Seems like they are taking the right approach. Instead of trying to regulate OSS, they're funding CISA to help make it more secure.