> I just don't understand why open source software can continue with the assumption that every single contributor is honest It doesn't. They've been on the loo

> I just don't understand why open source software can continue with the assumption that every single contributor is honest It doesn't. They've been on the lookout since before 2003: https://lwn.net/Articles/57135/ https://lwn.net/Articles/57135/ (there are other examples, this is just the earliest I know of) > Apparently, do nothing, and assume that everyone in the world is honest, while writing self-indulgent "public letters" about it? This sounds overly dramatic which makes discussion difficult. My answer would be that the kernel maintainers have known about this threat vector for a very long time and seem to be doing a reasonable job of repelling it.