Distributors absorb reports

Do not accept undocumented code

Many bug-fixes address symptoms

Only releases get tested

Once merged, you own it

Given enough eyeballs, all bugs are shallow

Code quality