> everything in the dependency tree With reasonable prioritization, we can probably do a lot to reduce the threat long before we get near everything. > who is

> everything in the dependency tree With reasonable prioritization, we can probably do a lot to reduce the threat long before we get near everything. > who is going to pay for that? Well, this bill does seem to involve hiring FOSS devs, maybe that's partly what they'd do?