Post #1074215
2026-02-22 22:00 UTC
@filippo I loathe Dependabot, even for zero-dependency projects, because every time I approve one of those rather-opaque PRs, I think “The bad guys only have to compromise Dependabot or one of the adjacent CI-toolchain packages and they own the world and probably do it in a way that I’m not smart enough to notice until too late.” Am I being unreasonable?
Replies (1)
-
@carlana@tech.lgbt 2026-02-23 03:57
@timbray I had a joke tweet to that effect at some point. It is worrying if you think too much about it.