Whoever wrote, reviewed, and approved this at the OpenSSF.
Consider leaving the organization. I am not joking. You have no idea what you are talking about; you know nothing about Open Source, and you seem to know nothing about Security, either.
Even less all these things combined. Just. Leave. Resign. It is ok to realize you are not the right person for that position. It happened to me before.
@Di4na > Looking back at the last OpenSSF Scorecard report on the xz repository, we do see a number of best practices such as Code-Review, Token-Permissions, Branch-Protection, and Static-Analysis were not enabled, nor did xz have the OpenSSF Best Practices badge. It’s difficult to predict whether these settings on their own would have prevented this backdoor, however, security best practices were not followed.
Add comment