4 ms·

I hope there is a better way to maintain open source projects without being overly cautious and suspicious of every PR someone makes. Maintaining open source pr

• __loam 2y ago
  Public funding for security maintenance.
  • guappa 2y ago
    And serious taxation of tech companies.
• A1kmm 2y ago
  Designing for safety helps a lot. Memory safe languages, reproducible builds, encoding safety properties in the type systems, and so on. Sure, an attacker can subvert the types as well as the code, or use unsafe code, or try to tamper with infrastructure, but the more obvious it is that something is unsafe, the harder an attacker's job is. The xz attacker introduced high-risk features over time and used them to justify weakening security controls and things that might have detected the problem. A culture of safety over the absolute best possible performance might help to make such attempts harder.