3 ms·
> Should always do a simple diff at minimum to see what changed. That's just part of being a responsible open source user. Nobody does this, as this is complet
by xyzzyz 5y ago
> Should always do a simple diff at minimum to see what changed. That's just part of being a responsible open source user.
Nobody does this, as this is completely unreasonable thing to expect.
- Arnavion 5y agoThe open source user they're referring to is the package creator, not the package installer. The package creator takes responsibility for the software they package. I sure hope they check the diff. I certainly do for the packages I maintain.
- pas 5y agoBut is that an audit? How much does that worth against a determined and skilled adversary? I mean if they quickly do a lot of big changes they can easily drown packagers/reviewers, and then slipping something through becomes a waiting game.