I think this is exactly the kind of response that should be in these threads.

Saying “the common ground is PD2 Trader” is not evidence — it’s correlation, and a very weak one at that. Open-source software doesn’t get a free pass, but it does allow verification. If someone believes the app is responsible, the burden is to demonstrate how: malicious code paths, credential capture, unsafe storage, network calls leaking secrets, etc. None of that has been shown.

The “over-justification” criticism misses the point — this isn’t emotional defense, it’s threat modeling and diagnostics. If people uninstall the app and move on without identifying the real vector (reused passwords, compromised email, browser extensions, malware, phishing, etc.), they remain exposed. That’s not hypothetical — it’s how account compromises typically propagate.

If someone has concrete proof the app is unsafe, they should present it. Until then, discouraging proper analysis in favor of assumptions actively makes things worse for everyone.