> Or do you really think that if someone has such concerns, their only recourse is to start contributing to the project?
Yes, I think one way to not come off as entitled when being critical to volunteers is to also offer volunteer work yourself.
And it's most helpful to provide feedback directly to the developers through their preferred means of communication.
> Or do you think they're not valid concerns?
Irrelevant what I think here, that's kind of the point. That's just my opinion.
> That project of course being one of the most security-sensitive projects one could imagine.
Agreed that the project is important. However, this is irrelevant, too, unless you're bolstering your "valid concerns" argument.
So what level of contribution is the bar here? I mean, what's the commit count? Do I have to be developing core features for years? Does writing docs count? Do I have to volunteer for a particular project before I can in any way criticize it, or is just any open source work okay?
> And it's most helpful to provide feedback directly to the developers through their preferred means of communication.
This is not feedback meant directly for the developer - it's valid questions that were meant to spark a discussion here on HN. Of course, with users like you around, that's difficult.
> However, this is irrelevant, too, unless you're bolstering your "valid concerns" argument.
It is relevant, because it's absurd to think that just any developer can just go and contribute to such a project.
All I offered was a way to not sound entitled. Personally, I certainly hold the opinions of someone that's helping me much higher than the opinion of someone that isn't.
Another approach to avoid sounding entitled could be to post a more thoughtful and comprehensive analysis on HN or a blog, rather than nitpicking a commit and posting broad questions like "what could have prevented this?" and insinuating that the volunteers need to do better.
Finally, if it's true that not "just any developer" can contribute to OpenSSH... well it's open-source. Fork it. Or build your own.
