You're addressing maintainers who somehow arrive at open source with expectations which set them up for failure and disappointment. I can agree with you there.

You're addressing maintainers who somehow arrive at open source with expectations which set them up for failure and disappointment. I can agree with you there. In the past, I've made comments that open source isn't a business model. It's a licensing model which governs intellectual property. My comment, however, isn't addressing maintainers. It's addressing their audience and their behavior: anyone who uses and leverages open source code without consideration of the labor that goes into it, which is a big difference. ESR is absolutely right when he points out that anyone who shares creative work also shows themselves vulnerable when it comes to reputation, good name and public perception. Sure, you could use the argument that "open source doesn't make any promises regarding support". But that still doesn't excuse the entitlement and indifference. If you can happily ignore it, that's great for you. Calling it out for what it is, however, isn't any less valid a way of responding. Even when it's just a hobby project and you don't get paid. Every so often, there's a case where a small open source project with limited maintenance ends up being leveraged by entire industries with interests worth billions. When things fall apart, media outlets and pundits will report about the failings of that small project and how it affects big interests, but they won't point out the elephant in the room: how these projects are maintained by a skeleton crew working in their spare time. The Ars Technica article is an example of this: https://arstechnica.com/information-technology/2021/12/minecraft-and-other-apps-face-serious-threat-from-new-code-execution-bug/ https://arstechnica.com/information-technology/2021/12/minec... At most, the lack of due diligence of these big passive players gets called out, like in this Wired article: https://www.wired.com/story/log4j-flaw-hacking-internet/ https://www.wired.com/story/log4j-flaw-hacking-internet/ Sure, none of this is going to awaken people's minds to be more apprehensive or more empathic to the challenges of maintaining a popular OSS project. The value proposition of being able to leverage free labor is simply too attractive. Meanwhile though, the log4j maintainers are now stuck being perceived as not having done enough to avoid these kinds of bugs. Whether that's trough investing "enough" time, making the "right" calls (whatever those are) or finding "appropriate sources of funding" for themselves. Thousands of engineers are scrambling to roll out fixes upstream. And millions of end users merely learn how "a software bug almost breaks the Internet and Minecraft." Ultimately, nobody gains from these disasters as a result of a lack of assuming shared responsibility for a common good.