Well that basic ethical no-no is going to make it impractical for anyone to do open source supply chain integrity evaluation at scale because getting permission

Well that basic ethical no-no is going to make it impractical for anyone to do open source supply chain integrity evaluation at scale because getting permission from thousands of people to do sweeping tests is impractical and warns everyone for a short period making it an inauthentic scenario. It will make it hard for things to improve, so millions will continue to get hacked due to supply chain attacks that almost no one is doing anything about. At what point does the ethical fault of negligence become so great that intervening to stop said negligence without consent becomes justified? We don't have much in the way of well defined law in this area yet, and it may take a long time to catch up. I suggest the lesser evil in the short term is to allow maintainers to suffer occasional mild embarrassment from time to time because they merged bad code. They get a valuable lesson out of the deal with no one getting hurt, no privacy violated, etc. If a maintainers don't want to review code with the understanding it could be malicious, then they have the right to never review or merge anything. All code contributions should be considered potentially malicious. Now, we also don't want to see repos bombarded with bad commits either if we can help it. Maybe a middle ground could exist where open source authors can signal a willingness to be tested once a year, and can signal if a test for this year has happened already. I think most projects would not do this, but it might be a step towards wide consent long term if someone cares to build such a system. In the decades before that though, there are not really any good options. If someones house is on fire and it has the potential to burn the neighborhood down, I don't imagine you should be faulted for doing what is required to put it out. Emergencies sometimes warrant dispensing with niceties. I think the supply chain attack risk is approaching emergency levels at this point. Negligence is the norm.