Post

the problem is not that it’s free software (free to fork, free to study, free to modify) run by a rag tag group of maintainers - the problem is it’s the literal backbone of all modern digital infrastructure and should be considered “too important to fail”. So yeah, when rsync vibes, it’s concerning.

The societal importance or number of users of an OSS project doesn't change maintainers' responsibilities. The responsibility lies, as it always has, with integrators. OSS is "free as in puppy," and when you take a dependency you take the implicit responsibility to maintain it yourself if needed.

At some point, an important open and free project stops being “just a project” and becomes a public good needing the same care and planning as other widely used/distributed utilities: we’ve yet to expand the open source model to encompass that.

Do not misunderstand me: maintainers and their projects owe no one anything - corporations that have consumed and consumed without giving back have created the tragedy, refuse to bolster engineering efforts, and need to make provide support

It sounds like we agree more than may be obvious. I'm glad when organizations decide to invest in open source, and I've written pretty extensively about the benefits and challenges of corporate engagement w/ OSS: