All this talk about #xzorcist over the weekend, I want to also point out that it's important to remember that the "software supply chain" largely does *not* exist in regards to open source, because most people have no real relationship other than parasitic consumption with the project.
@Di4na's great blog post on this topic explains it quite well: softwaremaxims.com/blog/not-a-…
I am not a supplier
For the past few years, we have seen a lot of discussions around the concept of the Software Supply Chain. These discussions started around the time of LeftPad and escalated with multiple incidents in the past few years.Thomas Depierre