> Coordinate to get code coverage. This may be a central part of the issue. It's a coordination problem and creating common knowledge. Each corporation might

> Coordinate to get code coverage. This may be a central part of the issue. It's a coordination problem and creating common knowledge. Each corporation might be willing to pay to have some bits of their dependencies audited as long as others cover other pieces. But to do that they need to be able to announce the audit result and scan their dependency trees for pieces that are not audited and pick from those. You'd also need some common standards what constitutes an audit and the lawyers would probably want some limits on liability so results should be considered as best-effort or whatever. There are no conventions and social protocols in place to support this.