[croggle]

No really, The IRS will use something like Red Hat and the Red Hat Corporation will be providing a level of guarantee which the IRS can fall back on should they need to.

If they just pull patches from the community themselves, when something goes wrong they will have to take the blame themselves and people will think they are foolish being so reckless. As a techie, this option may seem feasible to you but then again you're just some random guy on HN who probably thinks node.js is the be all and end all of IT. I doubt you've got the intelligence (cleary) or the experience (very cleary) to understand how the IT industry works at a human, risk management and legal level.

[wslh]

It's funny how you talk about me without knowing me. You don't even made a background check to see if I adjust to your node.js bias.

No, my company sells hard core technology to big vendors and sign the kind of corporate contracts that you refer in your comment. Since the IRS will not solve the issue there is another route: selling a hotpatch service to another vendor who sells to the IRS.