Huh. OK, that’s fair. I guess a more precise phrasing would be: the relationship is indeed almost the same as far as the rules of engagement are concerned, but

Huh. OK, that’s fair. I guess a more precise phrasing would be: the relationship is indeed almost the same as far as the rules of engagement are concerned, but the default starting point is very different: with a conventional supplier you don’t (get to) start using their product in yours until after basic terms have been negotiated, almost necessarily including some kind of right to have the supplier fix their stuff if it’s broken in an obviously stupid way. Open-source things, though, individual devs can and do just pick off the floor. (Not necessarily good from a security standpoint, but hinder that process too much and work slows down to an extent most businesses won’t be able to afford, much like with installing outside software.) Which means that if you find some in your codebase and treat the author as you would any baseline supplier[1], just because there’s no way you wouldn’t negotiated the corresponding terms, you rightly get called an arsehole. This pattern of problematic behaviour predates the “software supply chain” meme, I think, but the fact that the meme seems to justify it in the minds of some people is a reason to dislike this analogy. Even if, as I said before, the other, liability half of it is entirely true. [1] https://daniel.haxx.se/blog/2022/01/24/logj4-security-inquiry-response-required/ https://daniel.haxx.se/blog/2022/01/24/logj4-security-inquir..., https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95644#c8 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95644#c8, and I’m sure I’ve seen more of those