Post #4389202

A car manufacturer lists an Android botnet in its open source attribution. The entry gives away how the list was made: by scanning instead of by declaring. Why a declared dependency list is worth more than a scanned one, and how the PHPUnit PHAR discloses its own contents: https://phpunit.expert/articles/your-composer-lock-knows-what-a-carmaker-only-guesses.html?ref=mastodon