Some enterprises, in the wake of #xz, are focusing on their metrics for #opensource dependencies they ingest..... rather than investing money, developer time, or other resources* to directly support maintainers.
But as I mentioned to a friend recently:
If downstreams do not provide at least as much support as a motivated attacker would, we're likely to continue to get these kinds of outcomes - & to be deceived, as attackers shape their efforts to trick the metrics.
As I said, I still do #opensource but care a lot less... the last straw was when I got a literal #deaththreat from someone because I hadn't worked on a #project in a while. (due to personal circumstances)
I dropped that project like a brick, locked everything down and went underground for 2-3 years. Not because I was afraid but rather fed up. Not the best approach but still.
@chaosmonkey Thank you for sharing your experiences and I am sorry those things happened to you. Yours is one of the stories I will keep in mind as I do my work.
And yeah - I think the coaching and cheerleading option is one that feels squishy and illegible to a lot of organizations and thus harder to recommend, so I am glad to be able to point to the pipenv example, and would welcome further case studies.
Add comment