On: Social engineering takeovers of open source projec...

[guappa]

The scorecard stuff is flawed.

You want to decide if something is secure or insecure but without reading the code. It's never going to have any correlation.