I think the message would more likely be "don't use open source and pay for closed source" than "give money to open source and cross your fingers that it does something".

Either way, it gives more jobs and $$$ to software developers in general. I'm fine with both :)

Just imagine how many more jobs will be created if every large company decides to roll their own stuffs. A lot are actually doing this, but not enough.

That is a tremendous amount of duplicated effort and it would be nice to be able to go and do something else with our skills and lives.

That just sounds like the broken window fallacy then. "It's good we have broken windows so the window makers have jobs".

It absolutely is. But we're all window makers, so our perspective is slightly different from general econ. ;)

To be fair, you also need software engineers to break the windows. It is in our best interest to break the windows.

Since that already happened, let's drink from the half-full bottle.

You should have more discretion with those ideas or disclose irony clearly, which I hope is the case here.

If that is the takeaway the industry takes from this, it will be a huge mistake. We are talking about this at all precisely because it was open source. Commercial closed source software can simply be assumed to be compromised. We know of enough instances of it happening that if you still have a knee-jerk "oh that sounds like a conspiracy theory" reaction to that claim, you need to recalibrate your conspiracy theory meter, quickly.

I mean Okta has shown us that paying for closed source does not imply higher quality or more secure software.

Also F5 or Citrix: some of their core security products had 90s-style C exploits and other signs of development practices well behind the times - roughly at the level of going to surgery and seeing your surgeon not washing their hands in the bathroom.

https://www.cisa.gov/guidance-addressing-citrix-netscaler-ad...

https://www.mandiant.com/resources/blog/session-hijacking-ci...

https://www.fortinet.com/blog/threat-research/defending-agai...

https://www.cisa.gov/news-events/cybersecurity-advisories/aa...

Yeah I'm not implying that's the way to go, but thinking since something open source was compromised that it will encourage businesses to donate is wishful thinking.

It might be riskier (because you'd have to identify yourself with government documents) to plant a backdoor in a similar way at a large, proprietary software vendor like Microsoft. But I don't know that it would be harder. And in the case of proprietary software there would not be nearly as much public scrutiny, and the scrutinizing public would have fewer resources for inspecting it.

Like Ivanti's Pulse VPN? Who hid a CentOS 6 in an appliance, unpatched, way past EoL?

You mean going for safe companies, like Microsoft? That were infiltrated for ages with solarwind, "without any changes to their source code"?

Yes, good example, a company they are likely already doing business with.

How would it have changed anything in this specific case?

This might solve the original author's issues, AND might also attract other people to do the job. The more people, the more eyes. It's definitely not a silver bullet, but I would be surprised that OSS maintainers are fine with the current financial arrangement, or lack of it.

Money itself doesn't necessarily cure mental health issues. I'm mean it usually doesn't hurt, but it's not like you can blend cash up into a smoothy and cure depression. (Yes, that's a South Park reference.)

Lack of money on the other hand can both cause mental issues and make dealing with them harder if not impossible.

The original xz maintainer stated that he delegated maintenance due to (then) current mental illness issues he was facing, not because of finances.

He mentioned mental illness and other issues. Those other issues could very well be financial. Financial issues also affect mental health.