> Never for a compiler, who even is that person?

Why do you care?

It's a stranger from the Internet. Same as with any other software you're using. In particular, same as with any OSS tool you're using.

> > Never for a compiler, who even is that person?

> Why do you care?

> It's a stranger from the Internet. Same as with any other software you're using. In particular, same as with any OSS tool you're using.

Don't you think that even if you don't know someone personally, you can calibrate your trust in their ability based on reputation, track record.

Yes. But we usually start with a high default, and only recalibrate if there's a specific reason in a given situation (e.g. there's been a specific user or sets of users involved in spreading malware, and software in question could've been targeted).

> you can calibrate your trust in their ability based on reputation, track record

rarely. How many of the libraries you pull from package managers do you actually know the authors of?