4 ms·

Dozens of emails / notifications, people pinging / bothering you on multiple platforms, multiple emails, etc. It's stupid to blindly trust someone's code, rega

Dozens of emails / notifications, people pinging / bothering you on multiple platforms, multiple emails, etc. It's stupid to blindly trust someone's code, regardless of who they are of if they are the current maintainer, that is not how you build secure software. If you want to start some organization which vets people for maintainers go for it, but don't expect maintainers to do it, I can guarantee you that thousands of maintainers do not. You're responsible for what ends up on your servers.

zeroname 8y ago
> Dozens of emails / notifications, people pinging / bothering you on multiple platforms, multiple emails, etc. Two options: 1. Stop supporting the package, mark it as deprecated, ignore/delete the spam 2. Hand over project to a stranger, endangering all of your users One of these options is irresponsible, the other one isn't. I'm not asking anyone to do something for me, I'm asking them to not do something for the sake of sanity. > It's stupid to blindly trust someone's code, regardless of who they are of if they are the current maintainer, that is not how you build secure software. I agree, but both of us know that pretty much the entire Javascript ecosystem is exactly that stupid. Let me ask you: What have you personally done to vet your dependencies? Have you used Babel or any of the other popular Javascript packages that have a huge dependency tree? If you have, chances are you are effectively blindly trusting all the developers in that tree. You're not checking every single commit that goes into it. > If you want to start some organization which vets people for maintainers go for it, but don't expect maintainers to do it, I can guarantee you that thousands of maintainers do not. I don't expect that they do, I expect that if they fuck up that their reputation takes a hit. That would some incentive for not fucking up. Instead, there isn't even any consensus that this guy fucked up. He's taking no responsibility whatsoever.

zeroname 8y ago

> Dozens of emails / notifications, people pinging / bothering you on multiple platforms, multiple emails, etc. Two options: 1. Stop supporting the package, mark it as deprecated, ignore/delete the spam 2. Hand over project to a stranger, endangering all of your users One of these options is irresponsible, the other one isn't. I'm not asking anyone to do something for me, I'm asking them to not do something for the sake of sanity. > It's stupid to blindly trust someone's code, regardless of who they are of if they are the current maintainer, that is not how you build secure software. I agree, but both of us know that pretty much the entire Javascript ecosystem is exactly that stupid. Let me ask you: What have you personally done to vet your dependencies? Have you used Babel or any of the other popular Javascript packages that have a huge dependency tree? If you have, chances are you are effectively blindly trusting all the developers in that tree. You're not checking every single commit that goes into it. > If you want to start some organization which vets people for maintainers go for it, but don't expect maintainers to do it, I can guarantee you that thousands of maintainers do not. I don't expect that they do, I expect that if they fuck up that their reputation takes a hit. That would some incentive for not fucking up. Instead, there isn't even any consensus that this guy fucked up. He's taking no responsibility whatsoever.