This is a good, brief post on the software supply chain situation from the perspective of an open source maintainer: https://iliana.fyi/blog/software-supply-chain/
For better or for worse, a supply chain has emerged. We can agree that “supply chain” isn’t the right wording, and that the problem shouldn’t exist. But here we are. And here we will be. I do expect some big changes in the open source ecosystem that companies and other critical software providers need to adhere to, which almost certainly won’t be a positive for small open source authors/maintainers
@jerry Ha! The two footnoted actions expose two very real problems with corporations: 1) They don't trust their employees; and 2) They aren't in the habit of ever seeing software projects as completed. Both are driven by the capital nature of corporations. i.e., greed begets greed, and money is always spent well. They can't understand the quality equation inherent in FOSS development, because there is no capital in it.
