Vetting the Cargo

Yay! We needed some method for securing the supply chain. I've written previously on the sociotechnical solutions that are available. And it will require a marriage of social and technical solutions to tie it together. We can boot up some non-profit institutions to help with this. We can line up some volunteers to help. And a trust chain with certificates. And different vetting levels. A whole network of approval smiling down upon us!

But when the first outpouring of PRs come in vetting my projects, I will not be as happy as you think.

It will seem like an honest flood of love. And of course, the individual contributors will be welcome. They have taken time from their life. Hours, days, even possibly weeks they don't have to judge my code coldly and efficiently. They are welcome and loved. Praise be to those individuals.

But I've seen networks of people used to control access. Most of the time, I can't prove it, and that's what I'll be reminded of as I welcome them. It's never the individuals fault of course, it's the other people.

Sorry, didn't mean to bruise this discussion.

Whilst the trust model is not perfect and a reputation based model with signed audits would represent an improvement I welcome this as progress in preventing supply-chain attacks. A worthwhile effort in my opinion.