But you don't hold a door: you are dropping a package on the street and letting people pick it up. Anyone can reuse the cardboard, paint it red, stack it up with other packages, or hang it on their livingroom walls... but there is no guarantee that the package won't contain a bomb, that the cardboard was made by eco-friendly methods, or that it will last one second after getting dropped on the streets.

That's the bare minimum of what you can do, which really just constitutes dumping your code on GitHub, slapping an unmaintained label in the readme, and calling it a day

But we can go beyond that, and start to do more work, and make grander social promises. Calls for a "community" come with the implicit agreement that this codebase now exists for more than just the one person who initialized it. And that you've pushed it into the public, and requested people to treat your repo as the repo, you've taken on certain responsibilities, and made some implicit, or explicit, promises.

Sometimes the job is thrust upon the maintainer accidentally (eg Linus), and sometimes it is requested (apparently in this case?)

But nonetheless it's a natural function of the OSS community, and there are ways to deny the responsibility appropriately, and inappropriately.

But it's there is much more nuance to this than dumping a box, or reading a legal contract (which is never representative of social contracts; it's just the bare minimum to avoid responsibility in the eyes of a lawsuit.)

Lawsuits is how society distinguishes the actual social contract from wishful thinking. You are free to establish your own imaginary community based on imaginary rules of etiquette, but everyone else is free to ignore such "rules".

Sure, but people whose behavior is only constrained by law rather than the general expectations of good taste in their community are generally referred to as assholes or with some similar term to indicate that their behavior is disapproved of but not to the extent that it would make sense to prohibit.

Yes and pushing the archive button is saying "I won't produce any more packages sorry."

What they did was climb through everyones window to get the cardboard box back, just as with the npm leftpad incident.

Stop painting the narative like people demand some volunteer to do more free work, when all they do is ask to not be actively sabotaged.

No, he didn't break into people's house, started their computers and started deleting stuff. It's all the same as the day before yesterday.

Except for they didn't simply push a commit which replaces the code with a readme that tells people to go maintain it themselves or fuck off, they emptied it, rewrote their history and did a git push --force.

And frankly I don't buy the story that they wanted to put the code on their own repository anyways, seems more like a concession because the other contributors also hold some copyright.

No, he just stopped dropping the package on the street every Monday at 7am. Whoever picked up the package in the past, still has it - or had the option to preserve it.

If your workflow relied on a package being delivered every morning, even unchanged, it's your own fault. He never made that guarantee.

Stop painting the narrative like people owe you anything, when you're just failing to correctly evaluate the actual resiliency (non-)guarantees of production pipelines based on random github repositories.

Yeah there's this common concept in society called trust, aka a social contract, that people don't advertise their stuff first only to deliberately screw you over.

And yes shockingly people are entitled to be treated fairly and not to be sabotaged. And no, providing them with a library for a limited period of time and then being fed up with it's maintenance doesn't somehow earn you that right. It gives you the right to walk away, but clearly thats wasn't enough for the author.

But hey if you want that to live and bathe in that kind of toxicity, enjoy!

Caveat Emptor.