Linux

The whole point of open source was that you can see the code and the commits. We don’t need to trust anybody. I feel like banning contributors is just contradicting one of the key benefits of open source.

You are misunderstanding why the sanctions happened. It has nothing to do with whether or not the individuals working at those entities are trustworthy or not.

The Linux Foundation is an institute of the United States. The United States has demanded that entities within their jurisdiction, like the Linux Foundation, follow sanctions, and cut contact and interaction with sanctioned entities.

Because the Linux Foundation doesn't want to be punished or pay fines, they follow those sanctions. Nothing to do with trusting the individual contributors or corporations.

What would you do about people who… lie online about where they work?

This is probably what happened. The contributors went home, to their personal emails, and the world kept spinning and no one looked twice.

We don’t need to trust anybody.

Reviewing every change and discovering every issue is unfeasible on multiple levels. Even skipping that fundamental, base level requirement; you need to trust in trustworthiness from submitters and reviewers, and that people review. You need to trust those maintainers that can push and pull and merge. You need to trust the builders and publishers and distributors.

I doubt you're reviewing every code change and compiling or verifying reproducible builds on every software and patch version you run. You put trust in the chain. And the chain decided to cut at some point because of risk.

Besides, the idea that employed developers with a Russian day job are a risk… but one fails to consider these were the honest ones who declared their day job.

So you think people do only one job and have only one concern? Do you think people of sanctioned countries, contributing to an unjust war, more or less directly, are a bad place to start reducing risks?

I feel like properly vetting commits to the kernel that does not involve the core contributors and maintainers too much is the way to go.

I'm baffled you can make this point while at the same time not accepting their decision after review, assessment, and consequence. You're asking them to review while not accepting their decision. From the same people.