Please also note that the new EU Product Liability Directive is coming into force step by step and also covers software liability.
FOSS projects who just publish code are broadly exempt, but including sub-standard software into Debian could make it really hard and risky for commercial vendors (e.g. laptop OEMs) to ship their products with Debian. This project is far from the question who is making security fixes when no one has even read the code in the first place. Is there even a promise in good faith to invest appropriate effort to make the product secure? Regards
