Robert Thau on Nostr: Well, you could resolve not to use OSS without such a contract, but you'd be pretty ...

Well, you could resolve not to use OSS without such a contract, but you'd be pretty unusual -- and I'm not sure how you'd get a contract with the maintainers of, say, every JS dependency of something like React (which commonly does run server-side to speed up initial page load these days, and could do ... all sorts of malicious things in that context).