3 ms·

Responsibility is a hard problem. It's quite true that more than one person can be responsible for something, in part, but there's only so much responsibility

• marcus_holmes 8y ago
  Authority and Responsibility go hand-in-hand. If you have authority over something/someone, then you are responsible for it/them. You cannot be responsible for something you have no authority over, and you should not have authority for something you have no responsibility for. In this case, every developer has authority over their own code base. If I decide to include some random code from the internet in my project then I am responsible for that decision. If whoever has commit privileges on that random code decides to commit malicious code, then they have responsibility for that. However, that doesn't make them responsible for my project, because they have no authority over my project. Including a dependency in a project is a security vulnerability. It may be worth the risk, it may not, but it is definitely a risk. And responsibility for taking that risk is entirely on the person who took the decision to include that dependency.
• mehrdadn 8y ago
  > whatever damage irresponsibility causes, more than one person cannot be responsible for the full damage, if we're going to maintain any consistency. This may be a moot point if you consider that "full damage" can be more than what one person can be expected to take responsibility for and handle.