Upstream vendors can harm small projects: OpenBSD dev