Open source registries don't have enough money to implement basic security