[kragen]

i don't think debian developers are actually prohibited from becoming employees of the vendor, but i think that if they get caught pushing malware, their dd status is likely to be revoked, and the process that allowed them to become dds is likely to be reviewed. any dd can generally push a change to any debian package to the archive; it's a major level of trust. that's why it's generally not realistic to try to get one of your employees to become a dd

[chungy]

There's a large segment of Debian Developers that are also the upstream maintainers/owners of various projects. I can't think of any paid examples, but volunteer ones are plentiful.

Perhaps the Debian project would force a .NET package to come with telemetry disabled by default, but for as long as said employee can abide by the rules of Debian, I don't really see any reason it can't be done.