IT之家注意到，开源安全基金会认为这种情况不可能持续下去， 某些非营利组织和大型企业应该为这些基础设施买单 ，他们认为与商业用户建立合作关系、为大批量消费者保留分层访问模式、提供增值服务才是可持续发展之本，这样才能提高使用成本和透明度。

开源安全基金会（OpenSSF）联合Java、Python、PHP等组织发布声明，指出开源基础设施并非免费，大企业长期免费使用不可持续。声明呼吁企业应为开源基础设施付费，以保障其可持续发展。#开源生态##企业责任# Tags：开源安全基金会，Python，Java，PHP ...

A monthly overview of things you need to know as an architect or aspiring architect. Unlock the full InfoQ experience by logging in! Stay updated with your favorite authors and topics, engage with ...

PyPI module 'ctx' that gets downloaded over 20,000 times a week has been compromised in a software supply chain attack with malicious versions stealing the developer's environment variables. The ...

Software in Python Package Index (PyPI) and Hypertext Preprocessor (PHP) repositories have been targeted in supply-chain attacks, which researchers say are aimed at stealing users' Amazon Web Services ...