so maintainers are starting to push back on these requests, and demands for free labor on a project that they give away for free, as if it were a commercial product.
in response, rather than the government scolding corporations for abusing the commons, these corporations have instead pushed for governments like the EU to adopt regulatory regimes such as the CRA which pressure maintainers to do even more free labor, in the name of security.
everyone likes security, right? as practitioners, we don't want to harm anyone's security posture. so there is pressure on maintainers to comply with these regulatory frameworks, in the name of security.