3 ms·
Well, the threat model here is that a maintainer themselves is the saboteur.
by sunshowers 3y ago
Well, the threat model here is that a maintainer themselves is the saboteur.
- cjbprime 3y agoThat was true for this project, which was almost orphaned to begin with. We'll run out of nearly-unmaintained critical infrastructure projects sometime. Larger projects with healthier maintenance situations are also at risk, and it's worth reasoning about how a group of honest developers could discover the actions of one malicious developer (with perhaps a malicious reviewer involved too).