Which brings up a good point... is any company doing dynamic evaluation of the package updates to see what they are actually doing?