From 82186a35b202253c0648e7e834dc94d42ce1273f Mon Sep 17 00:00:00 2001 From: himazawa <73994521+himazawa@users.noreply.github.com> Date: Sat, 30 Mar 2024 22:48:38 +0100 Subject: [PATCH] chore: fixed style --- content/posts/xz-backdoor/index.en.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/posts/xz-backdoor/index.en.md b/content/posts/xz-backdoor/index.en.md index 4cdf871..fb02682 100644 --- a/content/posts/xz-backdoor/index.en.md +++ b/content/posts/xz-backdoor/index.en.md @@ -128,7 +128,9 @@ A large and active community can provide additional eyes for reviewing code, rep Consider whether the project receives financial support or sponsorship from reputable organizations. Projects with dedicated funding tend to have more resources available for security audits and ongoing maintenance. And also are less likely to be completely abandoned. +{{< admonition type=tip title="Tip" open=true >}} Remember: you want to rely on that dependency for the whole week, not only during the maintainer's freetime, projects with a nice financial support will likely be full-time jobs and not just hobbies. +{{< /admonition >}} ### SDLC A good portion of the evaluation should also focus on the SDLC to e ensure security (and quality in general) gates are correcly implemented, approvals on PRs are mandatory and there are healthy practices in place to prevent one single contributor to push malicious code without approval.