Amélie Koran and Adam Baldwin discuss OSS sustainability, supply chain security,, governance, and outreach for popular applications - part2

<p>Adam Baldwin (@adam_baldwin)<br /> Amélie Koran (@webjedi)</p> <p> </p> <p><a href= "https://logging.apache.org/log4j/2.x/license.html">https://logging.apache.org/log4j/2.x/license.html</a></p> <p><br /> <a href= "https://www.theregister.com/2021/12/14/log4j_vulnerability_open_source_funding/"> https://www.theregister.com/2021/12/14/log4j_vulnerability_open_source_funding/</a></p> <p><br /> <a href= "https://www.zdnet.com/article/security-firm-blumira-discovers-major-new-log4j-attack-vector/"> https://www.zdnet.com/article/security-firm-blumira-discovers-major-new-log4j-attack-vector/</a></p> <p><br /> F/OSS developer deliberately bricks his software in retaliation for big companies not supporting OSS.<br /> <a href= "https://twitter.com/BleepinComputer/status/1480182019854327808">https://twitter.com/BleepinComputer/status/1480182019854327808</a></p> <p><a href= "https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/"> https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/</a></p> <p><br /> <a href= "https://developers.slashdot.org/story/22/01/09/2336239/open-source-developer-intentionally-corrupts-his-own-widely-used-libraries"> https://developers.slashdot.org/story/22/01/09/2336239/open-source-developer-intentionally-corrupts-his-own-widely-used-libraries</a></p> <p>Faker.js - <a href= "https://www.npmjs.com/package/faker">https://www.npmjs.com/package/faker</a>  Generate massive amounts of fake contextual data<br /> Colors.js - <a href= "https://www.npmjs.com/pafaker">https://www.npmjs.com/pafaker</a>  - npm package/colors get color and style in your node.js console</p> <p><a href= "https://abc7ny.com/suspicious-package-queens-astoria-fire/6425363/"> https://abc7ny.com/suspicious-package-queens-astoria-fire/6425363/</a></p> <p>Should OSS teams expect payment for giving their time/code away for free? What are their expectations</p> <p>Should open source projects be aware of how popular they a