> Software Supply Chain Security could be a great opportunity for open source developers to get some money out of all the big corporations that benefit from the

> Software Supply Chain Security could be a great opportunity for open source developers to get some money out of all the big corporations that benefit from their work. I am not so sure about that. The big reason companies get certification is for liability and indemnification. For the software you are certifying: Have you paid for a security audit? Have you obtained certifications for all the open source dependencies of your software? How much of a bond have you put up? Do you have legal counsel that can respond to inquiries? Are you willing to travel to testify in court? Would you be convincing to a jury of your expertise? This type of certification plays much more into the hands of someone like Microsoft or Google with their massive size (so they can offer indemnity) their massive in-house legal counsel, and their name recognition.