niplav comments on Patching ~All Security-Relevant Open-Source Software?