Given this disaster, one or other "foundation" will now embrace the `xz` project, start paying a maintainer or two so that they don't accidentally end up dying

Given this disaster, one or other "foundation" will now embrace the `xz` project, start paying a maintainer or two so that they don't accidentally end up dying from burnout. Rinse, repeat for all critical-path open source software. A bit like the OpenSSL "Heartbleed" disaster[1]. OpenSSL is now part of Linux Foundation's (they do a lot of great work) "Core Infrastructure Initiative". Many fat companies build their applications on these crucial low-level libraries, and leave the drudgery to a lone maintainer in Nebraska, chugging away in his basement[2]. [1] https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed [2] https://xkcd.com/2347/ https://xkcd.com/2347/