4 ms·
Why should I trust open source today? Packages are routinely hacked, political message or not. I 100% agree this has no place in open source but (1) people subj
by 88913527 5y ago
Why should I trust open source today? Packages are routinely hacked, political message or not. I 100% agree this has no place in open source but (1) people subject to the effects of war aren't in most sound state of mind and (2) "npm install" is arbitrarily running pre- and post- hook commands that can do all sorts of fun things on your machine. This commit looks harmless in comparison to packages looking for wallets and AWS credentials.
OSS is used not because it's safe or secure, but because the benefits outweigh the costs.
- hda2 5y ago> Why should I trust open source today? Packages are routinely hacked, political message or not. Correction: NPM packages are routinely hacked. I've been using linux packages for two decades, and not once have they been hacked (to my knowledge). I consider those packages to be infinity more secure than proprietary packages where I and others can't check what's running under the hood. OSS being safe and secure is one of the primary reasons why I prefer open source to closed source software.
- 88913527 5y agoAnecdotally, I agree because it's difficult to find much on linux package distribution hacks. But there is this: https://lwn.net/Articles/295406/ https://lwn.net/Articles/295406/ I guess I wonder where you draw the line, and if this sort of incident is acceptable, why, and is the line being drawn arbitrary.
- johnny22 5y agoand typo name hijacks in other language specific repos