New blog post up. I find the concept of package taxonomies really hard to write about as I assume it's obvious. My interactions in the vuln mgmt community as taught me it's not obvious, so here's an attempt to talk about the problem.
Feedback very much welcome 🙇