3 ms·
To be honest I wouldn't expect an abandoned project to be any different. I would expect it to have lost its maintainer, not switched from a trustworthy maintain
by mehrdadn 8y ago
To be honest I wouldn't expect an abandoned project to be any different. I would expect it to have lost its maintainer, not switched from a trustworthy maintainer to a malicious one.
Edit: Clarified second sentence.
- madrox 8y agoNo maintainer is malicious...until they are. Be honest with yourself: how many dependencies have you vetted the maintainer before including? If n > 0 then you're just as susceptible.
- mifreewil 8y agoI wouldn't just add some random maintainer with a new GitHub account to a project I controlled. If they had made some contributions via pull requests, I would consider it or if they were a maintainer of other projects with actual users. In this case, there was no vetting at all. A brand new GitHub account with a couple forks. I'm not placing all the blame on the original maintainer as I understand his philosophy of handing off the torch, but I think it's a naive thing to do, as this has shown. Ultimately, this has been a good demonstration of a weakness with the ecosystem and I think there are a lot of things that could be improved here to help mitigate this in the future.