[masklinn]

You’re not making any sense, he “had bad judgement” in getting an other maintainer so he should hand out maintainership? Like… to who?

> I know a tonne of professions where you’d be out the door if you messed up on that scale.

Cool story bro, know what happens in “a tonne of professions”? You get paid for doing stuff, and you get colleagues, with an actual formal legal contract, who also get paid.

And yet there are still bad actors, flipping insiders or getting moles in is literally standard modus operandi in espionage.

[supposemaybe]

No, what doesn’t make sense is you.

The guy made it obvious he was struggling. He needed somebody to take it over and someone came to his ‘rescue’… and he trusted every single change they brought.

Why am I saying that you don’t make sense? …because you haven’t even suggested a single resolution. You attack me even though I’m saying it how it is.

Now how about making use of your reply and suggesting something more useful? Because the status quo is actually what led to this, people just ignoring the issue and leaving the guy to his devices when his heart clearly isn’t in it.

Can I remind everyone that the entire world was nearly hacked?

[ryanjshaw]

You're very confident that this could have been avoided so can you point out EXACTLY what he should have done differently?

As far as I can tell, the only way to detect the manipulated release would have been to compare the release tarballs with one built by independently to detect the extra build script that had been inserted that injected the backdoor.

Of course, anybody in the world could have done this, including you, and yet... Neither you, nor anybody else, did. The reality here is that the entire supply chain is at fault - source code should be built from the public repo, not from a tarball.

Many very experienced people, and public companies, allowed this to happen. It's not fair to pick on one person.