If you don't care about control over the downstream of your project, or funding, no one is forcing you to professionalize! I just want that to be available as an option to those who do.
Proprietary and corporate players are equally useless at securing their supply chains; I don't love that (from my perspective) they're now blaming and trying to coerce open source to become more like them to ostensibly fix the same problems they propagate themselves.
I'm not a security nihilist: I think improvement is possible. But in my experience, not many corporate managers or project sponsors ask for removal of features and reduction of attack surface.
Perhaps; some financial statistics that I'd suggest to consider would be:
- As of June 2018, U.S. households in the 0-40% income-level group had $0 median savings[1]
- From the same source: the median savings for a household in the U.S. is approximately $11k. There are approximately 120m households in the U.S. according to the U.S. Government census[2].
- As of 2022, thirteen firms from within the S&P 500 hold a combined $1 trillion in cash-on-reserve[3]
And yep, it'd be sensible to debate whether individuals or companies would be more likely to influence the direction of software; it's a disingenuous comparison to draw in that regard.
But even if we consider only individual citizens, there would still be significant disenfranchisement in dollar-voting ability.
[1] - https://www.cnbc.com/2018/09/27/heres-how-much-money-america...
[2] - https://www.census.gov/quickfacts/fact/table/US/HSD410219
[3] - https://www.investors.com/etfs-and-funds/sectors/sp500-compa...