How should that work? Nobody knows who is using which part from which repo. And it's not just about big business. There are all kind of small communities and little apps, extensions, etc. with some small communities. Most of them don't even make money, but are juicy targets for some small fast money.

Forcing everyone to raise their security and gain awareness about those things is a huge win for everyone, and only a little problem for the individual user. And it seems to be only a phase anyway, as most people & services are moving to more comfortable solutions over time.

Billion-dollar businesses can pay full-time professionals for support. They can hire staff or contract with a vendor. They can audit the free software they use or, like the good old days, pay for software whose vendors maintain it.

Or they can use hobbyist-written software for free, which is just fine, but don’t expect the hobbyist to support it for free.

> How should that work?

By the users of the software I publish noticing the license that states that while I hope this software is useful to them, it is provided with `"NO WARRANTY, NOT EVEN FOR FITNESS OF PURPOSE" and planning accordingly.

If you're an entity that wants to ensure that software you use from a source that you have approximately zero power over (and has explicitly provided NO warranty for that software) is and continues to be fit for purpose, you're going to have to inspect that software at a point in time, determine if it is fit for your purposes, and carefully inspect every future version of that software that you're considering using.

There really are no shortcuts. Requiring one to drink a Confirmation Can to log in doesn't change the math here.

> How should that work?

Fork and change the readme to reflect that this version is hardened for big business.