AWS, Google, OpenAI and a dozen more pledge to “defend open source.” The maintainers aren't sold

A real problem, wrapped in a suspect guest list

The open letter, published by the Linux Foundation and signed by more than two dozen companies including AWS, Anthropic, Cisco, Citi, Google, IBM, JPMorganChase, Microsoft, NVIDIA, OpenAI and Red Hat, names a genuine shift: “Finding a serious vulnerability … used to take an expert weeks. This now takes a machine minutes.” Its answer, branded Akrites, promises a single confidential channel for disclosure, a dedicated incident response team, funding and engineering resources, and — the eye-catching clause — to “stand as the maintainer of last resort” when a critical package has no one maintaining it.

The first substantive reply went straight to the accounting. Dmitry Grinberg asked the question the press release skips:

“Akrites employs no engineers, so who will make the fixes and who'll pay them?”

“Maintainer of last resort” already exists — it's called a distro

The structural critique was that the headline promise reinvents something the ecosystem already has. As one veteran contributor put it, anything they’d “maintainer of last resort” would in practice be a fork: “We already have hundreds of distributions acting as maintainer of last resort many times over, only with actual developers and not presuming to make themselves the new upstream for anyone else.”

The deeper objection was about direction. A long-tenured contributor zeroed in on the one operative line (“participants will contribute engineering resources”) and judged the rest: the initiative “favors centralization and corporate circles, exactly the opposite of what the hacker ethics promotes for good reasons.”

The fear isn't the help. It's the help that arrives as homework

What maintainers actually dread, one reader spelled out, is the failure mode where this becomes a firehose of AI-generated patches “with even more time pressure to merge, lest them consider projects 'unmaintained' … and use it as a rationale to take over the project.” Set against a signatory list of the largest commercial consumers of open source, the letter reads less as a gift and more as a governance claim. Whether Akrites contributes through existing pull requests or quietly forks the commons under its own roof is the test — and the thread is waiting to see which.