>Kinda feel bad for them here though because they did things initially pretty much exactly right: paid real money to a developer with reasonable credentials to

>Kinda feel bad for them here though because they did things initially pretty much exactly right: paid real money to a developer with reasonable credentials to work in upstream to develop this feature with apparently best of intentions. That is pretty much textbook example how corporations can participate in open source (without in-house developers). I mean, I see what you're saying, but I can't 100% agree with this. As a textbook example, I still remember way back when Apple was getting started with KHTML and what would eventually become WebCore and WebKit, and they got quite a lot of heat for a while early on for just doing big fat block code dumps without following project procedures and such. "Contributions welcome" is true for anyone, but there is an implicit (and often these days explicit for larger projects) "...as long as you follow our code standards, communicate, put in the basic effort to do a professional job, etc". Contributions don't have to be perfect but there needs to be some meat there or it's just a waste of everyone's time. Even for a big corp doing big work, just "throwing code over the fence" so to speak often is not appreciated. Netgate hired him, so they were ultimately responsible. They apparently did a very, very poor job of both checking on him and supporting him, which is on them. They didn't see about coordinating with the actual guy who created the entire thing. They didn't do a basic sanity check of what he'd finished before trying to have it pushed right to main, and they were aggressive about deploying a security product that was really really shoddy and in context quite dangerous right out to the general public. And then they were complete dicks about even relatively low-key efforts to try to fix it with as much face saved all around, too much even. I'm sorry, but that doesn't actually seem like a great example of how corps can participate productively. Nor do I honestly think it "highlights how difficult participating in open source can be". Can't just expect unlimited gratitude purely for volunteering something useless/dangerous.