Libxml2's "no security embargoes" policy

Very sad read. Much of the multi-billion dollar project I work on is built on top of libxml2 and my company doesn't have a clue. Fuck, even most of my colleagues working with XML every day don't even know it because they only interface indirectly with it via lxml.

> Fuck, even most of my colleagues working with XML every day don't even know it because they only interface indirectly with it via lxml.

Relevant XKCD: https://xkcd.com/2347/

Well, they need to pony up around $150k or so to keep it alive rather than freeloading off the work of others.

It’s not freeloading to accept a gift given freely.

Yet in real life gifting, we expect reciprocity and have norms. (E.g., if little Johnny doesn't bring a present to Sally's birthday party, he never gets invited back.)

Asymmetrical gifting is only acceptable with a power imbalance; if the boss gives an employee a gift, it need not be reciprocated.

FOSS actually turns this on its head, since unpaid volunteers are giving billionaires like Bezos gifts. Worse, people argue in favor of it.

It is not freeloading, but correspondingly you cannot demand anything from a gifter. Not even "could you please look at it". They might. Or they may ignore you. Or they may delete their repo and go away to the wild. Up to them.

Companies should implement dependency audits that identify critical open source components and allocate appropriate support resources proportional to their business impact.

I've never once expected someone to repair a gift they gave me because I found a flaw in it. That's when it becomes freeloading.