News for hackers. Stuff that matters.

A comment on Backdoor in event-stream library dependency. Parent comment

Re:Backdoor in event-stream library dependency by kurtisc on Monday November 26, 2018 @01:15PM (#18535491)
Would you have distrusted this maintainer though? If someone takes it over and publishes what appear to be real bug-fixes, I'd imagine most people would trust them. The same goes for trusting forks, or trusting the original developer not to hand over access.
[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by lmm on Tuesday November 27, 2018 @04:28AM (#18540846)
> Would you have distrusted this maintainer though? If someone takes it over and publishes what appear to be real bug-fixes, I'd imagine most people would trust them.

Quite possibly. But I'd make a conscious decision to do it, and certainly wouldn't be in any position to blame the original maintainer.

[ Parent | on HN ]