> I think people are upset because there is a moral, ethical and social obligation expected from academia to not intentionally do shit like this. OSS security

> I think people are upset because there is a moral, ethical and social obligation expected from academia to not intentionally do shit like this. OSS security should not rely on ethics and trust. The default assumption should be that malicious actors are using every dirty tactic they can to get their changes accepted, and that someone@something.edu is no more trustworthy than internal.security.agency@china.gov.cn. Feels like the OSS community got caught with their pants down and is now overreacting.