The manifesto sure sounds like it's coming from a (security) consultant, not a developer. > Recognize the open-source code consumption's real risks. >

The manifesto sure sounds like it's coming from a (security) consultant, not a developer. > Recognize the open-source code consumption's real risks. > Establish open-source software consumption policies and test them against risk tolerance and other objectives. > Adopt and refine tooling, best practices, and processes for tracking and enhancing the security of consumed OSS. Rather than writing manifesto's I recommend getting your hands dirty in the trenches. Show, don't tell. As the lobbying seems to be aimed at "software developer organizations" consuming Open Source, I was expecting a recommendation along the lines of: contribute either money or time sustaining the project you rely on.