> The second approach is organizational. For example, Iron Bank currently offers only one price to its users: free. While this may seem “low cost,” software com

> The second approach is organizational. For example, Iron Bank currently offers only one price to its users: free. While this may seem “low cost,” software companies have no motivation to provide secure and high-quality components to Iron Bank because they cannot charge. If Iron Bank created “private” repositories that allowed companies could charge for access to high-quality software building blocks, it seems likely that Iron Bank images would have dramatically fewer known vulnerabilities. Ah yes, because this is historically what has happened.