Re:The rise of few-maintainer projects
by dustfinger on Saturday May 25, 2019 @10:15PM
(#20012726)
Trust issues can often be mitigated with verifiable signatures. Perhaps if there was a protocol in place requiring each release to be signed by the current maintainer and all commits signed by the individual contributors, then a change in signature on the release would have provided a strong downstream signal that maintenance had changed hands. Without verifiable signatures, downstream is drinking the water without testing it. As you said, there are crazies out there, who knows what they might put in the water.
But in this case, it's not "a member of that community who also has potato farming skills", it's an absolute nobody, who you haven't seen doing any farming, or eating, before. It's a big world, there are crazies out there, they show up every once in a while.
And finally, it's the internet, it's not really like anything that came before. You can be more trusting in a small town than in a big city. The internet is 1000 times bigger than the biggest city, it's a whole new kind of thing. If 99.9% of people out there have good intentions, that still leaves millions of people on the internet trying figure out a way to take advantage of you.