@sheevink @yosh yeah I'm not a fan of all the onus of all this supposed accountability always being forced to the bottom of the chain. If anybody using my library needs to cough up an SBOM and finds something amiss, I literally never want to hear about it. It's their problem alone.

There are a lot of people calling in ethical responsibility in the Serde situation in the absence of legal ones which also seems pretty moot since caring about build times is a perfectly reasonable choice.