John here - thanks for the kind words on my piece. You can also find it here (without the substack subscription stuff): https://johncodes.com/posts/there-is-no-secure-software-supp...
There was some good discussion on the /r/programming subreddit: https://www.reddit.com/r/programming/comments/zyf9rb/there_i...
I would love to continue the conversation: I think it's a really important topic in the world of increasingly deep dependencies. I too hadn't heard of the Gorilla maintainers reaching out for new contributors or sun-setting the project until after the fact.
https://onengineering.substack.com/p/there-is-no-secure-soft...
Looks like that's been submitted to HN, but never got traction.
It has the somewhat misleading title "There is no secure software supply-chain," which probably didn't help it's HN votes on previous submissions. It's really about the maintainers deciding to sunset Gorilla, in the context of that being a good idea to prevent it from becoming an insecure untrustworthy dependency, but more than that too. I found it a very thought-provoking read, and would love to hear others responses to it, including folks from Go community but also on the general issues.