To be honest when an attack like this happens at big companies, our expectations to mitigate the attack are much higher than if it's a project maintained by a s

To be honest when an attack like this happens at big companies, our expectations to mitigate the attack are much higher than if it's a project maintained by a small group of people. For example, Microsoft recently "lost" (they didn't disclose what happened) some sort of authentication key that allowed Chinese hackers to break into their network: https://techcrunch.com/2023/07/17/microsoft-lost-keys-government-hacked/ https://techcrunch.com/2023/07/17/microsoft-lost-keys-govern... How does this even happen at a big company like Microsoft? Then you take a look at small, <100 people company, their security policies are much more strict than Microsoft's. And even if it happened the same way, we wouldn't have such high expectations because they have a small team. Honestly, I prefer trusting a small project than a big company project. Take a look at Terraform now, HashiCorp pulled the plug and made it a proprietary app with source available requiring you to sign a CLA to prevent them from being sued later on. Red Hat is manipulating the GPL2 to force people to buy their subscriptions. EDIT: how can we forget how GitHub was before Microsoft bought it in 2016? GitHub was much more friendly to open source and nowadays they just use any open source code available on their service to train their Copilot AI without respecting the terms of the licenses of the millions of projects hosted there. They killed Atom. They scan your private and public repos for "vulnerabilities". They literally read everything on your repo and feed it into Copilot. If GitHub wasn't sold, I'm pretty sure the situation would be different. Call me crazy or dumb but I strongly believe that the bigger a company is, the worse their policies are. They neglect security at the cost of higher profits (ahem, looking at Facebook for allowing people to mine their users' data via an exploit that was just fixed when they called out Facebook for selling users' data).