Because it can be fixed trivially, eliminating the threat? Literally, it already happened here: https://github.com/seletskiy/godiff/commit/865648740d705a24a9cf

Because it can be fixed trivially, eliminating the threat? Literally, it already happened here: https://github.com/seletskiy/godiff/commit/865648740d705a24a9cf927dfa73f458322141d9 https://github.com/seletskiy/godiff/commit/865648740d705a24a... Just as described, the problem was raised and then fixed. Now let's assume someone like Oracle goes and acquires 1000 unlicensed tiny open source projects, just to be a dick, and closes their source and begins copyright trolling. Here's what happens: people switch off of those projects. I'm not trying to diminish the usefulness of godiff; it is useful! But it's not literally irreplaceable; there may even already be other options in the ecosystem, and if there's not, it's not something that can't be removed temporarily, and replaced long-term. This blog post is a little alarmist IMO, but people who do this kind of sleuthing are doing a service to the open source community, because yes, issues like this can just be mitigated.