Of course you have to be able to trust that some post you find (which names a real person doing work in the field) really comes from that person and is not simply stealing their authority.

My point wasn't that this specific case is like that, but rather that online spaces are bombarded with claims that take far less effort to generate than it takes to verify or debunk. And once some story is seen by enough eyeballs, no withdrawal or retraction is going to have the same reach (bad actors already know this).

It's a finder's fee, a very old and ordinary concept in business. The more sales you can bring to a company (or could divert to competitors), the more skin in the game you have. That's not to say I think these companies aren't in some ways anticompetitive to the detriment of merchants and DIY shoppers.

You took a cursory glance at a CV on a website and decided that was probably good enough to keep suspicion at bay, this time. But digging more and more to build up trust requires more time and effort than a bad actor trying to advance an agenda would need to put in; It is asymmetric.

For at least the past 5 years, Amazon.com has been completely flooded with throwaway brand names churned out from random sequences of characters selling white-labelled products. The ones that do poorly get discarded and replaced, and the ones that find traction get to climb the rankings.

Do you think the same doesn't apply to "authors" of books, social media posts, and even academic papers in 2026? It doesn't matter if someone's staked their reputation unless their reputation is already widely known and trusted to begin with.

Maybe your calculus could hold if Chainguard's registry were the primary distribution mechanism for PHP in use worldwide (such that the benefit of an updated image would at least be widespread compared to the sitting ducks relying on the other repositories), but it isn't.

What you're saying is it's the ideal kind of application for not obsessing over its background resource consumption, given that it's only going to be running for 10 minutes once or twice a year.