The Xz backdoor and a near miss on the F-Droid app store show how the entitled attitude of some people in the open source community can be used to push malicious or insecure code.
The insinuation of "merge now otherwise you are letting your users down" in the F-Droid PR is so sickening. I can't imagine talking like that to people who voluntarily put their time and effort into a FOSS project.
I think one of the worst things that happened to internet culture was when "I'm a fellow nerd and I am happy if you made me some free nerd stuff, thank you" got replaced with "I'm a customer and you are making a product for me" mentality. It's like someone is doing you a favor by joining your Lemmy instance, or running your free software, and it gives you the right to complain to them and demand features or things you want, and you'll threaten to leave and not bless them with your presence anymore if you don't.
I see this all the time with Lemmy: People pressuring the devs to do some thing in some particular manner, and them constantly explaining "hey, our time's not unlimited and we have a large number of priorities, we'll get to it when we get to it, if you feel strongly about it please do it yourself or hire someone" which is 100% reasonable, and then for some reason that's a problem.
For far too long, there's been this idea in tech spaces that a person, regardless of how shitty they are, is automatically deserving of adulation because they're some "10x" developer. That soft skills, and wider understanding of the landscape, are completely unnecessary. They think it's "meritocracy" where all that matters is the code you deliver, and you can be the shittiest person on the planet otherwise. It's created so much toxicity, so much hostility, and driven so many people away. And it's so much more apparent in OSS spaces where pull requests seem to be the only currency people have to wield.
Those kinds of attitudes completely pushed me away from participating is nearly all Linux/OSS communities. I used to be really active on a number of forums and in irc. But that kind of shit became so overbearing it just wasn't worth it anymore. Not to mention the fact that it felt like 75% of the people there were also 4channers and well on their way down the alt-right rabbit hole.
Hopefully this xz scandal will give the kind of big corps which already pay OSS maintainers the kick up the arse required to treat their entire supply chain as a potential attack vector that should be audited and supported. Or maybe I've just asked the monkey's paw for increased corpo control over OSS projects...
That used to be the dream: corps hired you to work on the thing they needed that you were good at. Now, though, they just want everything for free and just acquihire to reassign you to whatever makes more money.
I think the real old big dogs like Microsoft, Google, and IBM still have a lot of dedicated developers for big projects like the Linux kernel. I doubt they bother that much with smaller projects though.