Let's use GitHub as an example. We have forks, and stars. Maybe we could also have some kind of build endorsement?
How one would verify that the endorser is worth your trust, I am not entirely sure.
Maybe endorsers could eventually be rated by CVEs found in their endorsements, and that would build trust?
On top of that it could have forced release binary scanning via VirusTotal/insert-malware-scanning-vendor-here.
Pay researchers to analyse repos without any. Post results. Link to the repo with mitigation PRs.
It’s insane this isn’t the standard already
This is the problem, the best we can do is pay via exposure. But that actually ain't nothing. Not just individuals, but also orgs could then make money from private contracts based on their reputations? This should be the benchmark of trust. Could there be anything better?
I would love other people to jump in and elevate this conversation.
Sure, CVEs might not be the ideal metric. Could you, or anyone else, suggest a better metric?
If GitHub is too lethargic to do even contemplate this type of change, maybe this could be a differentiator for GitLab?
This would actually be an excellent LLM coding benchmark,[0] in addition to a human endorser benchmark.
[0] If nobody is already doing this, especially retrospectively, and you do, then please at least give me a shout out. :)