[acrispino]

The lack of a bright line doesn't make the idea meaningless. It's just a judgement call.

It's not unreasonable to be more concerned about an open source library disappearing than say, postgresql or mysql disappearing. No macho posturing required.

[savanaly]

But people who complain about this stuff usually don't frame it that way-- absolutist statements like from the GP: "Anything you use in a critical path you should control." are common. The message is typically "I realize something fundamental that you don't and I'm owning all my dependencies and you don't own any of yours," rarely "I made a different choice about dependency ownership and here are the reasons I think that's appropriate for you too."

[acrispino]

You seemed to take a pretty holistic, system-wide view of "critical path" which is fine. Do we know if the other person meant that?

Let's say I'm working front-end web development. My "critical path" might include: js bundler, some kind of application framework, various libs, etc. The scope of my work (and authority/responsibility) informs what I can reasonably have under my control.