Viewing profile — carols10cents

How does a user become a Trusted User? Who is paying them to review everything?

If you're writing the tests after writing the code, you're not doing TDD though.

Since Shai-Hulud scanned maintainers' computers, if the signing key was stored there too (without a password), couldn't the attackers have published signed packages? That is, how d…

Yeah, npm has orders of magnitude more users than crates.io. This attack's success, or lack thereof, has no bearing on the savviness of JavaScript or Rust developers.

So why are you upgrading?

Who is requiring you to use large numbers of transitive dependencies? You can always write all the code yourself instead.

Why wouldn't you knit a chicken???

And the architect is a volunteer for Habitat for Humanity.

who is going to pay for the review of packages and updates? how do we know we can trust the reviewers? github actions are name-spaced and that didn't help anything here...

Do not try to equalize a maintainer guarding their time and energy from having to deal with an issue that has already been fixed and users that refuse to search or read with trying…

No maintainer is obligated to maintain access to a discussion space for their users. > One now doesn't even know and cannot even estimate the number of other issues that must have …

It's the Charles Anderson Bridge. https://engage.pittsburghpa.gov/charles-anderson-bridge

What would prevent the sock puppet accounts from signing each others' keys?

How are these two problems unique to Rust though?

It looks like accounts can be entirely anonymous. How are you planning on handling moderation of comments? What happens if I post on a neighbor's house "jagoff who lets their dogs …

Tell me you don't know anyone from Pittsburgh without telling me you don't know anyone from Pittsburgh.

> these are the folks who do the Lawfare podcast, right? Yep, and they had a podcast episode with the author of this paper: https://www.lawfaremedia.org/article/the-lawfare-podcast…

I wish Bluey hadn't introduced the concept of a "bush wee" to my kid, I've had to explain that no, we can't pee in someone's yard in the middle of our busy neighborhood...

Namespaces can't be typosquatted?

Crates.io has publisher information-- namespacing is not required for that. For example, here are all the crates owned by the `azure` GitHub organization and published by the `azur…

How do namespaces measurably increase security?

I'm one of the crates.io team members, and we're very grateful to Phylum for doing this analysis and alerting us! As a volunteer member, I'm also very thankful to the Rust Foundati…

Making crev part of the official Rust toolchain won't magically make enough time in the day for me to want to volunteer any of it doing code review.

That's what TideLift's goals are too. https://tidelift.com/

You're very welcome, I'm glad you like it! <3