4 ms·
Realistically, maintainers are strangers on the internet to me, and crucially, it is common to add unofficial repos, as well as use non-platform package manager
by dijit 2mo ago
Realistically, maintainers are strangers on the internet to me, and crucially, it is common to add unofficial repos, as well as use non-platform package managers like npm, cargo and pip.
It’s all strangers stuff
- embedding-shape 2mo agoPersonally, "strangers under a banner of long-standing organization XYZ" is different to me than "jkb_25342" on GitHub with one repository, with no source and only binary releases. Realistically, of course you're right, I don't know everyone who maintain the software I work, but I am familiar with the organization. Basically, you need to figure out where you can place your trust, which again for me personally, depends on a lot more things than "met face to face and know who they are".