[Arnt]

Open source is a gift left by the wayside for people to pick up or not. It's not a customer-vendor relationship.

You're free to react as you want, but it's good to keep in mind that if you want the maintainers to care, you should be willing to enter into a customer-vendor relationship.

[worksonmine]

I would agree with you unless this was the official government app for interacting with the government. They have a bigger responsibility than a random library. It is nice that it's open source though so people can audit it.

[Arnt]

Audit, you say.

I once put an easter egg into some open source code used by many millions of people. Nobody found it until a colleague talked about it at a conference maybe a decade later.

People talk about audits, I at least don't think audits can be relied upon to find much. It's nice when audits happen, don't misunderstand, but I don't assume that opening the source of something means that any badness will be found. That assumption requires several leaps of faith.

[worksonmine]

I'm just giving them the benefit of the doubt, I don't assume anything.