3 ms·

Who would trust those?

• z3t4 8y ago
  Then the question becomes, how do you know who to trust ? Are you supposed to also vet the id-hashes of the signers ?
  • sgeisler 8y ago
    I guess you will trust coworkers, people you know irl, well known developers, companies you pay for review subscriptions. You don't have to trust all of them 100%if you require multiple reviews per dependency.