3 ms·
We can play this game all day. 99.999% of open source projects rely on Github Actions, Circle CI, Travis CI etc to build their code. Those are all proprietary
by threeseed 5y ago
We can play this game all day.
99.999% of open source projects rely on Github Actions, Circle CI, Travis CI etc to build their code. Those are all proprietary so unless you are running your own CI/CD stack then you can't trust the code.
And of course every open source project relies on libraries. So you need to make sure this applies equally to them as well.
- heavyset_go 5y agoYes, I'm pretty sure we're all familiar with "Reflections on Trusting Trust"[1]. Security comes in layers, and with open systems, if you want to, and if you have the resources, you can audit and verify those layers depending on your level of paranoia and your potential adversaries. You might throw your hands up in the air because security isn't assured and go all in on closed, black box systems, but there is value in open systems when it comes to security. [1] https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...