Seems to me that the hazards described below accrue to any software you don't / can't audit / test and it's just a question of how much you can successfully bla

Seems to me that the hazards described below accrue to any software you don't / can't audit / test and it's just a question of how much you can successfully blame on the vendor and further more deflect with "my hands are tied because contractually I'm bound by the vendor not to reverse engineer": * software is ubiquitous * software opens the door * software is an appealing attack vector for bad actors because it can be widespread and highly effective * without controls in place to detect malicious changes, they may go unnoticed until they're distributed The mitigations also apply to software generally: * security and software teams (to) work together to develop policies and a process for testing applications and software components * (ummm, static analysis does apply to proprietary software, they just call it breaking the law) But who is suposed to do all this, really? The Linux Foundation is going to spend $10Mil and that's going to prevent Solar Winds? Does not compute.