3 ms·
You have now just transferred risk. You have done nothing to mitigate it, and created more work for those of us that actually do read code. Then again, if some
by salawat 4y ago
You have now just transferred risk. You have done nothing to mitigate it, and created more work for those of us that actually do read code.
Then again, if someone wants to pay me to do nothing but read and vouchsafe code, hell, why not. As QA I basically do that anyway. Will have to think on this.
- remram 4y agoI don't see it as "transferred risk". As individuals we already have people we trust and people we don't know. This system allows you to get trust in your dependencies without requiring to trust the specific rando that authored the specific library you want to use. Yes ultimately someone you trust has to vouch for the library for you to trust it. That's unavoidable either way. Those systems only allow for that person to be anyone instead of just the author.