I agree from a technical perspective. For political actors, on the other hand, they use the publicity of these security flaws to smear OSS from executives, policy makers and the general public.
Just FYI, I’ve worked on a big Brazilian state owned tech company and I heard multiple times from top executives sponsored by politicians of how closed source is better for security because the flaws aren’t apparent, or because only employees of said company could touch the code base. We devs all knew that was all bullshit, but they use this kind of justification to the wide public in order to justify their shady business deals.


































Good to know… I don’t use Python very often, so I’m always a bit oblivious of the recent changes. I’m mainly a Java developer (or Kotlin, when the employer is generous and let me pick the language). In this regard, JVM ecosystem seems to be a bit less chaotic. Maven and Gradle approach seem to be less of a mess than what I find in other ecosystems. The main issues on this ecosystem are some widespreadly used behemoths like Spring framework and Java EE, which often encapsulate and integrate other libraries in all sorts of creative ways and which can cause a big dependency hell if devs don’t consider carefully their choices.
By the way, which is the better tool for virtual envs in Python, nowadays? Pipenv or venv?