3 ms·

Didn’t xz get backdoored through extreme cunning and an exhausted solo maintainer?

• __MatrixMan__ 2y ago
  Yes but the exhaustion was not 100% organic. There was a bit of social engineering towards wearing the maintainer down even further. I'm just pointing it out because I think it's going to be a tricky balance to strike. How can we, as a community of people who care about free and/or open source software tell the difference between: - a good faith effort to inform the wider community of a maintainer who is behaving badly - a bad-faith contributor pressuring an overworked maintainer to include a malicious commit I think you're the former, but I'm rather worried about the latter. And I'm interested in strategies for telling the two apart.
  • ironmagma 2y ago
    I’m actually neither. I’m a big fan of forks. If something isn’t working out well, it should be very easy to create a fork and switch to the fork (i.e. forks should be lightweight just like branches). We can’t rely on everyone to follow our schedules, so if there’s a desire we should take the lead on getting it done instead of dragging each other down. As such, I didn’t post this to shame anyone, mostly to provide an onus for switching to a fork. (Or I should say, another onus, since there are already a few reasons to not contribute to Gitea, mostly coming down to size of the project and inertia preventing refactors or redesigns.)
    • __MatrixMan__ 2y ago
      That's a very reasonable position to have, sorry for jumping to conclusions :)