Open Source Security Loses Its Eyeballs

The institutional problem is that open source has treated visibility as a control, when visibility only matters if someone has time and incentive to look. Socket.dev’s claim that no one reads code before installation ^[1] lands because it names the behavior everyone already optimizes around: speed first, inspection later. AI-generated code turns that habit into infrastructure risk, because the volume now defeats the informal shame, peer review, and maintainer memory that once carried more of the security load.