Hacker News Reader

While all of this is of course quite serious, we also need to remember that these types of things are actually fairly rare. Last major one was that JS event-stream thing, and that was in 2018 (5 and a half years ago).

I don't think this is really a structural problem requiring these kind of sweeping changes; it's just an occasional rare incident.

View on HN

As far as we know, they're rare...

No, the problem is that we don’t know how common it is.

We only know about the ones found.

Or there isn't anything else to be found.

It's more or less impossible to prove the absence of these type of bugs, so you can always say "we only know about the ones found" because that will always be true.

Either way, you're going to have to do better than "this could perhaps possibly maybe be a more common problem" if you want such a huge sweeping change as maintainers of open source projects to "be identifiable". What does that even mean in practical terms? They upload their passports? To who? Who and how do they verify this? How do we prevent edited passports? What about privacy? etc. etc. etc.

All for something we don't even know is a problem.

Reply on news.ycombinator.com