12 ms·
> Like, for example, evidence that the author actually takes security issues seriously and has a formal way to announce them. Personally I think there is a bus
by SolarNet 5y ago
> Like, for example, evidence that the author actually takes security issues seriously and has a formal way to announce them.
Personally I think there is a business model in there. "Curated" code releases/versions by a trusted third party you pay to review all the code. It would be a boring job, like being an auditor.
Bonus points, you can pay an "ethical" one that then tries to get money to the OSS devs of libraries that their clients demand the most.
- foobiekr 5y agoThis is hypothetically the redhat/monte vista/canonical business model, or part of it. They don't do deep curation though because they're not spending the money on it either, but at least they do some basic vetting. Which is apparently more than most of the coders out there.