Publish date has nothing to do with commit timestamps
Look, all I’m saying is, normal cybersecurity rules still apply. Don’t go running off to download and run code that’s hot off the press, with no track record, no established user base, developed by a rando who is visibly moving at a breakneck pace. Especially with any category of software that’s notoriously difficult to secure.
I’m saying that they might’ve just made a fresh repo and didn’t carry over commits they did locally while fleshing it out. I’ve done that plenty of times before. And sure, it’s a good idea not to rely on fresh off the press projects, but I never suggested otherwise here. I just thought the project was worth a look.
That’s not a lot of time for the developer or anyone else to review, test, or audit the code.
the assumption being that all the work was done after the repo was published
?
Publish date has nothing to do with commit timestamps
Look, all I’m saying is, normal cybersecurity rules still apply. Don’t go running off to download and run code that’s hot off the press, with no track record, no established user base, developed by a rando who is visibly moving at a breakneck pace. Especially with any category of software that’s notoriously difficult to secure.
I’m saying that they might’ve just made a fresh repo and didn’t carry over commits they did locally while fleshing it out. I’ve done that plenty of times before. And sure, it’s a good idea not to rely on fresh off the press projects, but I never suggested otherwise here. I just thought the project was worth a look.