<p><span class="h-card" translate="no"><a href="https://infosec.exchange/@dymaxion" class="u-url mention">@<span>dymaxion</span></a></span> <span class="h-card" translate="no"><a href="https://mastodon.social/@whitequark" class="u-url mention">@<span>whitequark</span></a></span> <span class="h-card" translate="no"><a href="https://mastodon.social/@rst" class="u-url mention">@<span>rst</span></a></span> <span class="h-card" translate="no"><a href="https://infosec.exchange/@tinker" class="u-url mention">@<span>tinker</span></a></span> <span class="h-card" translate="no"><a href="https://mastodon.social/@AndresFreundTec" class="u-url mention">@<span>AndresFreundTec</span></a></span> understandably, they are pushing against creating a liability relation with OSS maintainers and users in spirit of all those no guarantee clause</p><p>Those who are the supply chain of OSS are integrators and commercial entities reselling the software, c.f. CRA in EU</p>