It's not that it's that complex to need all of this. It's about ease of use. Home Assistant OS makes life simpler for users (such as myself), it makes it easy to use adding that run as additional docker containers, it makes plugging in USB z-wave/zigbee devices a breeze.
While it is technically no longer supported, you can still install the whole kit and caboodle using pip in a Python virtual environment, but why would you?
This is what I've been running on my generic x86-64 system for a couple of years now, 0 issues. Even migrated to a newer system recently because I wanted something that was slightly faster for ESPHome compilations.
That's why Matter and Thread are IPv6. You don't need IPv4 at all... and if you run out of IPv6 address space, I'd love to see just how many devices/sensors you have in your home.
It's a risk assessment calculation, and usually the lawyers make that call.
At a previous company I worked at legal considered it cheaper to reinvent the wheel if necessary to avoid GPL software than to potentially have to deal with a lawsuit around GPL being used in our software.
Even LGPL software was considered off-limits, because one wrong linker flag and now it's statically linked into the resulting binary...
> It sounds like they are making up excuses for not wanting to fully Open Source their code; which is fine. But don't blame upstream for your reluctance or inability to adhere to this.
They are changing the license on ALL of their source code. How is this making up excuses?
Second, I know plenty of companies where MySQL or Wordpress are not allowed to be used because they are GPL.
Security stuff is interesting even in the case where all your employees are saints.
If you are building a docker image for example, you likely are doing a pull from docker hub, the security scanning software can help you catch security issues there.
It can also help with things like dependencies in your node projects, python projects and more (at least, that is what the security scanning software we use at $work does, I assume gitlab is similar).
It's not about employees pushing malicious code, it's about catching issues with dependencies further up the stack, to make sure that the end result you are pushing to your servers/users is not vulnerable.