Vendoring is the right attitude even if it is not the solution. Each company should know exactly its dependancies (ie S-BOM), and if there is a problem, they s

Vendoring is the right attitude even if it is not the solution. Each company should know exactly its dependancies (ie S-BOM), and if there is a problem, they should look to produce their own patch and release that. Now this second part is … a little naive, but it’s quite feasible for that to become a middle ground industry. The big distributions are fine but as a thought experiment imagine a group of ISVs focused on say python web services. They can provide an immutable nix-like definition of a simplified stack, keep a treadmill of updates and security patches, probably as binaries. I think there is unlikely to be a way such “focused distros” will ever give up warranties so perhaps we are not making progress. However until we live in a global socialist utopia, we need to find some way of making the “raccoon in the dumpster” get paid.