My tin foil hat idea is for people to be suspicious about open source contributors. Not from countries or even one's who have seemingly never been met.
But from contributors who have no history and no footprint other then the project they're working on. That should be a red flag in the future.
But from contributors who have no history and no footprint other then the project they're working on. That should be a red flag in the future.