2 ms·
Your argument assumes the malicious submitter is honest about their identity online. We can't assume that. Instead, we have to assume that all source, regardles
by teawrecks 5y ago
Your argument assumes the malicious submitter is honest about their identity online. We can't assume that. Instead, we have to assume that all source, regardless or how "open" it is, could be malicious. Only once it has been properly audited by the many eyes of the community should we consider placing any trust in it.
If people had confidence in the ecosystem because they thought they could blindly trust code from random strangers, then it was misplaced to begin with.
- randomhodler84 5y agoI agree with you there, however reality is that you may have one of these packages in your build, on your system, just through merit of using something else in the js ecosystem. We are never going to have a vetted set of dependencies. It will forever remain a mess as long as the platform and ecosystem exist. At best we can be reactive and kick bad actors out of the picture.