CS students are not expected to do security audits in production software.
And if they do, it will certainly not be exhaustive. Nor will it be at a pace in which software is typically released.
And if they do, it will certainly not be exhaustive. Nor will it be at a pace in which software is typically released.
I expect most projects don't even check they're not violating licenses or ever audit any dependency… let alone do a security check on who the authors are.
Also just FYI, russians are not stupid. If they want to contribute malware they won't do it from their kgb email address. They will create a fake identity with a very standard WASP name.
Security is generally better in linux based ecosystems than windows.
Microsoft also don't do sec audits - if you want a sec audit on your stack then you buy it.
It just turns out that it is much easier to audit a Linux based stack that a Windows based one