News for hackers. Stuff that matters.

A comment on The Pull Request Hack Is Fucking Magic. Parent comment

Re:The Pull Request Hack Is Fucking Magic by armchairhacker on Saturday July 15, 2023 @11:38AM (#36737778)
> The Pull Request Hack probably isn't suitable if you're running big projects. And it is almost certainly a stupid idea if you write code which is actively used by multiple downstream projects. And if your stuff has even the slightest chance of compromising security then you're better off sticking to trusted members.

The code (event-stream, a popular NPM package which was targeted because it's used by a crypto wallet) fails all 3 criteria.

[ Parent | on HN ]
Re:The Pull Request Hack Is Fucking Magic by throwaway290 on Saturday July 15, 2023 @02:01PM (#36739419)
Only one... It is really tiny and has nothing to do with security. (As in, not directly... Actually everything can impact security if it's used wrong so that point is moot).

It does have multiple downstream users. But I will bet 99% of projects where contributors submit good PRs, and maintainers have not enough time so they give commit access, have multiple downstream users.

[ Parent | on HN ]