Verify the identity of developers
Verify the identity of developers
Posted Apr 5, 2024 13:43 UTC (Fri) by farnz (subscriber, #17727)In reply to: Verify the identity of developers by atnot
Parent article: A backdoor in xz
… assumes a "supply chain" and an avenue for contractual obligations that just does not exist, cannot exist and is deeply undesired by all of the people this industry runs on, those who publish their code online because it brings them joy.
This is the key point; if you're going to "solve" this problem, you need to start at the producer end, since the consumers of Free Software have no leverage over the producers in general (you may have leverage in specific cases - say if you employ a producer of Free Software and can threaten their livelihood - but not over the full sum of Free Software).
If you can't come up with a good reason why you'd jump through the hoops you're putting in place to fix a typo in a message the program displays (say changing "the" to "The" because of context), then your hoops are not going to work in general, since there will be plenty of producers of best-in-class Free Software who refuse to jump through your hoops.
