carols10cents

How does a user become a Trusted User? Who is paying them to review everything?

If you're writing the tests after writing the code, you're not doing TDD though.

Since Shai-Hulud scanned maintainers' computers, if the signing key was stored there too (without a password), couldn't the attackers have published signed packages?

That is, how does signing prevent publishing of malware, exactly?

Yeah, npm has orders of magnitude more users than crates.io. This attack's success, or lack thereof, has no bearing on the savviness of JavaScript or Rust developers.

So why are you upgrading?

Who is requiring you to use large numbers of transitive dependencies? You can always write all the code yourself instead.

Why wouldn't you knit a chicken???

And the architect is a volunteer for Habitat for Humanity.

who is going to pay for the review of packages and updates? how do we know we can trust the reviewers?

github actions are name-spaced and that didn't help anything here...

Do not try to equalize a maintainer guarding their time and energy from having to deal with an issue that has already been fixed and users that refuse to search or read with trying to cover up for gross negligence and bugs.

No maintainer is obligated to maintain access to a discussion space for their users.

> One now doesn't even know and cannot even estimate the number of other issues that must have gone unreported. It's not safe or wise to use a package that is so shrouded in mystery. It is in fact foolhardy.

Issues don't get reported for any number of reasons. All open source is use at your own risk.

What would prevent the sock puppet accounts from signing each others' keys?

How are these two problems unique to Rust though?

It looks like accounts can be entirely anonymous. How are you planning on handling moderation of comments? What happens if I post on a neighbor's house "jagoff who lets their dogs poop everywhere lives here, please evict"?