Our Software Dependency Problem (2019)

Previous discussion: https://news.ycombinator.com/item?id=18979596

Relevant: "crev" is a system for socially scalable and cryptographically verifiable dependency review https://github.com/crev-dev/crev