4

In many ways I agree with all of the words, the good-will, the assessment and the positive intentions. There is just one problem, and it's a serious one.

The NSA (and similar organizations in other countries) know about these processes, and they have vital interests to undermine every widely used piece of software, not only do they get paid for it, not only do they command vast resources, and are they widely (sometimes more, sometimes less) by their government or foreign governments. They are not just hacking, pay hackers, and help each other. They do know that it is vital to work on every front. This includes writing (or contributing to) the rules of important internet standards, go to conferences and lobby for this change or against that change, provide commonly used libraries (including open source), have contacts in every circle. But worse of all this is that they - for the better of mankind - do everything to make sure that such practices will not end.

Now back to the long list of security researchers - the efforts of each one of them being very much appreciated ... in general. How many of them have a known and verified C.V. and history, how many of them might have more than just one single goal. How many of them, without any ill intentions may be gettin' paid by some project in return for some .... and how many along their lifes did nothing wrong so when bribe doesn't work, extortion may do the job.

Don't get me wrong. I am not accusing any single one of them. But even a person who intentionally contributed to the closure of three minor vulnerabilities, while being misguided in many ways, could easily contribute to keeping one other, serious vulnerability wide open.

This does not mean that you should stop doing what you do, or change what you're doing. But it means that the worldwide management of cyber in-security will not stop at the gates of github or Joplin. It is much more reasonable to believe that both of them are high on the list of targets.