[dessant]

Some of the largest projects on F-Droid are all funded either by having a paid version on Google Play, accepting donations, or a company funding their development by hiring the maintainers. Most of the software you can install from a distro repository are also developed in large part by people that are compensated in some form, if the project requires continued development.

Money always ends up in the equation when you have to invest years of your life maintaining and supporting a project. And that's perfectly fine and healthy, because it means you can find a path that does not result in either side being exploited.

As for your last point, I was not responding to developers selling out their users, which is unfortunate, but to the expectation to not have a premium/paid version of a software project distributed. I think the developer even shared the pro version for free on F-Droid (OsmAnd does the same), yet the existence of a paid version was regarded as something negative by the user above.

If you're uncomfortable with the taught of you or at least someone else funding the development of the software you use, you're only setting yourself up to be exploited.

[mcpackieh]

You're missing a big part of the equation: the leopard exists in places where developers can push updates directly to users with minimal if any oversight from commercially independent reviewers. Debian and F-Droid build packages from source given to them by the developers, they don't trust developer builds. Therefore even though these Simple apps have sold to a malware company, that company won't be able to push updates to users. On platforms where this leopard is common, there may be some lip service paid to review but it's almost always completely automated or performed by low-skill contract labor who have no personal commitment to the process.

Another aspect of leopard territory is API churn. On Android and to a lesser extent browser extensions, regular rebuilds are necessary to keep the application up to date. This sometimes necessitates reworking parts of the application, not just rebuilding it. This recurring chore places a constant burden on developers, they can't "finish" an application then forget about it and move on with their lives; doing so would see their work vanish. On the other hand, on GNU/Linux desktops it's perfectly feasible to "finish" an application and leave it unmaintained for 15 years, people will still be able to use it. And on Android with F-Droid, most of the burden of rebuilding applications to keep them running is taken on by F-Droid volunteers, reducing the burnout pressure on application developers.

The conclusion is simple: Strict separation of the developer and packager/distributor roles keeps the leopard away.

[whatevaa]

> On the other hand, on GNU/Linux desktops it's perfectly feasible to "finish" an application and leave it unmaintained for 15 years, people will still be able to use it.

Oh no, only if it buildable from source. Binary compitability in Desktop Linux is non-existant, even Linus Tovarldis has ranted about this in the past. Even source is not immune to rot, if no maintainer steps up, nobody will package it, and god forbid the application uses something like QT4, while the distro decides to drop QT4 altogether...