Joe Conway <mail@joeconway.com> writes: > It may be impractical, but given cases like the XZ Utils backdoor > situation (i.e where a malicious person showed up offering to "help" > maintain an open source project where the original maintainer was > stepping away), it seems like any transfer process needs a vetting step.
Yeah, if the replacement maintainer is malicious or even merely incompetent, things could be worse than leaving the extension alone. But that wasn't on David's list of worries, so I imagine he thinks that's a soluble problem.
