News for hackers. Stuff that matters.

A comment on Backdoor in event-stream library dependency. Parent comment

Re:Backdoor in event-stream library dependency by rando231 on Monday November 26, 2018 @12:17PM (#18534923)
If you can't or don't want to maintain the project and can't find anyone trustworthy to take it over, just don't do anything. This effectively deprecates the project, while not harming its existing functionality.

This maintainer actively ceded control of his library to some random person.

[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by tschellenbach on Monday November 26, 2018 @12:46PM (#18535236)
Yeah this one is easy to spot, but what if someone makes valid contributions and for pull request #10 slips in a backdoor. Most open source projects are not able to check that anywhere near thoroughly enough.
[ Parent | on HN ]