3 ms·
Need to start doing basic verification of identity, being suspicious of users always using a VPn and proving their real location, many many years of contributio
by xcrunner529 3y ago
Need to start doing basic verification of identity, being suspicious of users always using a VPn and proving their real location, many many years of contributions before becoming a maintainer and having that control etc.
- zeroCalories 3y agoThis. Most important contributors are employed by big tech anyway. If you're an independent contributor at the minimum we need to have a way to hold you accountable.
- porkbeer 3y agoSiloing it back to big tech just creates the same problem again, because they have no incentive to keep it open.
- AstralStorm 3y agoIt's not siloed, the problem becomes one of trusting Microsoft with your address data. Then them verifying it correctly (which they won't) Then on maintainer checking if they're giving ownership to the right person. And just like everyone else, these have been compromised before.
- xcrunner529 3y agoFunny thing is other services such as banks and even Tinder (!) are way better at automatically not trusting and even demoting VPN users. Perhaps GitHub and others should do better here with making that stuff more visible. Oh and it appears the dev was working via email rather than the mailing list for a bit too. Probably should be more suspicious of any back channel attempts like that too.