The rust project does it. There's a repo with all [active] members and their permissions on github, etc. These get synchronized and updated every time there's a change.
1 to 2 paychecks = 100% increase.
> good guys getting one paycheck instead of zero
0 to 1 paycheck = infinity increase.
With a known baseline of "good paychecks", financial analytics can pursue identification of "bad paychecks".
Related, the motivation for trying to gain privileged access to open source projects is to leverage the existing trust associated with that project. A different long game that could be played is to create a new project with the intent on backdooring it a few years down the road, after it has gained sufficient trust.
This might be worth doing and contributing to a site like bestofjs or libraries.io (I don't really use that one though!)
When major security players insist that using GPG is bad, there is no way of knowing if [email protected] is the same account that it was last month or not.
You'll receive an email asking you to stop uploading signatures.
I think guessing a password and getting lucky is much easier.
It might be that no open source contributions I've made are things people care about, but I'm not spending one second of my time for free updating databases so multi-billion dollar companies can feel safer.
Those changes of maintainers need to be synced to package distribution sites like npm.js or Debian packages and put in context with versions/releases.
In Europe this was introduced for banks after the banking crisis. If a bank does any organizational change, a report is sent out to all member states of the EU right away and any of the 27 national bank agencies can check if they notice something unusual. It might be possible to bribe a few people in your own country, but it’s really hard to bribe all responsible people in 26 other countries.