They announced grassroots donations for 10% of the total. That’s good, but still short of where it should be for something so popular.

I think of it like crime or natural disaster: a PyPI compromise could easily cause economic damages on the order of a bad storm or small terrorist attack. Collectively we spend billions trying to mitigate those societally rather than telling each person to defend themselves, and this feels like the same idea adapted to a different context.

I think you’ve badly misread the numbers here: donors have only covered a small fraction of what this NSF grant would have covered.

(And of course, it should go without saying that relying on the public to react to the government’s capricious behavior does not make for a stable funding situation for a nonprofit.)

Externalizing responsibility while taking the value of things and calling that a net win until the consequences come up seems short sighted.

Hopefully nobody else funds this critical infrastructure piece of both the government and private sector software world. Especially someone of a country/color/gender you don't like.