Comment on Do you actually audit open source projects you download?