> Currently the two sustainable answers for that are No, there aren't two, there are three; the third one is the one you slid by: > rewriting all the software

> Currently the two sustainable answers for that are No, there aren't two, there are three; the third one is the one you slid by: > rewriting all the software you depend on If sudo bugs don't get fixed by the existing developer(s), companies that depend on sudo will just end up writing their own. I suspect that in most cases companies will see that as cheaper than having to pay an open source library developer, who is not an employee, to maintain an open source library that is not under the company's control. So if the open source developer isn't donating their work for free, the companies probably won't end up using it at all.