Sven Slootweg (soft-deprecated) @joepie91@pixie.town

As a bit of extra background: I've been professionally auditing (probably thousands of) FOSS dependencies for years now, in a high-risk environment, and *not once* have I run across deliberately malicious code, not even questionably broken code, really.

Every single issue so far has been a security issue, none that were likely to be disguised backdoors. Many of them very common security issues that most developers are likely to create themselves when reinventing wheels (eg. when avoiding dependencies out of a misguided fear of malicious code).

That's where the *real* risk is.

This also feels like one of those cases of the metaphorical-law-I-forgot-the-name-of, where people perceive an uncommon event as being really common because it's so uncommon that it gets widely reported every time it happens, and therefore skews people's perception of its frequency

And no, it's not *just* security folks overestimating the threat level, tons of software developers do it too (and often at the same time overlook the things that are *actually* dangerous)

I don't think computer people really realize just how little (relevant) malicious code actually exists on the anyone-can-upload package registries, and folks seem to consistently overestimate the actual threat level here

Tired: who would ever buy these useless home shopping gadgets?

Wired: oh, the target demographic is disabled folks, not me, some of them turn out to be really useful though...

Inspired: wait, my ADHD motor control issues are a disability, and I *am* the target demographic

@determinerik Dit was voorheen Apotex, die was toen ook al failliet gegaan en dus doorgestart als InnoGenerics, blijkbaar

https://sleutelstad.nl/2020/08/11/doorstart-leidse-medicijnenfabrikant-apotex-lijkt-mijnenveld/

It occurs to me that there are some very clear parallels between "energy efficiency comparisons of programming languages" and ""EV proponents".

People are constantly talking about how EVs will be so much more energy-efficient, rather than questioning whether maybe we shouldn't have so much private car usage in the first place.

Likewise, people talk about the efficiency of different programming languages, rather than questioning whether maybe 80% of what we do with them (particularly advertising/analytics-related) maybe shouldn't be done in the first place.