Solving Open Source Supply Chain Security for the PHP Ecosystem
I don&#x27;t get it, who is going to pay for the time and energy required to audit everything? I presume the big package maintainers already have eyes on their stuff - symfony etc.<p>In theory we should always diff upstream package changes - in practice hardly anybody does. There&#x27;s a trade-off between using OSS code and the cost of maintaining it yourself.<p>That said I guess this adds an option to the ecosystem that wasn&#x27;t there, or possible before.