If consequences matter, they should apply to vendors, too

The author argues that recent U.S. policy is increasing pressure on cybercriminals through enforcement and disruption while simultaneously weakening software supply-chain accountability by making attestations optional; he calls for both aggressive action against criminals and stronger consequences for insecure software production to raise the cost of cyber predation.