> Relying on people to remember rules or adhere to some informal policy isn’t scalable Is that the case here? She was asked twice to follow the formal procedu

> Relying on people to remember rules or adhere to some informal policy isn’t scalable Is that the case here? She was asked twice to follow the formal procedure. She basically replied "fuck off". > It takes no effort to enforce reviews for pull requests. So why not just do it? Fair enough. Devil's advocate here: If they had then they wouldn't have found out that they can't trust this person to act in the project's best interests. But yeah. Seems reasonable to me to just flip the bit, if indeed for them it's that simple. But there will NEVER be that easy a fix for all issues. Edit: It seems it may be more complicated than this. Other commenters have said that this project was moved into a Github enterprise account, which granted this person god-like powers. If so, then at the very least this means that she exploited a temporary security vulnerability, where she found herself with god like access she was not supposed to have according to the project maintainers and policy. It's also not scalable to "just never have a security gap", which is also one of the many many arguments against cryptocurrencies. "Prevent-only" just does not scale. > We are tech people, do things technically. Hmm... I'm trying to not say "I used to think that, but then I grew up", because I don't intend it as an insult. Running a project, and more true the larger it is, is not as much technical work. There will always exist the technical possibility to do the wrong thing (except in a supermax prison). And even when possible, most technical means are just not worth it. We can't all develop software like the space industry[1]. It's just not worth it. Especially when the problems are of the kind that can be undone, like this one was (rollback PR). [1] https://www.nap.edu/read/2222/chapter/5 https://www.nap.edu/read/2222/chapter/5