I guess the takeaway from the xz backdoor situation is:
If you’re an open-source project maintainer, and somebody starts getting on your case for not doing enough free work for them, you reply “big Jia Tan energy there” and then block them forever.
I guess the takeaway from the xz backdoor situation is:
If you’re an open-source project maintainer, and somebody starts getting on your case for not doing enough free work for them, you reply “big Jia Tan energy there” and then block them forever.
Thing is, it's a good rule to have even if there is no malicious intent.
As a volunteer maintainer, it is wise to always put your sanity and mental well being above the project. If you think you have the energy to deal with rude folks, by all means proceed, but do ensure you *can* handle them.
Personally, I've found the "returns" for dealing with them to be in the net negative. So I ignore/block them. I owe them nothing, even if they spent 10 days writing a beautiful patch.
On my publicly facing projects, I add an explicit disclaimer stating they can submit bug reports/patches, but I don't commit to looking at any. They have to decide if it's worth engaging with me.
What kills me is that I shouldn't *have* to put any such disclaimer. Rather, maintainers who want to be very active should be the ones explicitly stating their commitments.
Looking at the bulk of Github projects, my stance is the majority one. Thus I shouldn't need a disclaimer!
Yesterday I read Just Say No, a post by Jeff Geerling who maintains a bunch of popular devops project on GitHub. His position, which I am totally sympathetic to, is that maintaining a project is a …
I'm conflicted. I applaud your effort and your intention, and yet I see it as a symptom of the main problem: That many perceive the unspoken "default" is that project maintainers should engage actively with random people (with or without a PR).
My argument is that when a project doesn't make an explicit statement like the one you advocate, there should be no expectation of a response. If a maintainer *wants* contributions and PRs, let them state it explicitly.
@beetle_b @zarfeblong "I see it as a symptom of the main problem: That many perceive the unspoken "default" is that project maintainers should engage actively with random people."
I would say, rather, that the problem is there IS no default. We may wish there was, but there isn't. (And different people might well have different ideas about what the default ought to be if there way one.)
So I think it's best to be explicit.
Agreed: It's always best to be explicit.