New blog post up. I find the concept of package taxonomies really hard to write about as I assume it's obvious. My interactions in the vuln mgmt community as taught me it's not obvious, so here's an attempt to talk about the problem.
Feedback very much welcome 🙇
Replying to @darakian@fosstodon.org
@darakian when I was thinking about this sort of stuff a few years back my conclusion was that we’d need to ultimately resolve down to byte ranges + allow ambiguous names in the model.
https://theoryof.predictable.software/articles/some-requirements-for-a-universal-asset-graph/