[inglor]

Just wanted to say thanks for your work!

As an OSS maintainer (Node.js and a bunch of popular JS libs with millions of weekly downloads) - I feel how _tempting_ it is to trust people and assume good faith. Often since people took the time to contribute you want to be "on their side" and help them "make it".

Identifying and then standing up to bad-faith actors is extremely important and thankless work. Especially ones that apparently seem to think it's fine to experiment on humans without consent.

So thanks. Keep it up.

[emteycz]

How could resilience be verified after asking for consent?

[PixyMisa]

Tell someone upstream - in this case Greg KH - what you want to do and agree on a protocol. Inform him of each patch you submit. He's then the backstop against anything in the experiment actually causing harm.

[kemotep]

Same way an employer trains employees on phishing campaigns or an auditor or penetration tester tests resilience or compliance.

[emteycz]

Yes, employers often send out fake phishing e-mails to test resilience and organizational penetration testing is done on the field with unsuspecting people.

[iR5ugfXGAE]

Ah. I never replied to the e-mails sent out by my employer about registering for a training in phishing detection. I just assumed those e-mails were phishing e-mails.

[thaeli]

I assume that so many official emails from my employer are phishing.. it's a mess.

[gjack905]

This read as sarcastic to me but FYI what you said is actually, unironically, true