3 ms·
Not doing that is cheaper and there's no regulation that forces companies to do those audits to get things released. We live in capitalism where cheaper wins.
by xena 3y ago
Not doing that is cheaper and there's no regulation that forces companies to do those audits to get things released. We live in capitalism where cheaper wins.
- EGreg 3y agoForget government force, I am talking about industry standards and defaults. People have RedHat, Apple and others for distributing stable app and service versions with operating systems. Same principle should apply to package managers. How can a low-level package break or poison 40,000 other repos overnight? This culture of Tweeting at 5 am to 5 million people before the truth has a chance to get its pants on is defended in the name of “freedom of speech”, but I much prefer the peer review gated approach of science. Not one monopoly gatekeeper but at least 2 reputable ones, before your OS or package manager allows the download (but users can override it if they insist). I think rpm and yum do that..
- jstarfish 3y agoSupply chain attacks are a thing in Linux too. Some activist clown tried to brick devices with Russian or Belarusian IPs in the same manner. This system is compromised.