News for hackers. Stuff that matters.

A comment on Crev: dependency vetting with a web of trust.

Re:Crev: dependency vetting with a web of trust by kuhhk on Friday January 04, 2019 @11:30AM (#18825228)
> crev is scalable, distributed and social. Users publish and circulate results of their reviews: potentially warning about problems, malicious code, or just encuraging high quality by peer review.

I like this. It would be nice to flag questionable areas outside of the maintainer's control, for other experts to look at. Sometime's I've seen something fishy that I share with a friend/colleague who might know how to interpret it, but often times it's in a language/framework that I might not have a friend to ask.

The open source saying "given enough eyeballs, all bugs are shallow" has always been a faux pas, because there has never been enough eyeballs, especially on small projects. However, something like this could begin to close the gap. +1 from me

[ Parent | on HN ]
Re:Crev: dependency vetting with a web of trust by infogulch on Friday January 04, 2019 @03:55PM (#18827521)
"given enough eyeballs, all bugs are shallow" is a reasonable theory but it includes some dubious assumptions like the distribution of eyeballs over code being or uniform (or proportional to use), frictionless planes, and spherical cows. We may be stuck with spherical cows, but hopefully something like this can help smooth over the eyeball distribution assumption.
[ Parent | on HN ]