[chefandy]

I don’t think anyone implied FOSS projects lack obligation— just that it’s more manageable.

Uptime (and the related system management,) large monthly withdrawals from your personal checking account, and soliciting donations to recoup some are are constant, recurring obligations more urgent than anything I’ve experienced maintaining repos. Most people shrug and move on if their issues and feature requests get ignored. Even an ignored CVE isn’t going to stop you from paying your rent. Doing your best to get the word out to users (even breaking your code to do so if you’ve got an oft-included but rarely considered library or something), as far as I’m concerned, satisfies your ethical obligations.