Let’s step away from the extremist position and there’s an interesting problem underneath. If a company or government organization is hiring engineers who will

Let’s step away from the extremist position and there’s an interesting problem underneath. If a company or government organization is hiring engineers who will be responsible for critical code, they will undergo background checks at a minimum to ensure they are not an obvious threat to the organization. This isn’t about “country of origin”, but about the criminal history and ties of the individual regardless of origin. In a government setting, security clearances will be required on top of basic background checks. The FOSS community doesn’t have the tools to do this kind of screening, and arguably the openness of the community is what makes it successful. But the uncomfortable reality is that there are indeed malicious actors, and the community doesn’t currently have a mechanism to proactively identify them and instead relies on discovering the results of their malicious behavior. I don’t claim to know the solution, or if there even is one, but the existence of this comment thread is exhibit A for why we need to be thinking hard about how to proceed as a community. FOSS projects are in the big leagues now, and will continue to come under threat from increasingly sophisticated actors.