> Detecting supply chain attacks at the end-developer level using such tooling is rarely going to pan out. Even if true, the uptake fraction (e.g. usage %) isn

> Detecting supply chain attacks at the end-developer level using such tooling is rarely going to pan out. Even if true, the uptake fraction (e.g. usage %) isn’t the key point: to provide an additional (rather novel to boot) layer of analysis and therefore security. Remember: security is layered. > Developers just don't care enough. Even if narrowly true, this neglects to recognize that developers exist in varied situational contexts. When properly motivated, some can use these kinds of tools.