The problem: Certain maintainer roles keep Drupal's lights on. Right now, there's a brownout.

Interim Drupal Association CEO Tiffany Farriss recently wrote about bringing to light "the work that just happens": the mostly invisible (but essential) services the Drupal Association provides to sustain the Drupal project and community. I love this description. If everything's going well, maybe you don't even know or notice. But on the other hand, maybe you should.

A long while back, security researcher Sam Mortenson reported a cross-site scripting vulnerability in Drupal core's Link module. Essentially, the options property on link fields was not being properly sanitized. This meant cross-site scripting was possible under some circumstances -- and, as always for cross-site scripting, we were concerned that the XSS could be combined with other attacks and escalated to more serious exploits.

Back in 2013, I led the core contribution mentoring day at DrupalCon Sydney. I'd already flown from the US to Europe three times at that point (first for Drupal Developer Days Barcelona, then for DrupalCon Munich and the Paris VDC sprint, and finally for a whirlwind 72 hours in London to sprint on VDC and CMI). None of that prior international travel prepared me in the slightest for the over 24 hours of nonstop air travel/physical torture that it takes to get from Wisconsin to Australia.