4 ms·
Either the bugs aren't reported to upstream and it remains vulnerable, or they are reported and get fixed, making paying to access the audit pointless. The firs
by rozab 6y ago
Either the bugs aren't reported to upstream and it remains vulnerable, or they are reported and get fixed, making paying to access the audit pointless. The first option would basically involve the platform maintaining a closed fork, which won't work with most licenses and would be terrible for the ecosystem.
- the_duke 6y agoI don't see the connection. As I said, many companies require a review/sign off for each dependency (version). Since they usually can't get them externally, they have do it internally. Enterprises also throw a lot of money at support contracts they never use, there is absolutely space for auditing expenses that give assurance and will be more thorough than any internal process.