I used to be neutral to even opposed to many tenants of the free software movement. But the more I'm involved in supply chain risk management discussions, espe

I used to be neutral to even opposed to many tenants of the free software movement. But the more I'm involved in supply chain risk management discussions, especially around software and observe the continuing breaches such as Solar Winds, the more I am coming to the realization that the only way to reasonably validate your operating environment is having access to and the ability to evaluate the source code for the software you rely on - and the best evaluation is being able to build, from source and then compare that build to your current production environment. At one time entering a password to log into your computer was considered a ridiculous requirement that only the biggest businesses could justify, full disk encryption was exotic, hard to manage and had huge performance penalties yet now desktop OS's make it trivial and accessible to even non-technical users. I think source/build validation will one day become commonplace and considered the norm too. It will probably take longer given the whole philosophy behind closed sourced software, intellectual property, etc. but I think it's inevitable. If instead of Solar Winds the same parties were able to penetrate Microsoft, Apple or Google....