> we must stop expecting [Open Source] devs to have any responsibility for code they produce.
Yes, I agree with this. And something that's been in my head for a while, which often discussed, is how people often "magically think" something along the lines of:
"If we just paid these devs for support, then we'd solve the support problem!"
Unfortunately, I don't think is reality. If you're a dev working at Google and you toss a library on NPM, you probably can't be paid to support it because your employer forbids it.
The type of person writing libraries Open Source is not always going to be motivated by money!
> Some of my clients actually do (or pay others for) security review of every single NPM dependency they use in prod. If you can not afford to review 2000 dependencies then you can not afford 2000 dependencies. Find a leaner path.
There was a post a few months ago[0] that has been talking about a way to "democratize" this review process. It's been sitting in my head and it's actually a part of a project that I'm working on now[1]. (My apologies for that not being documented anywhere yet though!)
Essentially, if every company on this planet has to review every Open Source dependency, that's a massive waste of human effort because there is a ton of overlap between that work.
Instead, what if you could have one person/entity do that work to review the dependencies and then you "buy" that dataset for a fraction of the price? If it takes 10 humans a year to review every dependency you have, then it's cheaper to pay 1 human salary to buy that data. (And we do the work once but then sell it 100+ times.)
That's the core principle that's been in my head for a while and that's how we're trying to build a company right now.
Unsexy problems aren't very "shiny" (like Stable Diffusion or NFTs) but they are important!