I'm interested in finding out to what degree you hold this viewpoint. How severe do the negative consequences of an action have to be where you would switch from saying "let them learn from their mistakes" to "we can't trust them again".
(I'm honestly interested in knowing, this isn't just a rhetorical statement.)
Regarding crime, there a lot of behaviors that aren't legally defined as crimes, but are still objectionable (sometimes very). As such, there is no court to prosecute them with the legal system's presumably objective processes, so it's up to the general public to make our own assessments.
Finally, I'm curious as to your level of tolerance to questionable, unexpected behavior by software developers. Maybe not this one, but I wouldn't be surprised if there were certain actions by software developers where you wouldn't tolerate even a single offense. In any case, our differences regarding tolerance to questionable behavior is why we're all discussing this incident anyway.
Like, I dunno, but if someone decides to feed my dog a KitKat, I probably wouldn't trust them around my dog anymore, you know? Yeah, they've learned their lesson about dogs and chocolate, but what other stuff don't they realize?
If you feel like that is appropriate, you could do that. I'm just glad the author removed the malware, and hope he's able to find a way to make money that doesn't involve a commercial botnet.
I disagree. Let people learn from their mistakes.
> ... to contribute to software that isn't subject to someone else's review.
That's hard to do when it is the author's own software. This "someone else must be lord and master" solution often doesn't apply to reality. Also, I've seen entire companies full of bosses managing people who "are not to be trusted" to do the right thing eventually end up doing the worst possible evil. Let the author learn, and move on.
> He knowingly merged _malware_ into his software and then did the minimum amount of plausible deniability
Or he asked his most active users, and they said it was fine as long as I can turn it off. Who knows... To assign any intent other than to make some money would be assuming a lot of facts that are not in evidence. The good guys won on this. Let's move on to actual problems instead of punishing someone for learning.