Joe Conway <mail@joeconway.com> writes:
> It may be impractical, but given cases like the XZ Utils backdoor
> situation (i.e where a malicious person showed up offering to "help"
> maintain an open source project where the original maintainer was
> stepping away), it seems like any transfer process needs a vetting step.
Yeah, if the replacement maintainer is malicious or even merely
incompetent, things could be worse than leaving the extension alone.
But that wasn't on David's list of worries, so I imagine he thinks
that's a soluble problem.
regards, tom lane
