Indeed the situation is bad, nothing can be done. At the very least as long as they can make unintentional vulnerabilities, they are defenseless against intentional ones, and fixing only the former is already a very big deal.

> What would you like them to do instead or in addition to this?

Update the processes and tools to try and catch such malicious infiltrators. Lynching researchers isn't fixing the actual issue right now.

I saw at least one developer lamenting that they were going to potentially bring up mechanisms for having to treat every committer as malicious by default instead of not at the next kernel summit, so it's quite possible that's going to take place.

> lamenting that they were going to potentially bring up mechanisms for having to treat every committer as malicious by default

I think "lamenting" is very much the wrong attitude here. Given all the things that make use of Linux today that seems like the only sane approach to me.

If people insisted on a kernel like that, that's what they'd fund and use. But apparently that's not their priority.

> Update the processes and tools to try and catch such malicious infiltrators.

How?

That's what I'm saying kernel maintainers should figure out.

Step 1: When a malicious infiltrator is identified, mount their head on a spike as a warning to others.