5 ms·
I would rather see it as if contributors gain _trust_ based on their contributions, which is not necessarily the same as authority.
by sorisos 8y ago
I would rather see it as if contributors gain _trust_ based on their contributions, which is not necessarily the same as authority.
- always_good 8y agoIf a contributor's end goal is to publish a backdoor, then making them wait 0 or 100 commits to the project before trusting them doesn't change the end result. In fact, if you had the energy to do the attack at all here (which took some work), having to fake trustworthiness doesn't require much more effort. Just look like a super enthusiastic contributor, put work into the readme, bike-shed over some issues every month, and bam.