Consent without choice When a website asks me to accept cookies, I usually click the button before I have finished reading it. I suspect most people do. When researchers asked participants to join a fictitious social network, most never opened the terms or the privacy policy, and those who did spent about a minute on a document that takes half an hour to read. This is strange, because the legal point of consent is to give us a genuine, informed choice. Instead the notice has trained us to continue without choosing.

Nixpkgs has a due-process problem. A project has a due-process problem when people have real power but the rules around it are vague. Nixpkgs committers can merge and close pull requests. Reviewers can block them. Teams can remove commit access and decide policy. Yet the project does not always say what standard applies, who decides, or how a mistake can be corrected. This is not an argument against strict review. Security, licensing, attribution, maintainer time, and contributor conduct all matter. The glibc work I recently submitted changes the dynamic loader and rebuilds the world. It should be reviewed unusually carefully. I have also made bad merges.