Some mailing lists at [1], like oss-security & kernel-hardening. CISA (Cybersecurity and Infrastructure Security Agency) [2] has a few different areas they report on. Mozilla has the dev-security-policy mailing list for all things PKI (public key infrastructure) [3], and a few other lists as well. There's the Full Disclosure [4] mailing list for vulnerabilities/exploits, etc. Quite a few others at [5], though sadly many are no longer active.

[1] https://openwall.com/lists/

[2] https://www.cisa.gov/about/contact-us/subscribe-updates-cisa

[3] https://groups.google.com/a/mozilla.org/g/dev-security-polic...

[4] https://seclists.org/fulldisclosure/

[5] https://seclists.org/

I add new blogs as I run into them on twitter/reddit/HN/etc

They always have a lot of outgoing links in their show-notes that should get you started with the rest.

[1] https://www.criticalthinkingpodcast.io/

With an Open Source project you at least have the possibility that if it has enough users and companies using it then someone will fork the code if the company ever makes it closed source and keep the project going.

Two different business models:

- Sell a great+differentiated product, support is ~free and rarely needed

- Give a away a terrible product (usually an over-engineered CRUD), constant $upport is required to use it effectively