@malwareminigun@infosec.exchange
Post #1398857
2026-03-23 20:50 UTC
@coderanger It doesn't matter if they were "bullied", the fact is that they did it. JiaTan being able to push a release was not a surprise to the original maintainers.
Replies (1)
-
@coderanger@cloudisland.nz 2026-03-23 20:53
@malwareminigun I think you might be misunderstanding this as being about package security, which I'm not sure anyone is discussing web-of-trust for? The recent push between projects like Vouch and humans.json has been to do maintainer-level trust analysis. I posit this will be ineffective.