I noticed that - while not being able to apply 2023Q3 and -at least for a moment- get no security alerts.
It would be helpful if you had mentioned some of the rationale behind that upstream maintainer's decision (if known, anyway).
Let's do a very basic reality check:
I remember a time (last century) when FreeBSD committers were proud to mention they have their private backdoors in the OS code. Nobody bothered - at that time we all were indeed a community.
Only later on this big security paranoia did develop, and nowadays it seems nobody cares anymore about software malfunctions unless there is some security concerned. And only then did appear this idea that security issues should not be published, so that we are no longer a community, but divided in secrecies.
Lets try and understand how this came. There was also a time when people did not bother to lock their front doors, because the all were basically the same and nobody had much to steal from. Only later on people became so filthy rich they got paranoid and started to lock their doors.
Se we might conclude, the appearance of the big paranoia has nothing to do with the computers themselves, but rather with them being abused to make money. And therefore we should not talk about security, but about the money. Because the money is stolen.
Lets answer the question: why did these big internet corps ("faang") grow so incredibly big? Because, unlike other corps, they did not need to build up infrastructure (like factories, distribution paths, resellers, etc.), as it was already there. We had built it for them, back in the last century, when we still were a community. They only needed to use it and start making money from it. Stolen money.
A few people other than me seem to already have noticed that there is no systemic difference betwenn a government and organized crime. Their identical purpose is just to protect one group of thieves from another.
So then, lets finally answer the questions:
Given the number of applications depending on his library, has he just endangered the entire Internet infrastructure?
No, he has just given us an opportunity for a reality check of what the internet once was, and what has become of it.
If his action will enable malicious foreign governments and terrorists to attack states or other targets, how many countries' security laws is he likely to have violated?
This is irrelevant, because the implied differenciation between "malicious foreign governments" and "countries' security laws" is propaganda babble and warmongery. All governments the same are just doing their task of protecting their own thieves.
The old internet of the last century did not need governments for protection. In fact the governments had no idea about it. They still don't, they just do what the thieves tell them to do.
