4 ms·
Those "many eyes" are the reason this was caught at all. I could easily imagine situations where this backdoor would go unnoticed for months or years.
by wtracy 8y ago
Those "many eyes" are the reason this was caught at all. I could easily imagine situations where this backdoor would go unnoticed for months or years.
- notacoward 8y agoSome tiny subset of those many eyes might have found it, but by then its impact was far from shallow. In some open-source ecosystems (e.g. GNU or BSD) the ratio of useful eyeballs to vulnerable ones is much higher. It almost seems to be a goal of NPM to maximize the blast radius before a problem is noticed. That's not a healthy way to manage open-source projects.