This is my response: > How many entities do you trust? I think this question is missing the point. Trust is how humans sense risks of a relationship they are

This is my response: > How many entities do you trust? I think this question is missing the point. Trust is how humans sense risks of a relationship they are in. Risk can be described as a set of potential events, characterised by amounts of damage and their respective probabilities. What matters is the total risk they have running a given system. Like, “what is the total amount of damage from security breaches per year, which covers 90% of the cases”? When we take this, probabilistic and economy-centric, view, it becomes obvious that actual performance of the suppliers is what matters. By performance I mean defect resolution and upgrade timeliness and reliability, and don’t even get me started on the Total Cost of Ownership. This is why the arguments from the Linux distributions side, including this fine article, are confronted by so much rage: the actual performance of distributions in delivering many valuable, modern, developed at fast pace, software tools is just not competitive in a large fraction of cases. You’re never going to dissuade people from short-circuiting distros. Not going to happen unless it becomes an economically sensible choice for them. I really liked this HN comment to the previous mgorny's article: https://news.ycombinator.com/item?id=26218464 https://news.ycombinator.com/item?id=26218464 (pasted verbatim below). It's really time we FOSS folks turn our attention towards economic aspects of our relationships. It's hard because underneath is a battle of who bears the maintenance and testing costs that no one wants to bear. Asking a publisher to qualify their library against a big range of versions just means that they need to do a lot more testing and support. Obviously they want to validate their code against one version, not 20, and certainly don't want an open ended > version which would force them to do a validation each time a minor dep is released. Similarly when publishers say I will only work against version X, this puts a bigger burden on the user to configure their dependencies and figure out which version they can use. They would like to push that work onto vendors. What's a bit depressing is that these economic concerns are not raised openly as the primary subject matter, but the discussion is always veiled in terms of engineering best practices. You're not gonna engineer your way out of paying some cost. Just agree on who bears the cost and how you will compensate them for the cost, then the engineering concerns became much easier.