Sure. I wouldn't say a quiet record is proof that the code is free of vulnerabilities. It could be that nobody looked, or that the vendor is good at strong arming people into keeping quiet.
However, I would say that a record of lots of high severity vulnerabilities is evidence of poor code and/or design. If AI can actually produce that, it's more transparency, and good projects can really shine. Currently, projects that don't cram a ton of features are punished by the market. I'd be happy to see the market atart putting more value on reliability, security, and long term support.
Aa I said, when there's a lack of evidence, we just go on dependencies, complexity, and code smells. It's not nothing, but it's not proof either.
Dr. Hax
npub16v…meqha
2026-08-13 08:51:50 UTC
in reply to nevent1q…uutp
Author Public Key
npub16v82nr4xt62nlydtj0mtxr49r6enc5r0sl2f7cq2zwdw7q92j5gs8meqhaPublished at
2026-08-13 08:51:50 UTCEvent JSON
{
"id": "9db3c5cab03de4ca4bd087880a68281310d3b10fdbb4cd399b4762de544a80eb",
"pubkey": "d30ea98ea65e953f91ab93f6b30ea51eb33c506f87d49f600a139aef00aa9511",
"created_at": 1786611110,
"kind": 1,
"tags": [
[
"alt",
"A short note: Sure. I wouldn't say a quiet record is proof that ..."
],
[
"e",
"079a39dcbcf5105fd979ba598900365968248c3c6d08ba90604347a0d74c4539",
"wss://relay.ditto.pub/",
"root",
"d30ea98ea65e953f91ab93f6b30ea51eb33c506f87d49f600a139aef00aa9511"
],
[
"e",
"6c9589067a99edab61c3096d8a85e91fac5bfa90b409a72df81d3c97987ba0cc",
"wss://relay.damus.io/",
"reply",
"32637475ec0256fbd754571aeaa52c5454c9bd79fb7ac5b99f53b86cfcb9527a"
],
[
"p",
"d30ea98ea65e953f91ab93f6b30ea51eb33c506f87d49f600a139aef00aa9511",
"wss://nos.lol/"
],
[
"p",
"32637475ec0256fbd754571aeaa52c5454c9bd79fb7ac5b99f53b86cfcb9527a",
"wss://ditto.pub/relay"
]
],
"content": "Sure. I wouldn't say a quiet record is proof that the code is free of vulnerabilities. It could be that nobody looked, or that the vendor is good at strong arming people into keeping quiet.\n\nHowever, I would say that a record of lots of high severity vulnerabilities is evidence of poor code and/or design. If AI can actually produce that, it's more transparency, and good projects can really shine. Currently, projects that don't cram a ton of features are punished by the market. I'd be happy to see the market atart putting more value on reliability, security, and long term support.\n\nAa I said, when there's a lack of evidence, we just go on dependencies, complexity, and code smells. It's not nothing, but it's not proof either.",
"sig": "a04daf8f3e07ccebf2be5dec1cd08defecc8d06a61d634800f0128d0c674655421718428e2c5fa4fad509f199c2a854e57197a142de1466f415a5141ba7223f9"
}