Security should be free (or rather, things should not be released if they aren’t reasonably secure) for a couple reasons. We’re all on the same internet, peopl

Security should be free (or rather, things should not be released if they aren’t reasonably secure) for a couple reasons. We’re all on the same internet, people getting taken over and used as ddos nodes, leveraged for further attacks, or leaking PII is a pain for everybody. Skimping on security is always easier, and security is hard to detect for the end user. We shouldn’t have a race to the bottom on this stuff. For volunteer projects, like a lot of open source, we can’t really make demands. But I think it is still unethical to release an open source project that invites itself to used in an insecure manner. It is like an “attractive nuisance” (typical example: In some jurisdictions, you might be responsible for an un-fenced pool on your property if a kid falls in it, even if getting to it required trespassing, because we don’t want a society where uninformed people die avoidably). Without a customer service relationship, open source developers don’t have an obligation to make something useful, but nobody should put harmful things out into the world.