The value of open source is that the code is there for anybody that wants to contribute, or fork in case people find its maintenance unsuitable. And even if the project dies, the code remains there for anybody to pick it up later, in case it has value. It has happened before, it can happen again. On the other hand most open source volunteers are unpaid and have no contractual obligation.
So tell me who is the criminal?
The Apache Foundation? But that's silly, since this project might have been simply dumped on GitHub. The few volunteers that tried pushing some fixes since last year? Oracle for donating the project? Speak for yourself in this case, because I'd rather have companies release their stuff, instead of locking it away.
This is an upsetting entitlement complex show here. If you want to contribute, then do so, otherwise GTFO.
It's not legal for me to set up a shop selling known faulty electronics, or even give them away for free unless I make clear I know they are faulty. I wonder if this should be extended to tech.
I'm not saying they have to take the code down entirely, but they could pop a big warning on the download page at least. They are knowingly having thousands of downloads a day of software they have known is dangerously broken for over a year.
All non-trivial software has security bugs. To reiterate, every program you've ever heard of has had and will have serious security bugs. If no bugs have been published, then either nobody is looking or someone is keeping them secret.
I agree that Apache has behaved irresponsibly.
However contributors _and Apache Board Members_ chimed in to announce that Apache OpenOffice was healthy and would continue. They managed, weeks laters, to spit out a release containing almost literally just one bug fix and then nothing since. So long as Board Members pretend everything is fine the Apache process won't trigger. This has become about the ego of Board Members versus the interests of the wider community.
Warranties are not the same as being misleading.