Isn’t it a bit ironic with how much code everyone depends on that can freely be altered by some unknown party, while so much time goes into code reviews to verify internal changes at most companies.
you can have ten comments about the name of a variable, but no one bats an eye at a new npm package introduced. Also, devs that wrote code that Google depends on can't pass the leetcode gate check to get a job there.
Presumably because they're one of the two maintainers: https://web.archive.org/web/20240329182607/https://xz.tukaan...
He had unfettered access to xz’s git?
Isn’t it a bit ironic with how much code everyone depends on that can freely be altered by some unknown party, while so much time goes into code reviews to verify internal changes at most companies.
you can have ten comments about the name of a variable, but no one bats an eye at a new npm package introduced. Also, devs that wrote code that Google depends on can't pass the leetcode gate check to get a job there.
Our industry is a laughingstock.
6 replies →
>while so much time goes into code reviews to verify internal changes at most companies
Maybe at FAANGs, but I work at a massive company and code review is non-existent.
1 reply →
Some might say RMS was right all along.
4 replies →
> while so much time goes into code reviews to verify internal changes at most companies
Very easy claim to make. Difficult to verify.
1 reply →
And he was in the project for just 2 years.
Only on Github. Not on the Tukaani mirror.
Because nobody’s really paying attention.
“LGTM!”
Generally yes, but ripping all conditions out of SECURITY.md should at least raise an eyebrow?
Nobody was watching. Plain and simple.
If you have commit access to it, and nobody is there to see, nothing stops you.
5 replies →