> it’s called professional accountability

Professional does for money, by definition. That doesn’t apply for most open source. RedHat employee contributing to Linux kernel is an exception, not a rule.

That is not true. The majority of open source contributions to popular projects are people making commits while at their paid jobs.

> The majority of open source contributions are people making commits while at their paid jobs.

Do you have any evidence to back up this seemingly wildly speculative assertion?

And, even if it were true, "while at their paid jobs" doesn't mean at all they're getting paid as developers at all, let alone as developers on those projects that they are contributing to.

Here's one example:

> By studying the Linux Kernel, we document that commercial participation outweighs volunteer participation substantially

https://journals.aom.org/doi/abs/10.5465/AMPROC.2023.17240ab...

Also, empirically, many of the most popular open source projects are published by commercial companies, who hire developers to maintain them. If you review the commit history for these projects, you will see that many of them are, unsurprisingly, employees.

https://airtable.com/appiS6H4nkeXdyO89/shrATIy7RIOheo3gF/tbl...

There is inevitable overlap of commercial activity with popular open source software. Either it was a commercial piece of software to begin with, or because it is popular, it now has commercial value and garners commercial attention. Something like React falls into the former, and something like Linux falls into the latter.

There's a lot of community open source software too, but it trends towards smaller hobby projects with few users.

First, I like how you included “popular” adjective. That alone disqualifies 99% of projects. These are the projects “hacked” by non-paid devs.

Second, some proof would be nice. I live in .net/nugget ecosystem and other than libraries backed by MS, most popular projects are not (at least ones I know of).

The 'popular' qualifier is important, because these are the ones that important infrastructure are reliant on. These are the ones that should meet professional standards. And by most accounts, they are being developed by professionals who should be subject to such expectations.

I think it's okay if a hobby project is unsuitable or unreliable for important tasks. They should also not be used in critical infrastructure or commercial products.

Professional accountability would be saying that companies like Riot can't deploy root-level code with no oversight onto millions of machines "for competitive integrity", not taking down git repos because they don't meet some regulations around security.

No--see licensing terms. As well, the software used is chosen by the implementors.

Now, if folks want regulation, introduce the Certified Professional Software Engineer. (Pay commensurate with tort, of course.)

A 12 year old who read a book on coding is now a professional? Standards really have fallen.

If that 12-year-old's code ends up in infrastructure that government or business depends on, it should be subject to these regulations.

Should the 12 year old be liable because a billion dollar company uses his code?

> It's called professional accountability.

Programming is not my profession though, it's my hobby. I chose to pursue another profession specifically so I could keep programming as a hobby. By all means hold the corporations accountable but please leave people like me out of it.