<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>SoftTalker</author><text>Volunteers abandon projects when the dam breaks. They work, and adapt, and take on more and more, and then one day one small new thing (that an outsider would see as totally reasonable) breaks the dam, all their motivation is washed away, and they quit.&lt;p&gt;I&amp;#x27;ve seen this happen much more often than I&amp;#x27;ve seen volunteers gracefully leave a project with a smooth transition to a replacement person or persons.&lt;p&gt;If you are using volunteer-maintained software in a &amp;quot;critical&amp;quot; part of your business, you should be prepared for this.</text><parent_chain></parent_chain></comment><story><title>“Critical” projects and volunteer maintainers</title><url>https://lwn.net/SubscriberLink/900953/44823d451920e233/</url></story>
<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>ctur</author><text>It is interesting seeing the evolution of open source maintenance in the light of new (or increasing) supply chain attacks and acts of political protest.  There always has been a &amp;quot;what is your obligation to quickly respond to a security issue?&amp;quot; expectation around the code and now similar obligatory expectation questions arise on the maintenance process itself.&lt;p&gt;We also see what seems like rather balkanized approaches (npm, pypi, cargo, ...).  It would be great if broader consensus arose on what the ideal standard should be for package management and distribution that then those projects could adhere to.  Similar about commit access to repos and what the requirements there should be.&lt;p&gt;It&amp;#x27;s also peculiar how much stronger the guarantees you get from your operating system vendor are w.r.t. signatures on packages vs what the underlying projects themselves have.  OSs have had this pretty well handled for decades, but no common best practices like 2fa, signatures, etc seem to have emerged.</text><parent_chain></parent_chain></comment><story><title>“Critical” projects and volunteer maintainers</title><url>https://lwn.net/SubscriberLink/900953/44823d451920e233/</url></story>