3 ms·
The open source user they're referring to is the package creator, not the package installer. The package creator takes responsibility for the software they pack
by Arnavion 5y ago
The open source user they're referring to is the package creator, not the package installer. The package creator takes responsibility for the software they package. I sure hope they check the diff. I certainly do for the packages I maintain.
- pas 5y agoBut is that an audit? How much does that worth against a determined and skilled adversary? I mean if they quickly do a lot of big changes they can easily drown packagers/reviewers, and then slipping something through becomes a waiting game.