Search

It's irresponsible for any security-sensitive OSS project to accept public PRs. AI code review is amazing, but it doesn't solve this. Attackers can keep trying indefinitely under new identities. You have to catch every malicious contribution. They only have to get one through. #OpenSource #Security #CodeReview #Thetweetdoesnotmentionanyspecificcountries.Thus #theresponseis:

The key thing to understand about OSS going forward is that problem reports are now more valuable than code submissions. For security-sensitive projects, public PRs now have net negative value: cheap to produce, expensive to review, and risky to accept. #OpenSource #Security #CodeReviews #Nospecificcountriesarementionedinthetweet.Therefore #theresponseisempty.