> Hang your shingle out by publishing negative (vote-against) attestations of vulnerable versions of open source software and positive attestations (e.g. code-r

> Hang your shingle out by publishing negative (vote-against) attestations of vulnerable versions of open source software and positive attestations (e.g. code-review) of the versions that mitigated the issues they disclosed. I don't know. I have sat here rewriting this comment now about 4-5 times. I guess we'll see how it plays out but I don't share your optimism for the economic incentives being there for people to undertake this kind of work. I do applaud you for this work though, and the efforts. The work you and Paragon have performed as part of the PHP ecosystem has been exemplary.