I guess the takeaway from the xz backdoor situation is:

If you’re an open-source project maintainer, and somebody starts getting on your case for not doing enough free work for them, you reply “big Jia Tan energy there” and then block them forever.

@zarfeblong Hard cases make bad law. I'd want to be careful about adopting such a rule.

@mike @zarfeblong

Thing is, it's a good rule to have even if there is no malicious intent.

As a volunteer maintainer, it is wise to always put your sanity and mental well being above the project. If you think you have the energy to deal with rude folks, by all means proceed, but do ensure you *can* handle them.

Personally, I've found the "returns" for dealing with them to be in the net negative. So I ignore/block them. I owe them nothing, even if they spent 10 days writing a beautiful patch.

@mike @zarfeblong

On my publicly facing projects, I add an explicit disclaimer stating they can submit bug reports/patches, but I don't commit to looking at any. They have to decide if it's worth engaging with me.

What kills me is that I shouldn't *have* to put any such disclaimer. Rather, maintainers who want to be very active should be the ones explicitly stating their commitments.

Looking at the bulk of Github projects, my stance is the majority one. Thus I shouldn't need a disclaimer!

@beetle_b @zarfeblong Yes. A couple of years ago, I started sketching out a proposal for project maintainers to formally and efficiently state their attitude to different kinds of contributions — https://reprog.wordpress.com/2022/12/02/proposal-a-controlled-vocabulary-for-attitudes-towards-pull-requests-forks-and-bug-reports/ — but it didn't really go anywhere.
Proposal: a controlled vocabulary for attitudes towards pull-requests, forks and bug-reports

Yesterday I read Just Say No, a post by Jeff Geerling who maintains a bunch of popular devops project on GitHub. His position, which I am totally sympathetic to, is that maintaining a project is a …

The Reinvigorated Programmer

@mike @zarfeblong

I'm conflicted. I applaud your effort and your intention, and yet I see it as a symptom of the main problem: That many perceive the unspoken "default" is that project maintainers should engage actively with random people (with or without a PR).

My argument is that when a project doesn't make an explicit statement like the one you advocate, there should be no expectation of a response. If a maintainer *wants* contributions and PRs, let them state it explicitly.

@beetle_b @zarfeblong "I see it as a symptom of the main problem: That many perceive the unspoken "default" is that project maintainers should engage actively with random people."

I would say, rather, that the problem is there IS no default. We may wish there was, but there isn't. (And different people might well have different ideas about what the default ought to be if there way one.)

So I think it's best to be explicit.

@mike @zarfeblong

Agreed: It's always best to be explicit.