ML moderation (was: security alerts in busybox)

>1) a collaborative community. (...)
>2) a safe place. (...)
>3) a professional place. (...)

  Agreed on all counts. Unfortunately, these three things do not come
naturally, and have to be enforced. That means, if people cannot
self-moderate, there needs to be a moderator, with actual power, who
ensures the three points are respected.

  The problem is we don't have anybody doing that for now. If Denys is
the ML's moderator as well as the code's maintainer, he needs to come
by more often to check that everything is running smoothly. If that is
impossible, then he needs to appoint extra moderators - with caution and
vetting, obviously - who can take care of issues.

  It does not help that there is currently no Web access to the main
git repository of busybox. This makes the code less visible and makes
it less obvious that this is the official repository of the project.

  Add to that the fact that Denys only pops by episodically to collect
the patches that have been sent to the ML and merge them. This creates
a situation where people are tempted to fork the main repository and
maintain their own version, until the main repository catches up. And
sometimes the fork has diverged too much and it feels like less effort
to maintain it than to keep in sync with the main repository.

  This is not a particularly healthy situation, and has not been for a
while. It was only a matter of time before some crank would pop up and
take advantage of it, using the established community as a way to
promote his own derived work, fill the airwaves with off-topic nonsense,
and spew toxicity at anyone objecting. We seem to have one big
problematic individual at the moment, but it's only a consequence of the
power void; if it wasn't him, it would be someone else, sooner or later.

  Until some moderation decisions are taken, I don't see things 
improving.
I've Cc'ed Denys directly, hoping to reach him.

--
  Laurent