What to do about open source vulnerabilities? Move fast, say