I think you missed his point on the Equifax story. I think he was trying to illustrate that their reliance on the Struts dependency come with a responsibility o

I think you missed his point on the Equifax story. I think he was trying to illustrate that their reliance on the Struts dependency come with a responsibility of both knowing where that dependency was being used. As well as monitoring that usage to ensure that you aren't left vulnerable by that usage. It's entirely orthogonal the responsibility of publishers of the dependency which you address in your comment. Both are important. But Russ's audience wasn't publishers. He was talking to the consumers and what they need to understand when they take on a dependency.