RE: https://mastodon.social/@n0iroh/117127548266404487

I suppose whenever #rstats folk (me among them) complain about CRAN it's good to recall the upsides of their approach--that are famously cranky about what your package code is allowed to do without user permission and I have heard many complaints about the depth of inspection. I'm not sure I've heard of successful supply chain attacks via CRAN 🤔