Absolutely agree that xz is a paradigmatic model of how well things can go with free open source. However, that also led me and others to a lot of dark reflecti

Absolutely agree that xz is a paradigmatic model of how well things can go with free open source. However, that also led me and others to a lot of dark reflecting on how vulnerable and exposed open source devs and maintainers are [0] and about complex social engineering attacks on the supply chain. It also raises troubling questions about how proprietary vendors can take advantage of that and spin it to their own ends. [0] https://cybershow.uk/blog/posts/poison-code https://cybershow.uk/blog/posts/poison-code