Wrt [[XZ open source kwetsbaar door psyops 20240331083508]] and examples referred to here, the author focuses on technology fixes to reduce risks. Whereas most of the problems highlighted are social aspects, for which no other solution is suggested than paying OSS devs who maintain stuff. That may well alleviate some of the social aspects that became an attack surface, but does nothing to look at Q of connections between devs and knitting those into relationships that are more resistant to social engineering and psyops. That and more transparency both on the social side of things and the chains. OSS is open source wrt the piece of software in front of you only.