4 ms·
On open source projects you can vet people based on whether you can personally identify them as real people. Moving forward be suspicious of anonymity for core
by kelseydh 3y ago
On open source projects you can vet people based on whether you can personally identify them as real people. Moving forward be suspicious of anonymity for core contributions.
- not2b 3y agoDebian does things that way, their developers have to get their key signed by other developers, and a DD who signs someone's key is supposed to check ID. But there's no similar protection for their upstream.
- xcrunner529 3y agoAnd using a freaking VPN for everything. Definitely more vetting is needed.