3 ms·
Yeah but really this isn't true. Popular open source that has tens of thousands of eyes on it still gets compromised all the time (see: npm). Even the Linux ker
by dymk 8y ago
Yeah but really this isn't true. Popular open source that has tens of thousands of eyes on it still gets compromised all the time (see: npm). Even the Linux kernel has had rogue git commits injected into it.
- calcifer 8y ago> the Linux kernel has had rogue git commits injected into it What? Who "injected" what and when?
- spacedog11 8y agoI'm also interested to know more about this.
- spion 8y agoThe probem with npm isn't that open source doesn't help, its that the eyes get spread out thin when you have thousands of modules - so nobody is looking at the changes that happen in their lots of small dependencies. Which is not to say that thats not a valid approach - but for it to work we need better tools to handle lots of git repos at once (for example, the ability to get notified about any new code on github that affects your project would be pretty cool, especially if its coming from people or organisations you haven't explicitly marked as trusted yet) I would like to see someone try and sneak rogue commits into Linux. It would be quite the feat.