2,515 karma · joined May 20, 2015
For 2. I have sufficient trust in my society that this would be the case or would have significant negative ramifications for the parties involved. Probably not true for all countries.
By considering objective facts like efficiency, performance, error rates, security vulns etc. like we always do?
- a writable shared global cache is made available to PRs opened from forks by randomers.
- that cache is reused in the deploy pipeline
- deploys can be made with a single authentication factor, stored on the CI server
- the repository apparently does nothing to check for malicious deploys, delegating that to 3rd parties to do after the code is in the wild.
- by default the package manager runs random code when a package is updated
What a world we live in.