Not all free is the same free

Last week I was in New York for Insight Partners' ScaleUp:AI event, and one slide from Lonne Jaffe resonated deeply with me. It asks whether corporations will stop buying software now that GenAI can write it "for free." Then it answers with two pictures: a free beer and a free puppy.

Free beer: enjoy, no strings attached. Free puppy: yours to take care of, long term.

The open source world has argued about the word "free" for decades. Richard Stallman gave us "free as in speech, not free as in beer," and that distinction was about liberty, not price. It still matters. But if you run software in production, there's a third meaning nobody prints in the LICENSE file... free as in puppy.

And as anyone who has ever caved to a kid in December knows, a dog is for life, not just for Christmas.

The download is the cheapest day you'll ever have

The day you pull an open source package into production is the beer moment. It's cold, it's free, and it goes down easy. One npm install or docker pull later, your team ships in a week what would have taken a quarter to build.

Then the puppy grows up.

It needs patching when a CVE drops on a Friday night. It needs upgrading when a major version breaks your integration. It drags in dependencies, and those dependencies drag in their own, so the one dog you adopted turns out to be a pack. It needs somebody who understands its quirks when it misbehaves at 2 a.m. And it never stops needing to be fed.

None of that shows up on the price tag. The license cost is zero. The cost of ownership isn't.

Everybody loves the puppy. Nobody signed up to walk it.

Here's the uncomfortable part. When you adopt an open source project, you are usually assuming somebody else is doing the walking. That somebody is often a handful of maintainers, frequently volunteers, frequently exhausted.

We have run this experiment in public, more than once.

Heartbleed, in 2014, lived in OpenSSL: code protecting a huge share of the internet's encrypted traffic, maintained by a famously small and underfunded team. Log4Shell, in December 2021, turned a logging library buried deep inside countless Java applications into a fire drill that ate security teams alive for weeks, largely because so many organizations didn't know they were running it. And the xz utils backdoor in 2024 showed the darkest version of the story. An attacker spent roughly two years earning the trust of an overworked maintainer, and the backdoor was caught almost by accident, by Andres Freund at Microsoft, who noticed SSH logins were running about half a second slow.

None of these were failures of open source as a model. They were failures of ownership.

So what happens when puppies get dramatically cheaper to make?

GenAI is a puppy factory

That's the real question on the Insight slide. If GenAI can write the software, why buy it?

Because generated code is the second kind of free, only more so. The model hands you the puppy in seconds and then walks away. Nobody else has ever seen that code. No maintainer community is watching it, no advisory database tracks it, and nobody is going to file a CVE against your one-of-one internal service. You aren't just the owner of that puppy... you're the only vet in town.

The slide is fair about the other side of this, and so am I. GenAI may well make maintenance cheaper too, and the tooling for finding and fixing bugs is getting better fast. But attackers get the same tools, on the same timeline. Cheaper maintenance isn't no maintenance. AI might make the walks shorter. It won't teach the dog to walk itself.

Adopt on purpose, not on impulse

Let me be clear about where I stand. At Ory, we build open source identity and security infrastructure. I am not about to tell you to stop adopting puppies. I'm telling you to adopt them on purpose. Before you bring one home:

1. Count the dogs you already have. Keep a real software bill of materials, transitive dependencies included. The organizations that suffered most during Log4Shell were the ones still asking "do we even use this?"
2. Check who's walking it. Look at the maintainer count, commit activity, funding, and whether there's a published security policy. A project with one maintainer has a bus factor of one, and xz showed us exactly what that looks like.
3. Budget for the vet. Patching, upgrades, and monitoring are recurring costs with a named owner, not something that happens when someone gets around to it.
4. Decide who holds the leash. Own it fully in house, or pay someone to own it with you through commercial support, a managed service, or an enterprise license. Either answer works. "Nobody" doesn't.
5. Give back to the neighbors. Fund the projects you depend on and push your fixes upstream. The people walking your dog for free deserve recognition.
6. Treat generated code as an adoption, not a gift. Review it, test it, scan it, and put a name next to it, just like anything else you run in production.

Open source isn't free beer. It's a free puppy, and the puppy always comes home with you… and stays.

Running Ory open-source? What is Ory doing to improve security?

As vulnerability lifecycles accelerate, securing your open-source identity infrastructure cannot wait. While we have doubled our community open-source release frequency to bi-annual builds, production teams facing strict compliance and exploit risks need faster turnaround. With the new Continuous Security License (CSL), you can offload and focus on vulnerability patching with guaranteed CVE resolution SLAs, without all the capabilities of an Ory Enterprise License (OEL).