Read also this excellent article by Russ Cox (of Go fame) on the issue: https://research.swtch.com/deps https://research.swtch.com/deps This is at heart an ec

Read also this excellent article by Russ Cox (of Go fame) on the issue: https://research.swtch.com/deps https://research.swtch.com/deps This is at heart an economics problem: how to provide a public good (software security) in the presence of free riders. The way society handles this kind of risk is through insurance, but there are a number of things that need to happen to enable a sustainable economic basis to fund the necessary dependency-vetting to happen. Edit: I wrote up my thoughts on the way forward here: https://blog.majid.info/supply-chain-vetting/ https://blog.majid.info/supply-chain-vetting/