3 ms·
When you sell your car there is generally a title transfer. A process which lets everyone know that the car is no longer yours. I think the largest gripe here
by devman0 8y ago
When you sell your car there is generally a title transfer. A process which lets everyone know that the car is no longer yours.
I think the largest gripe here is that the original maintainer let the new, unknown maintainer commit to his repo and publish under the already established package name instead of making him fork it and publish as a new package.
- altfredd 8y agoThere is nothing wrong with publishing rewritten package with same name under full supervision of original developer. Transferring control generally implies full trust, and Dominic haven't established any trust with new developer. He didn't even ask them for their real name!
- Ayesh 8y agoIf someone's determined, they can always create a legit looking GitHub account, submit a few PRs (they did, in this case), gain trust, and _then_ deliver the malicious code. It just takes time. But this trust part seems to work pretty well. You need to be trusted to be a Debian package manager, and I volunteer as a Drupal code review admin where we require all contributors to have a real name, and there is a back and forth discussion for a few days until we mark the user as vetted.