just an amazing joke and reference right there 👏

My first advice to junior contributors is to STOP using vibe coding for PRs. OSS is always about people more than about code. We don't need more code generated by LLM, we need more people who care.

so they can sneak up on people better??

totally agree! most test frameworks/runners don’t tho :-( and jsdom doesn’t count

attackers have payloads ready to go. No tokens are short-lived enough to actually matter afaict.

👋

there is no indication I’ve seen that the life of any of the tokens listed was relevant in any of the incidents.

this is all in an npm context, and an artifact for npm is the tarball produced by npm pack.

have it make an artifact, and download and publish that locally

normal 2FA with local publish is the closest tho :-)

wow, i would have thought it was closer to 90%

that is a fair way to reframe it :-)

setting aside your take, I’d assume braille would be the blind analogy to eye reading?