Mastodawn

Axios maintainer pwnage is fucking peak incompetence. Critical shit is on the hands of fucking idiots. How the fuck are these guys not having separate computers for different tasks? Seriously... Or a fucking VM for the crap... Tech is available, tech is cheap. Everyone is a fucking moron... Damn...

Show thread

Chris Adams 3d ago

@osxreverser That's not even remotely near peak. Yes, they could have done better but … nobody is buying them a separate computer to use for stuff like this and if it's a side project they're not looking for more friction.

We have this conflict all over the open source world. We could really use a well-trusted organization (CNCF, Apache, Linux, etc.) making a major effort to help maintainers adopt trusted publisher build workflows, for example, but that wouldn't be cheap or fast.

Show thread

fG!3d ago

@acdha Virtual machines are dirty cheap. There is no excuse. People are just incompetent and the whole thing is ridiculous the more you read into it. It can't just be fame and github stars, the increased responsibility demands increased friction, security and better processes. Otherwise it's just stupid risk everyone is taking, assuming the other side is able to behave reasonably secure.

Show thread

schrotthaufen

@osxreverser @acdha People are *very* lazy. Any kind of friction at all is only ever accepted after unjustifiably expensive damage was done. When it comes to extra steps for themselves, even people with a phd in infosec forget how to calculate risk.