Replying to @hughsie@mastodon.social
@hughsie @drwhax I think a lot of projects aren't clear where they stand between professional and hobby development and how much responsibility they should be taking on. Just because you donated some work to the world as FOSS and a company picked it up and distributes it as part of a product, doesn't make you responsible for the "supply chain" your hobby project finds itself in. IMHO any company which ships FOSS (which is _all_ of them) needs to vendor their dependencies, or have a contractual agreement for maintenance, and not just rely on the goodwill of the original author or volunteers for things like security, QA / CI testing, etc. I feel like a number of devs have gotten suckered into a culture of emulating commercial professional development (using an issue tracker, reviewing merge/pull requests, having numbered version releases, using CI and test suites, etc.) for things which are fundamentally non-commercial hobby projects and end up deeply unhappy burning their nights and weekends doing software maintenance because "people depend on them", like a martyr, and it feels rude to tell those people to get stuffed.
I think a fundamental way we should structure human systems is to limit the responsibility (and correlated damage) any one person can have on their own because our poor little meat-brains aren't really built for it.