What can be done to protect open source devs from next xz backdoor drama?