11–20 of 184 posts
It looks they consider as maintainer only those people who listed on package.json, not a real number of contributors on github or anything.
So all conclusions in this post is based on wrong assumption and incorrect data interpretation. That's all you need to know about it.
I think you could list random people on github in your package.json to looks cool in eyes of stats cultists.
I find it more concerning that the DoD uses node. I might be wrong but npm etc feels like a very large attack surface.
Huh, I just checked stats on ecosyste.ms It looks they consider as maintainer only those people who listed on package.json, not a real number of contributors on github or anything. So all conclusions in this post is based on wrong assumption and incorrect data interpretation. That's all you need to know about it. I think you could list random people on github in your package.json to looks cool in eyes of stats cultis…
technically speaking, if you have a large project with many contributors, every contributor is often still only responsible for one small part of the project. linux kernel drivers and subsystems most have their dedicated developers. and very few of them each.
The title of the register article is completely disgusting > Putin on the code: DoD reportedly relies on utility written by Russian dev then in the article: > Hunted Labs told us that it didn't speak to Malinochkin prior to publication of its report today, and that it found no ties between him and any threat actor.
The title of the register article is completely disgusting > Putin on the code: DoD reportedly relies on utility written by Russian dev then in the article: > Hunted Labs told us that it didn't speak to Malinochkin prior to publication of its report today, and that it found no ties between him and any threat actor.
Aren't Russian developers on average more susceptible to the "wrench attack" though?
I find it more concerning that the DoD uses node. I might be wrong but npm etc feels like a very large attack surface.
If they had done an activity check they would have seen that half of all projects have zero maintainers.
updating is a systemic issue, not a per-project matter
The title of the register article is completely disgusting > Putin on the code: DoD reportedly relies on utility written by Russian dev then in the article: > Hunted Labs told us that it didn't speak to Malinochkin prior to publication of its report today, and that it found no ties between him and any threat actor.
Aren't Russian developers on average more susceptible to the "wrench attack" though?
Some of the best engineers that I've worked with (in the US and Europe) are Russian. I've also been quite impressed with other former Iron Curtain developers. A lot of Chinese folks I've worked with have been good.
I know that some nations are known for threatening the relatives of expats, to get them to work on their behalf. Not very nice.
But state-sponsored Russian (or other nations, as well) is definitely something to be concerned about. I suspect a number of folks are concerned about the influence of American programmers. The CIA is known for using fairly innocuous employees of NPOs. My father was one.
I find it more concerning that the DoD uses node. I might be wrong but npm etc feels like a very large attack surface.
The DoD is a huge organization, so I'd guess they use almost everything.
That's an understatement if there ever was one.