I mean, the XZ backdoor happened because the main developer was overworked and burned out[0]. Stuff like this happens all over the OSS sphere, its just that its

I mean, the XZ backdoor happened because the main developer was overworked and burned out[0]. Stuff like this happens all over the OSS sphere, its just that its usually on less-critical projects. AFAIK, Heartbleed also sat unnoticed in OpenSSL for years because it was no one's full-time job to care. If you were paying someone to full-time maintain XZ or Heartbleed, or whatever, it would have their singular attention. [0]https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.h... > I haven't lost interest but my ability to care has been fairly limited mostly due to longterm mental health issues but also due to some other things. Recently I've worked off-list a bit with Jia Tan on XZ Utils and perhaps he will have a bigger role in the future, we'll see.