I see a lot of comments on whether this is motivated by geopolitics -- an attempt to deal a setback to China. I have no way of knowing whether this is the case

I see a lot of comments on whether this is motivated by geopolitics -- an attempt to deal a setback to China. I have no way of knowing whether this is the case, but in general, I would suggest that this is at least plausible, and, if I am right in this, we need to have an existential conversation about what happens to Open Source in a global warfare scenario. (cf https://www.noahpinion.blog/p/americans-are-still-not-worried-enough https://www.noahpinion.blog/p/americans-are-still-not-worrie...) High-risk-low-liklihood scenarios are a fact of life, and we get used to dismissing them as the cost of doing business. But when those same habitual reflexes get used to dismiss scenarios that are now of moderate liklihood, we collectively make mistakes that are hard to recover from. Such mistakes are especially likely when (a) contextualizing an additional piece of information, such as a seemingly-unrelated product cancelation, or (b) making plans for the future (either personally, or for a project, company, or industry.) It's time to at least _have a conversation_ about what open source looks like under present global conditions, and that conversation needs to foreground the _exceptionality_ of the past thirty years of relatively peaceful relations between great powers. Nobody wants to have this conversation, not because it's scary, but because of significant social pressure we all experience to discount the liklihood of unpleasant futures. But here we are. What does trust look like in Open Source in 2030? How should we model threats? How do we ensure that as many people as possible can contribute to projects, while at the same time minimizing the risk of another xz? A spookier question: _can_ we?