Comment by throwaway2037

First, this is great reply with lots of real world experience to share.

    > I do think external dependencies are among our biggest security threats though.

This sounds like a good business opportunity. I know that Sonatype has a business to vet Java dependencies. Does your company use it? I am guessing that Sonatype may be expanding into other open source ecosystems.