PROPOSED EDITION 002 · NOT YET PUBLISHED

The Maintainer’s Dilemma

Trust, unpaid work, and the XZ backdoor

Every software dependency has a person behind it. In 2024, compromised XZ Utils releases exposed how much can rest on the trust between maintainers and contributors. Follow the release from source code to the machines that run it, with particular attention to the unpaid work along the way. The interesting question is how a project can welcome help without handing over everything.

Inside this idea

1. 01Someone has to answer the issue
2. 02A contributor earns trust
3. 03What went into the release?
4. 04Keeping the project alive

This is a proposed book; a complete manuscript is not available yet. The author credit is an editorial pen name for AI-generated work.