> It's a classic FLOSS problem but there was a succession plan and the previous maintainer retired and handed the reigns back to Tridgell.

This is the part where I think the most issues are, when big companies ship volunteer-created code (that they found on the Internet) for commercial purposes, then they need to be responsible for the long-term maintenance and security of that code, and can't just defer to the original volunteer maintainer as an accountability sink. "No warranty express or implied for any purpose" is not really ethical for widely-deployed software but no one person can/should be held accountable for all the ways something like rsync is being used, so you can't just forward all CVEs to Tridgell and say "job done", he _can't_ fundamentally accept that responsibility, its too much.

I think it'd be healthy for orgs which ship FOSS to others if they planned on forking and having some vendor consortium to handle maintenance, like Linux Foundation, that might hire the original maintainer, but can also develop a team capable of handling the responsibility incurred when shipping code in products to other people. The idea that major software projects should be organized around individual BDFLs seems crazy to me now that FOSS is such a part of modern infrastructure.

I think there might be some resistance from FOSS maintainers though, a lot of people are attached to the prestige that comes with creating a successful project (eg "my code is interplanetary because it's on the Mars Rover"), but we don't organize other human infrastructure projects around individual engineers, we don't design airplanes or bridges that way, and while small projects the equivalent of building your own garden shed don't require a lot of rules, because the potential harm is low, the more people affected the more responsibility for safety exists and the less its fair to have borne by individuals and should instead be borne by organizations, institutions, culture, etc.