I have to spend several hours each week dealing with security issues reported by third parties. Most of these issues aren't critical but it's still a lot of work. In the long term, this is unsustainable for an unpaid volunteer like me. I'm thinking about some changes that allow me to continue working on libxml2. The basic idea is to treat security issues like any other bug. They will be made public immediately and fixed whenever maintainers have the time. There will be no deadlines. This policy will probably make some downstream users nervous, but maybe it encourages them to contribute a little more.

The more I think about it, the more I realize that this is the only way forward. I've been doing this long enough to know that most of the secrecy around security issues is just theater. All the "best practices" like OpenSSF Scorecards are just an attempt by big tech companies to guilt trip OSS maintainers and make them work for free. My one-man company recently tried to become a OpenSSF member. You have to become a Linux Foundation member first which costs at least $10,000/year. These organizations are very exclusive clubs and anything but open. It's about time to call them and their backers out.

In the long run, putting such demands on OSS maintainers without compensating them is detrimental. I just stepped down as libxslt maintainer and it's unlikely that this project will ever be maintained again. It's even more unlikely with Google Project Zero, the best white-hat security researchers money can buy, breathing down the necks of volunteers.