> So, look, I get that there are some people who want to live in a world built on caveat emptor and the idea that it’s always and only your fault if something bad happens to you. I get that there are some people who think this is the only kind of world open source can be. Maybe Armin is one of those people, or maybe he just argues like one without realizing or intending it. [...] But no. Just… no. That would be a terrible world, and a terrible model for open source software.
Is "that would be a terrible world" supposed to be a counter-argument? The world is built on caveat emptor, especially when downloading random packages off the internet. That's why browsers are sandboxed. That's why people run virtual machines. The vetting process for adding new dependencies at big corporations can literally last months. The 2FA nonsense does basically nothing in practice (vetting will not and should not magically go away), and only adds an undue burden on developers.
The internet is a dark forest and I think it would do us a bit of good to treat it as such.
Is "that would be a terrible world" supposed to be a counter-argument? The world is built on caveat emptor, especially when downloading random packages off the internet. That's why browsers are sandboxed. That's why people run virtual machines. The vetting process for adding new dependencies at big corporations can literally last months. The 2FA nonsense does basically nothing in practice (vetting will not and should not magically go away), and only adds an undue burden on developers.
The internet is a dark forest and I think it would do us a bit of good to treat it as such.