Aug 21, 2026, 9:28 PMbig foss: "to avoid supply chain risk and backdoors, contributors must now verify their identity"
also big foss: "we are pleased to announce that claude is now contributing to the repo!" :neocat_think_woozy:
- Aug 21, 2026, 9:28 PM
Replies
Ozzelot :ai_free:ozzelot@mstdn.socialAug 21, 2026, 9:32 PM@psf big foss: "thank you meta, now we can have slightly less hallucinations in the supply chain"
Irenes (many)ireneista@irenes.spaceAug 21, 2026, 9:45 PM@psf yeah not gonna lie, we refuse to contribute to any package repo that requires a legal name. just flat out refuse.
- Irenes (many)ireneista@irenes.spaceAug 21, 2026, 9:46 PM
@psf sorry, that was ambiguous. we mean we won't contribute to ecosystem-specific package sets such as crates.io, npm, pypi, etc
Emelia/Emibecomethewaifu@tech.lgbtAug 21, 2026, 9:58 PM@ireneista @psf Yep. I'd trust a cryptography package written by a well-established persona going by SparkleButts69 with a profile picture of an anthropomorphic cat more than I'd trust anything written by someone pushing for "identity verification to publish code"
In other words, "maybe the prior friction (before these package managers) around importing a random library you found on the internet was good, actually?"
- Irenes (many)ireneista@irenes.spaceAug 21, 2026, 10:01 PM
@becomethewaifu @psf definitely same on all counts
- Irenes (many)ireneista@irenes.spaceAug 21, 2026, 10:02 PM
@becomethewaifu @psf also we want to see their sparkly-butt avatar and are sad they're not real