People in your software supply chain
I appreciate this article bacause this is an important distinction to make. In fact, it is so important that I am willing to rewrite code in order to know the names and contact information of all of the people that my dependencies depend on, as well as having some sort of professional relationship with them.<p>For example, in a project I am working on, I need a database, a way to talk over the Internet, and cryptography. Obviously, I know what database to use: SQLite (D. Richard Hipp). Obviously, I know what dependency to use for talking over the Internet: curl (Daniel Stenberg).<p>Cryptography is harder, but I finally settled on BearSSL (Thomas Pornin). BearSSL does not give me everything I want, however; since I want OPAQUE (a way for clients to not give their password to a potentially malicious server), I need that. BearSSL also does not give me a &quot;KSF,&quot; or key-stretching function, which OPAQUE requires, though I can use Argon2i for that.<p>The reference implementation for Argon2i unfortunately seems dead, even though I know the names of the people who made it. I don&#x27;t know if they will respond if I contact them, while I do know that D. Richard Hipp, Daniel Stenberg, and Thomas Pornin will respond. So in order to make sure I always have a point of contact with <i>all</i> of my dependencies, I am going to write Argon2i, BLAKE2b (needed by Argon2i), and OPAQUE myself.<p>Bad idea? Yeah, don&#x27;t roll your own crypto. But I am studying hard, and I intend to get my crypto audited before publishing.<p>The end result, however, is very worth it: my dependencies will be well-known, and I know each of the authors personally, albeit through email.<p>And down the road, if I manage to make some money, I can kick some of it <i>back</i> to them in exchange for their previous help. In turn, they&#x27;ll be happy to continue the relationship.<p>That&#x27;s how Open Source works at its best: it depends on relationships, and on giving back to those relationships. I think that that is what this article is trying to say, and I whole-heartedly agree.