News for hackers. Stuff that matters.

A comment on Backdoor in event-stream library dependency. Parent comment

Re:Backdoor in event-stream library dependency by ocdtrekkie on Monday November 26, 2018 @12:12PM (#18534865)
You can't vet the people, but you can vet the code. Of course, if you just give someone commit rights, then you can't. But generally speaking the maintainer understands the code they merge into a project, and that is the vetting that takes place.
[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by AndrewGaspar on Monday November 26, 2018 @12:25PM (#18535002)
Nobody's saying you should never accept a patch from an unknown person. "Of course, if you just give someone commit rights, then you can't." is the whole point!
[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by kurtisc on Monday November 26, 2018 @01:28PM (#18535617)
If you're using auto-updating external packages, aren't you effectively giving the package author commit access to your derivative project too?
[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by shittyadmin on Monday November 26, 2018 @12:36PM (#18535120)
Sure, but then they have to actively invest time into the project... not everyone can afford that.
[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by heartbreak on Monday November 26, 2018 @06:53PM (#18537925)
Then mark the project as abandoned and add a note suggesting the new volunteer’s fork.
[ Parent | on HN ]