I agree. I could see some value to a kind of measurement like that, but I agree that that particular method seems heavy handed. This is partly what SBOMs are

I agree. I could see some value to a kind of measurement like that, but I agree that that particular method seems heavy handed. This is partly what SBOMs are meant to solve for. I’m also not sure calling Linux “aging infrastructure” that is obscured by activity in the Kernel is intellectually honest. Perhaps it’s better framed as a naive take. If the point is about shopping the rest of the OS (“all the dependencies” if you will) being a supply chain issue, I think the point would be better.