Hacker News Reader

Comment by nailer | Hacker News Reader

People in this case aren't asking for support, they're asking for the project to have been given to a trusted maintainer or declared abandoned.

View on HN

How do you suggest finding trusted maintainer who would not turn malicious at later date?

I don’t. No guarantees of anything. But we can probably do better than random Chinese dude with no other projects or contribs

To be honest I wouldn't expect an abandoned project to be any different. I would expect it to have lost its maintainer, not switched from a trustworthy maintainer to a malicious one.

Edit: Clarified second sentence.

No maintainer is malicious...until they are. Be honest with yourself: how many dependencies have you vetted the maintainer before including? If n > 0 then you're just as susceptible.

I wouldn't just add some random maintainer with a new GitHub account to a project I controlled. If they had made some contributions via pull requests, I would consider it or if they were a maintainer of other projects with actual users. In this case, there was no vetting at all. A brand new GitHub account with a couple forks.

I'm not placing all the blame on the original maintainer as I understand his philosophy of handing off the torch, but I think it's a naive thing to do, as this has shown.

Ultimately, this has been a good demonstration of a weakness with the ecosystem and I think there are a lot of things that could be improved here to help mitigate this in the future.

Reply on news.ycombinator.com