3 ms·
There is an argument to be made in the opposite direction. One of the key benefits to open source software is the opportunity to inspect the code that you're ru
by ISL 5y ago
There is an argument to be made in the opposite direction. One of the key benefits to open source software is the opportunity to inspect the code that you're running... before you run it.
At issue here isn't open source as a concept, but rather an emergent ecosystem in that blindly trusts package uploaders not to be malevolent. It points to a need for improved testing coverage. Indeed, since open source is open, it is also amenable to static analysis of uploaded package revisions, something one cannot readily do with closed-source software.
- shkkmo 5y agoThere were deliberate attempts to hide the file deletion payload in obfuscated d code. Running your tests would have resulted in your files being deleted or the test passing and would have done nothing to protect you from this particular instance.