>No, we do not have to do this. We wouldn't get anything done, if we tried to maintain our full oss stack. Where would you start? In the linux kernel and move your way up to chromium/firefox? Have fun out there.

People (sysadmins) have been doing this for years--it's nothing new. Software doesn't break that often. You generally start with wherever you're hitting the bug. Maintaining, running, and operating software is significantly different than writing from scratch (and generally less labor intensive)

What do you do when you hit a bug in production caused by some OSS? Throw your hands up and tell management you opened an issue on the issue tracker?