> Review every patch? Well, yeah. If you review code contributed by somebody you spent hours vetting and interviewing, and whose worked in the next office ove

> Review every patch? Well, yeah. If you review code contributed by somebody you spent hours vetting and interviewing, and whose worked in the next office over for a year, and whose work is accountable through their livelihood, why would you not review the code contributed by some unpaid internet rando? Of course, the practical answer is “Because that’s crazy! There’s no budget for that!” — which is why this problem exists. There are other ways of establishing and delegating trust so that you personally don’t have to review every import and change (see the Linux distribution ecosystem), but these vulnerabilities will persist until those networks and systems get built out. And they won’t get built out until people learn that GitHub stars and popularity are not sufficient measures of quality or reliability.