Follow
@silvermoon82@tech.lgbt Which vendor is this? I'm generally extremely suspicious of such vendors, because they tend to use simple (and very wrong) metrics that mostly just end up reinforcing harmful maintenance practices, but upstream support (also financially) does sound a bit better than usual.
@silvermoon82@tech.lgbt (I should note that my dayjob is basically "dependency auditing" and I've seen a loooot of bad software supply chain services, so that's where a lot of the skepticism comes from :p)