I don't see what's wrong with Mongo cutting ties with Russia. There are practical problems receiving payment from Russian territories, and companies are allowed to choose which countries they do and don't do business with.

In a similar fashion, developers may choose who can and cannot use their code. In fact, depending on how your government's sanctions are structured, you may even be obligated to not license code to developers in some countries.

Using malware to overwrite random files against random Russian IPs is obviously stupid. I'm sure the dev will get to explain his case to a judge at some point. The Terraform thing, though, is different; it's not malicious, merely political.

However, I think the assertion that software "should not be political" is silly. All software is political. Open source licenses stem from American ideals of freedom, for example, and are designed to work in the American legal system above all else. Then there are the implied cultural contexts; the list of software that only works in left-to-right configuration or even fail to just accept standard unicode input is laughably huge. The amount of times I've had to adjust software to work with alternative decimal separators...

Independent developers can (and probably should) decide to mostly focus on the problem they themselves are trying to solve. If that doesn't work for someone else, they can either ask (and possibly be denied) alterations to extend the solution to their problem space, or suggest additions by extending the software themselves, but in essence, cultural and political assertions are everywhere throughout "open source".

Protestware has been around for quite a while, but I think this is one of the first times we're seeing high profile developers take a stance. Whatever risk this is exposing was always there; we can try to hide the risks of open source, but in the end, that's just covering them up.

I agree that protestware should not be considered open source, but any open source project can turn into protestware at any time, and it always could have. This is why groups like Debian and companies like Canonical are important: they use their organization to produce a unified view that you can rely on. Debian applies patches to align software with their views in several ways. The result is that software is often re-packaged and is deployed slower than upstream, but stuff like this doesn't get into your systems. The Python/Pip/Cargo/Go way of distributing dependencies directly, rather than using some kind of unified repository, exposes you to the risk of open source software becoming protestware, but it doesn't have to be that way.

Developers scrutinize Debian and Ubuntu for packaging old software, but you can safely develop against their dependencies. This is the open source that can be trusted, to a usual extent. In my opinion, the trust developers place in random usernames on NPM is misplaced, and the extensive dependency graphs modern frameworks require make that problem so much worse.

To those saying that it's bad that innocent Russians are getting hit by this: that's the point. It's also why sanctions are only applied in extreme circumstances. Foreigners can't tell other governments what to do, the best the rest of the world can do is hope or incentivize a country's citizens to make their government change their minds.