Mastodon Feed
We have previously understood that there is a presumption of good faith amongst the software developer community, that most people on Github, on PyPI, on NPM are not trying to ship you malware. Even the flashy "supply chain attacks" that have shown up over the last decade are the exception not the rule, xz can happen to anyone, but probably xz isn't going to happen to *you*.