5 ms·

> They can even introduce vulnerabilities intentionally, and it's your responsibility if you trusted them not to. Is that true? I can add code in my open sourc

> They can even introduce vulnerabilities intentionally, and it's your responsibility if you trusted them not to. Is that true? I can add code in my open source library to steal credit card numbers, and if you use it that'd be your fault?

pjmlp 5y ago
There is a reason why some companies have internal repos only policy, and libraries only get added to them after legal and IT review.
cutemonster 5y ago
It's not true. There's a legal system and they cannot do intentionally illegal things and fraud. But it's good to not trust random strangers at GitHub -- maybe a user profile is just a facade for a criminal gang, maybe untraceable so they can get away with it
- seba_dos1 5y ago
  Not every intentional vulnerability is meant for illegal things or fraud.