4 ms·

> People treat this problem as unsolvable when it's absolutely not. The root problem is "I'm using software from hundreds of authors, how do I know I can trust

by p-e-w 4y ago

> People treat this problem as unsolvable when it's absolutely not. The root problem is "I'm using software from hundreds of authors, how do I know I can trust all of them?". And that problem is indeed unsolvable. It's not even a technology problem. And no, peer review is not the solution. Scientific fraud is still widespread despite peer review being the standard for many decades. Granted, there may be better approaches than the Wild West that is PyPI and NPM, but this problem will never go away completely.

deleted 4y ago
[deleted]
Zuiii 4y ago
Are you honestly telling me that a package that was reviewed and signed off by three reputable developers is practically susceptible to "Scientific fraud"? If you do, then I can see why you think this problem is unsolvable. You will never have a theoretically perfect solution to this problem, but guess what: turns out you don't have to. Even single-reviewer systems like linux repositories have proven to be vastly more secure than this crap. This problem is absolutely solvable and eventually it will be. I just hope they solve it the right way.
- HideousKojima 4y ago
  >Are you honestly telling me that a package that was reviewed and signed off by three reputable developers is practically susceptible to "Scientific fraud"? Yes? Especially if it's pulling in dependencies written by a bunch of other people because then it doesn't require malicious action by those three reputable devs, but merely negligence on their part in how those dependencies (and any updates etc. to them) are managed.
  - Zuiii 4y ago
    Of course negligence causes the system to fail. That's why people rely on REPUTABLE developers; that is, those who have a long history of doing good, thorough reviews. In practice, even single-reviewer systems have proven to be enough to keep entire package ecosystems secure (linux package maintainers). I encourage you to do more research on this topic.

by p-e-w 4y ago

deleted 4y ago

[deleted]

Zuiii 4y ago

Are you honestly telling me that a package that was reviewed and signed off by three reputable developers is practically susceptible to "Scientific fraud"? If you do, then I can see why you think this problem is unsolvable. You will never have a theoretically perfect solution to this problem, but guess what: turns out you don't have to. Even single-reviewer systems like linux repositories have proven to be vastly more secure than this crap. This problem is absolutely solvable and eventually it will be. I just hope they solve it the right way.

HideousKojima 4y ago
>Are you honestly telling me that a package that was reviewed and signed off by three reputable developers is practically susceptible to "Scientific fraud"? Yes? Especially if it's pulling in dependencies written by a bunch of other people because then it doesn't require malicious action by those three reputable devs, but merely negligence on their part in how those dependencies (and any updates etc. to them) are managed.
- Zuiii 4y ago
  Of course negligence causes the system to fail. That's why people rely on REPUTABLE developers; that is, those who have a long history of doing good, thorough reviews. In practice, even single-reviewer systems have proven to be enough to keep entire package ecosystems secure (linux package maintainers). I encourage you to do more research on this topic.