Why AI Agents Are Redefining the Open Source Supply Chain

Hi, everyone. Welcome back here to Text Strong tv. I'm happy to have Ang Maa logo.

I hope I got it right. You nailed it. Ang is, yeah, we did it.

Great. Tobar is now the Chief marketing officer, CMO at Eclipse, the Eclipse Foundation. So first of all, Tobar, since the last time you hear of promotion, congratulations.

And they got a good man for the job. Good for you. Good for them.

I hope so. Yeah. Hi.

I think so. Tobar Mark, people say, how, how do you qualify to be the CMO at a place like the Eclipse? Give them a little sense of your journey.

Great question. So, um, I am an engineer by training and trade initially on in my career. Um, I've had a variety of roles in r and d and product management and marketing over the last, over 20 years now.

So I'm, I'm dating myself here, Alan, uh, mm-hmm. But the, the last decade or so I've been in the open source world and it's been quite a ride. And, uh, no day is, is the same as the, uh, the last and at the Hooks Foundation, uh, what, uh, we do, uh, our mandate is three things.

We want to, uh, ensure that we're empowering developers, we are enabling collaboration, and we are ensuring user freedoms. So the role of my team, the, the great folks that I get to work with around the world, is doing that from the perspective of marketing and events and product management, which, uh, we're gonna talk about a a bit later on. Excellent.

Um, you know what, as we were talking off, off camera, I think a lot of our audiences heard the name, the Eclipse Foundation. It's, it's a, it's bedrock in tech, right? It's, it's a known entity, but I bet if I asked everyone who raised their hand, if they heard the Eclipse Foundation, and then I went around and asked them, well, tell me about the Eclipse Foundation.

What does it do? You know, what's some of the software or the projects? They have a tough time.

So look, you're the chief marketing officer now, man, right? This is your job. You gotta change that.

You gotta change the equation to Mark. Tell, tell us, you know, give us the, I mean, we don't have all day, but tell us the Eclipse Foundation story, The, the elevator elevator pitch, if you will. Um, so we are one of the world's largest open source foundations, and our mandate is to essentially provide stewardship, so governance and, and a process framework around, uh, over 400 different open source projects, uh, ranging from the automotive software defined vehicle space to developer tooling to AI and, and edge computing.

So we have a pretty broad portfolio in terms of the different types of technology that are, um, hosted and honed at the Eclipse Foundation. And we are proud of the fact that we are the largest open source foundation that's actually based in Europe. So that's something that, um, uh, you know, if you look at our contributor base and committers, uh, it's a global community, but we are based in Europe and, uh, and proud of those roots.

Look, in this day and age of digital sovereignty and national sovereignty and personal sovereignty and AI sovereignty and all of the sovereignties, all of them, it's an important, yeah, it's important. It's an important distinction. And I, I thank you for bringing that up.

You know, Toba, I really think when we look back over this next, over the last, let's say three, four months, and over the next few months, when we look back through the lens of history, these are the months where I think the AI disruption that we've all been told about is starting to really gain traction. We're seeing it in open source software. We're seeing it in open source models.

We're seeing it in security, the amount of vulnerabilities and bugs being found by AI scanners. Um, and a lot of people are saying, oh, it, it's the death kn for open source software. Well, there's a lot of people who kind of, you know, the algorithms rule them a little too tightly and they get a little too wound up, but to say that it's not having any effect is naive and, and not true either.

So talk to us about how, in this day and age registries, let's say like open VSX, right? What is the future, near term, long term look like for them in this age of ai? You know, how does it stay current?

How does it incorporate this and, and, you know, stay as useful as it is? Yeah, that's a great question. I, I don't think it's a, an exaggeration to say that AI is changing every facet of our lives.

And that includes the digital realm and ecosystem that, that, uh, we are part of as the ECOS foundation and, and, uh, the various open source projects that, that we host, uh, under our Aegis, um, the, the way in which it's, uh, altering that landscape and the work that we do is something that, uh, we are still trying to wrap our heads around. I think you're absolutely right. Uh, you, you, you didn't necessarily say this, but what I heard is that, uh, we're at an inflection point, uh, both in terms of how it's impacting consumption and usage of the different products, if you will.

The, the, the software that comes out of the open source collaborative model, but also up and down the value chain or supply chain, you're seeing, um, AI having a profound impact, impact, rather. And you mentioned open VSX. So open VSX is the world's largest vendor neutral marketplace for vs code compatible extensions.

Uh, what does that mean in, in practical terms? Well, think of it as an app store for, for any extensions that work with vs code compatible, um, uh, uh, technologies. So as a result, what we are seeing through that extension registry, and this is something that, uh, in speaking with our friends at other package registries and, and repositories, uh, it it's something that's industry-wide is that you're seeing the extensions being consumed in a way that is different than Alan and Tang using, uh, using the software as we would've through, uh, an integrated development environment, uh, an IDE or a platform.

Uh, these AI agents, um, have a mind of their own, uh, I'll put it that way. And, and the, the nature of that, uh, often in terms of bandwidth and downloads is ex, uh, exponentially higher than, than what you would've seen from individual developers, right? So we've got some platforms that are using open VSX as a default registry that when they fire up, these AI agents essentially go and install and update extensions at 20 times the rate that a developer would.

So at, at, at that level of, uh, of scale, uh, in terms of, uh, the multiples. So we are all having to cope, uh, and, and as an open source project, open VSX is an open source project, and it's also a public registry that, that we host, uh, on our infrastructure. Uh, we are seeing our various costs, our bills go up in terms of the, uh, the bandwidth and storage and, and, uh, and and compute that's related to operating open VSX.

So what that has caused us to do is, is really have to, um, make some good and hard decisions around the future of open VSX and ensuring that it's always available and, and freely accessible to the developers that rely on it, as well as the companies that are commercializing and building all of these great innovative AI native tools, uh, on top of it. So it's, it's the best of times and the best of times, uh, in the sense that we are, uh, we we're, we're seeing a lot of goodness, but, but, uh, also commensurate challenges, uh, associated with that. So it's, it's goodness squared, if you will.

Yeah, yeah. No doubt. You know, I was, as I told you before, before we got on camera, I did a whole bunch of videos today, but in, in talking to some of the folks that I've been interviewing and talking with, I think what we're seeing now with AI is problems of scale.

Yes. Using ai, we are running into scale like we've never seen, right. Finding 600 vulnerabilities in open source projects a few days after you release a new version of an AI model, we're really not equipped to, to go do, you know, to go deal with that in a timely manner.

We've gotta, we've gotta build up the muscle memory and, and, and responses for that kind of thing. When we look at the amount of code, I, I saw some charts today, the amount of code in 2025 beyond hockey stick, it's almost vertical. Yep.

Right? The amount of open source, uh, uh, code contributed, all of these things are ho not hockey stick. They're vertical lines.

Yes. Yeah. They're vertical lines.

Like you said, you need the infrastructure to support that. We, we weren't, if we weren't counting, you know, a doubling or tripling our storage or our bandwidth or our instances or our compute power. Yeah.

Um, not to mention what using AI itself takes in terms of compute and, and infrastructure. Absolutely. Absolutely.

So These are all things, and, and you know, in a lot of ways, at least in the tech industry, toba, I, I feel like we're a new kid with a toy on Christmas Day, right? And, and we're, we're using AI because we can, not necessarily, because we should not, that we shouldn't use AI for, you know, we are using it for things that I think over time we're gonna realize, yeah, no, that's not probably the best use of it economically, or, you know, for whatever reason we're learning all this, right? This is a, this is a literally, you know, an 800 pound gorilla that we don't really understand the, its best usage, its best way of, of, of leveraging.

Uh, unfortunately it falls to organizations like the Eclipse Foundation, right? Because you're on the front line of this. So I get what you're doing, I get what I'm hearing from you.

I guess my final wrap up to you is how are you coping? Yeah. It, as, as I think you're spot on.

Um, and as we were saying before, it's an embarrassment of riches and, and learnings and coping is, is absolutely the right word. So, just to put what you're describing into, uh, into perspective, when we first launched the Open VSX registry, so this is again, the, the publicly hosted version of Open VSX, the project. We were thinking of it as a best effort, background service that would help satisfy the needs of our community and a few, uh, stakeholders in the, in the industry.

Um, we just recently surpassed 300 million downloads per month. Um, so that's about six times what we saw in the initial year. So a six x to your point around scale.

Uh, and, and by the way, I, I, I bought a sweet spot in my heart for hockey analogies because I'm a hockey dad, hockey parent twice over. So I spent a lot of my time in, in hockey arenas. And by the way, it is, as you said, it is very much this, uh, this, uh, exponential growth that we're seeing, both in terms of the, the downstream consumption, uh, and but also the publishing where we're up to 7,000 unique publishers with 10,000 extensions.

Every time we update our, uh, our, our, our, uh, dashboard, it, it's immediately out of date because that, that growth vector and that velocity is, is as strong as it has been. And the primary driver for that, uh, or at least one of, uh, the, the primary drivers to your, uh, earlier question is AI made of tooling and, and what we're seeing in terms of the cloud IDs. So you can go through essentially, uh, a who's who a vs code compatible, uh, platforms and tools that are backstopped by, uh, open VSX, so have backend integrations into open VSX.

You've got your Amazon kiro, your Google anti-gravity cursor, windsurf, all of these use open VSX. And, and what that's translated to for us in terms of coping is making sure that, um, we, we have the funding and, and, uh, and the operating model that keeps pace with that. So some of the announcements that we've made recently are around implementing rate limits.

Uh, and again, that's not to punish anyone. It's really to enable us all to thrive, uh, both individuals. So the, the developers and open source projects out there for whom we're giving, um, really generous rate limits as well as the commercial platform vendors, the folks that need to have, uh, the, uh, the downloads and the bits flowing at a much faster rate in order to satisfy their millions of use, uh, of users.

Uh, there was a recent analysis that that, um, estimated their approximately between eight and 10 million developers that rely on open VSX, they may not know it. And in fact, in many of our conversations, we ask people, Hey, do you know anything about open VSX? If you used it?

And they say no, but when you ask, uh, Hey, do you use, uh, antigravity from Google or, or, uh, any of those other platforms that I mentioned, it turns out that they are indirectly using Open vs sites. So, uh, rate limiting to ensure stability and scalability. And then, um, we are actively working with, uh, some organizations such as as Kiro, as Amazon rather, uh, and, uh, and Cursor who have really stepped up their support and, and we're tremendously grateful for them, uh, uh, kicking in financial contributions as well.

Um, so it's, it's all of those things. We're looking at it from a technology perspective, from an operational, and also financial in terms of working with those key stakeholders, those heaviest users, to ensure that the safe, the, the, the service is secure. It's, it's stable, it's scalable and, and freely available for, for the ecosystem.

Love it. Deb, I, I realize it's probably a little later in the day by you. I appreciate you coming on here.

Best of luck. Well, first of all, and congratulations on be being CMO now. Thank you.

Uh, best of luck to you and the Eclipse Foundation. Come back on and keep us posted because these are, these are really interesting times, right. And we're gonna see how this unfolds all of us.

Absolutely. Yep. Well, thank you so much, Alan.

All Right, my friend. It's good seeing you. Congratulations.

And be well. Thank you. We're gonna take a break here on Textron tv.

We be, we'll be back in a moment.