Indeed. I'm very frustrated by all of the "this has shown how fragile FOSS is" hot takes I see appearing. I think it has shown us how awesome FOSS is: If this

Indeed. I'm very frustrated by all of the "this has shown how fragile FOSS is" hot takes I see appearing. I think it has shown us how awesome FOSS is: If this were all closed source software, chances are we'd never have known about the issue, nor would an entire community now be able to have an open conversation about how to mitigate it in the future, applying their combined brain power to the problem. And there's a fair amount of obvious steps to take now: - Re-visit the pro/con of anonymous contributions. Re-visit identity verification. Maybe do a SPDX-like thing for governance/contribution work flow mechanisms for project to report how they work and what stance they take, to allow downstreams to risk-rate. Some projects will very much want to continue to allow anonymous contribs for excellent reasons, and that's fine. - Phase out build and module systems that drive published tarballs differing from repo tags. - Have distributions verify that tarball contents match repo tags on import of new versions. Yes, this requires that projects have a repository that is reachable online. I think for critical SW that's OK. - Don't accept build systems that silently disable security features when dependencies are unavailable. Not building a security feature should always be a decision point and manual opt-out. - Come up with better metrics for maintainer burnout and heartbeat signals.