@foolishowl @Epic_Null @ironiridis @murb @bagder it was ever getting free labor as soon as corps got interested in using floss. As soon as 2004, I was working on a company whose business model (since 2001) was mostly just that.
That and a flag to hire brilliant people ("hey look, you will do open source here, and there's not that many place where you can"), something Google & all abused for decades.
Regarding #supplyChain / #vulnerability and #floss, #Europe seems to getting it right with the Cyber Resilient Act, after debuts in near catastrophe.
At first, the CRA looked like it was written by people not knowing that #floss existed, or trying to get free labor. The cost of vulnerability management was totally shifted on code writer.
Then, after an epic mobilization (with big involvement of the eclipse foundation), we reached something that look satisfying.
In summary, with #cyberResilienceAct, it's the first one in the chain monetizing the software, directly or as a dependency, that is responsible for the safety and thus paying for vulnerability management.
libxml2 maintainer move is totally aligned with CRA current goals. If you take benefits of free labor, you're responsible for the safety level. You, as a company, can always redevelop the piece of software if you find the risk too high.