Projects with bigger problems

> What's needed is people to stop complaining when companies work in their internal forks first

Isn't this what MOST people do, including FLOSS devs, work on an internal fork first?

The minimum required (and also maximum necessary) aka "necessary and sufficient" for companies to be considered "good FLOSS citizens", should be that their production repository (or a copy thereof) is world-readable.

If they want to make the effort to upstream their fixes (they should, it's in their interest, but it's their decision), then that's down to them.

And if the FLOSS developer wants to plunder their repository for good ideas and/or code, that's down to them!

Once we get over the current "OMG AI is finding exploits" scare, I would hope that the EU CRA encourages this to become the norm. Much less effort than doing stuff in-house.

Cheers,
Wol