Comment by edejong

11 years ago

Personally, it's not about the 'original' developer pulling out, but about the simple question: who or what do you trust?

1. The developer, 2. The content distributor, 3. The code (by git SHA ref perhaps), 4. The contract of the code (using formal verification), 5. The legal contract with the code supplier.

And if you trust 1, do you expect of him to sign the stable releases using GPG tags?

All the focus on OSS nowadays seems to be on 1, but as professional engineers, shouldn't we focus more on 4 and 5?

0 comments

edejong

Reply