Post #2176668
2026-04-16 11:20 UTC
@hipsterelectron@circumstances.run @slink@fosstodon.org probably but my problem with SLSA are more that I actually respect people in the supply chain and want results.
Which... this goes against it.
Replies (1)
-
@slink@fosstodon.org 2026-04-16 11:30
@Di4na@hachyderm.io @hipsterelectron@circumstances.run it imposes a massive burden on maintainers and does not have answers for fundamental problems. Like: Why the bias towards trusting github? How do they manage my keys? Why should I trust a millions-of-LOC node.js monster to build my code? I have really only just started and do not feel spending any more time with it was worth it. This looks very much like all the other plays the security theatre is staging. Again, at least for now.