foundation for Node.js and jQuery, and Ruby Central.
Donations and memberships certainly help defray costs. Volunteers do a lot of what otherwise would be very expensive work. And there are grants about.
Winser churned through other ways to pay the bills. How about running an app store? Charging $0.99 per package seems pretty reasonable, yes?
Yet this approach faces several immediate challenges. For starters, the package maintainers will want a cut of that. Setting up and maintaining payment infrastructure would incur additional costs.
Plus, open source developers probably would not be okay with any form of digital rights management, so the containers they will download will be unencumbered and easy to copy around.
Any attempt to monetize a monopoly will immediately result in people routing around it. "They've done this time and time again," Winser said.
Back to square one.
[14]Another open source project dies of neglect, leaving thousands scrambling
[15]Open-source AI is a global security nightmare waiting to happen, say researchers
[16]Open source's superior security is a matter of eyeballs: Be kind to the brains behind them
[17]OpenSSF warns that open source infrastructure doesn't run on thoughts and prayers
The same problems would apply to a subscription model, in Winser's view. One person buys a subscription to the registry then shares the log-in with his friends, like you do with your streaming accounts.
How about charging the producers of the open source software? In effect, the registry becomes the publisher. This, Winser argued, would cause a fair number of projects, or companies with open source projects, to set up their own registry sites, fragmenting the community. And who knows what their security posture will be.
Another approach: Add enterprise features, then charge for them. This has worked for some service providers – such as GitHub – so perhaps it could work for registries as well.
Still, corporations aren't exactly clamoring for enterprise registries, Winser noted. And if they want to pay for security features, it will probably be through a security vendor.
"Anybody have any better ideas?" Winser asked the crowd, rhetorically. One audience member suggested ads.
Winser did not offer a solution, though he suggested the key is to convince the corporate bean counters to consider paid registries as "a normal cost of doing business and have it show up in their opex as opposed to their [open source program office] donation budget."
"I don't have the answers," he admitted.
The cost of free beer
Money is a rarely discussed aspect of open source. The software is just supposed to be like free beer, right?
Hospitals, universities, and museums are all nonprofits, yet they still charge for services. In fact it is good practice; otherwise people will abuse the system. But in open source, the idea of payment remains taboo.
Open source may indeed be like free beer, but no one enjoys their frothy lager served chock full of parasites and bacteria. So maybe we all should get used to ponying up at the bar. ®
Get our [18]Tech Resources
[1] https://alpha-omega.dev/about/about-alpha-omega/
[2] https://fosdem.org/2026/schedule/event/8WJKEH-package-registry-economics/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aZNNMQAQanmuuJtwtrKz_gAAAZg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aZNNMQAQanmuuJtwtrKz_gAAAZg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aZNNMQAQanmuuJtwtrKz_gAAAZg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aZNNMQAQanmuuJtwtrKz_gAAAZg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aZNNMQAQanmuuJtwtrKz_gAAAZg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://michaelwinser.github.io/package-registry-sustainability-research/
[9] https://michaelwinser.github.io/registry-cost-survey-says/
[10] http://crates.io
[11] https://www.theregister.com/2025/09/16/npm_under_attack_again
[12] https://pypi.org/
[13] https://alpha-omega.dev/grants/grantrecipients/
[14] https://www.theregister.com/2025/12/02/ingress_nginx_opinion/
[15] https://www.theregister.com/2026/02/01/opensource_ai_is_a_global/
[16] https://www.theregister.com/2025/07/22/open_source_windows_security_opinion_column/
[17] https://www.theregister.com/2025/09/23/openssf_open_source_infrastructure/
[18] https://whitepapers.theregister.com/
Re: Unquestioning, much?
takno
$1.8m a month is around 2-3% of list price for AWS on Cloudfront. Caching wouldn't save you anything since that is the price going out of the CDN. I'd say $1.8m is probably what Fastly would charge a user for a commitment of 750pb.
I suspect you might have got your TB and PB mixed up, and possibly your Gb and GBs.
Re: Unquestioning, much?
xcdb
Well, I wasn't trying to do a detailed analysis more of a "nah, that can't be right" and taking the article claim of "189 Gbps" spent 5 mins seeing what a similar aggregate bandwidth could cost...
Re: Unquestioning, much?
dgeb
Cloudfront bandwidth pricing for it works out like this, per https://aws.amazon.com/cloudfront/pricing/pay-as-you-go/:
747PB/yr = 62.25 PB/mo
1TB @ $0.00 = $0
9TB @ $0.085/GB = $765
40TB @ $0.08/GB = $3,200
100TB @ $0.06/GB = $6,000
350TB @ $0.04/GB = $14,000
524TB @ $0.03/GB = $15,720
4PB @ $0.025/GB = $100,000
57.25PB @ $0.02/GB = $1,145,000
Total = $1,284,685
(This is based on it all being in either North America or Europe, which have the joint lowest rates - the blended cost for global traffic will be somewhat higher, although we lack sufficient data to know by how much.)
So far from being around 2-3% of list price, it's very much in the ballpark. Although very likely you're right that the $1.8m was a Fastly figure, they only publish low-volume pricing so we can't check it.
Re: Unquestioning, much?
Jeff 11
In a like-for-like cost of doing it yourself, that figure is going to be inflated by the CDN providing lots of edge-side replication and more peak capacity - 189Gbps is only an average. But indeed not to the tune of 100-200x what you've calculated...
Name and Shame ?
alain williams
Some very large & very profitable enterprises are heavy users of open source but contribute nothing to what they depend on.
if projects were to name the non-paying skinflint companies they might be able to shame them into making contributions.
Re: Name and Shame ?
VoiceOfTruth
That old chestnut again - make the 'big' users pay.
If you use open source, you are a user too. Reach into your pocket.
Re: Name and Shame ?
alain williams
Reach into your pocket.
I do.
Do you ?
Irongut
> Hospitals, universities, and museums are all nonprofits, yet they still charge for services.
No, that very much depends on where you live as I have never been charged by a hospital or museum for their services.
Hospital charges
alain williams
No, that very much depends on where you live as I have never been charged by a hospital or museum for their services.
Have you been in a hospital car park recently ? I was charged £4 for ½ hour at the Lister hospital (Stevenage) recently :-(
Stuff costs money.
Tron
I spent most of 2025 in and out of NHS hospitals. Overall that was about £1000 in costs for taxis and prescription charges. I guess you must live next to a hospital and round the corner from a museum.
Unquestioning, much?
"In some cases benevolent parties can cover these bills: Python's PyPI registry bandwidth needs for shipping copies of its 700,000+ packages (amounting to 747PB annually at a sustained rate of 189 Gbps) are underwritten by Fastly, for instance. Otherwise, the project would have to pony up about $1.8 million a month."
If you were insane enough to pay AWS list prices, but who at that scale would be doing that?
A quick look at OVH suggests that unmetered 25Gbps is about £1,000/month, so even if you were bonkers and didn't cache (and ignoring hosting fees and using only the sustained figure of ~200Gbps) it would be about $11,000/month for the bandwidth vs the article "~$1,800,000/month"