I agree that appropriate compensation is necessary, but I don't think it's sufficient. There's a lack of visibility and tooling for dependency management/auditi

I agree that appropriate compensation is necessary, but I don't think it's sufficient. There's a lack of visibility and tooling for dependency management/auditing. I can't even find a proper list of critical OSS along with their donation links. Moreover, there needs to be a fundamental re-thinking of the security model of languages and runtimes, i.e. even if I can eval() user input or load a plugin from the network, it should not be game over. There should be finer-grained access control in programs, both at the type-level and with how they interact with the OS. The global view of "your program can do anything unless said otherwise" needs to change.