you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 2 years ago (2 children)

This is how one attracts and invites Jia Tan and Hans Jansen types.

  • source
  • hideshow 4 child comments
  • [–] [S] 3 points 2 years ago (1 child)

    this isnt worth the time, it's not a dependency of a huge piece of software

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 2 years ago (1 child)

    Malicious account holders with a long term goal need to build reputation. It doesn't matter much that such an app isn't a dependency of other software.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 6 points 2 years ago (1 child)

    Practically every FOSS project is actively looking for volunteers/maintainers all of the time. More contributors are not problematic.

    The xz problem was that they socially engineered the main dev into giving them the keys to the kingdom.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 2 years ago (1 child)

    Making one a maintainer (with merge and possibly even direct commit/push permissions) is handing them a key to the kingdom. Recruiting a maintainer out of the blue without them being already contributor and long term participant in the project is questionable.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 2 years ago (1 child)

    I believe that the bad actor was a contributor for several years before becoming a maintainer

  • source
  • parent
  • hideshow 2 child comments