Who Bears the Burden? Rethinking Expectations Around Software Supply Chain Security

This piece challenges the common expectation that software providers and open-source maintainers must shoulder the entire responsibility for supply chain security. It addresses a critical misalignment in the tech industry: while organizations demand absolute security guarantees from their dependencies, most maintainers operate with limited resources and no contractual obligation to provide comprehensive security oversight. Understanding this disconnect is essential for building realistic security strategies.