The trend of anonymous bots sending mass contributions to Open Source repositories is guaranteed to lead to reputation farming followed by malicious contributions

[galdor@fosstodon.org]

The trend of anonymous bots sending mass contributions to Open Source repositories is guaranteed to lead to reputation farming followed by malicious contributions.
Either we'll move to a signed system to verify human contributors (GPG style) or the OSS ecosystem is cooked.

[craigbro@infosec.exchange]

@galdor i think we’ll see more communities practice formal participation requirements and ceremonies like Debian does for its maintainers.