On Tue, Feb 11, 2014 at 07:53:14PM +0100, Honza Horak wrote:
I'm not sure that significantly is correct. It's not such a big problem now to package some sane code, go through formal review and then change the code to malware. As far as there is some quick "stop" button, I'd be ok with automatic reviews.
Sure. The current model is based on the idea of sponsorship, and the idea that the high bar of getting a package in creates a system of contributor trust. We should probably look at how true that is, too.