All this talk about #xzorcist over the weekend, I want to also point out that it's important to remember that the "software supply chain" largely does not exist in regards to open source, because most people have no real relationship other than parasitic consumption with the project.
@matk@Di4na I'm getting very tired of the "software supply chain" talk because it's all wrong. This blog post crystallizes my feelings about it very well.
It's also fundamentally why I have such a problem with OpenSSF, SLSA, and SPDX. They've started imposing and normalizing this psuedo-relationship around open source consumption that I believe fundamentally damages the commons and the community.
Add comment