Making one a maintainer (with merge and possibly even direct commit/push permissions) is handing them a key to the kingdom. Recruiting a maintainer out of the blue without them being already contributor and long term participant in the project is questionable.

[–] steeznson@lemmy.world 1 points 7 months ago (1 children)

I believe that the bad actor was a contributor for several years before becoming a maintainer

[–] erAck@discuss.tchncs.de 2 points 7 months ago (1 children)

Apparently not, you can check commits in https://git.tukaani.org/?p=xz.git;a=summary the first authored commit was 2022-01-28, then long time nothing until 2022-06-10, the first merge as committer was 2022-12-16.

[–] steeznson@lemmy.world 1 points 7 months ago

Interesting! I'd not realised it was so recent