4 ms·
You need ethereum (or some other blockchain) if you're concerned about hackers. You could imagine an attacker getting into npm's servers and replacing package l
by aakilfernandes 11y ago
You need ethereum (or some other blockchain) if you're concerned about hackers. You could imagine an attacker getting into npm's servers and replacing package links with malware.
You might also like a decentralized repo if you're worried about a single agent having a monopoly. This monopoly could one day charge for access to the repo.
- nikolay 11y agoThat's a total overkill for the purpose. We use signatures for authenticity checks. Let's not try to use Ethereum for everything just because we hold some ETH and want its value to grow by using it where it's not even necessary.
- williamcotton 11y agoDecentralized consensus over which private keys own what strings (aka Namecoin) would save us from having to deal with obtuse hashes, would it not?
- nikolay 11y agoOnce I install a package, its hashes and other info become part of the project. I just don't want that to change in time without me knowing. Etherum here is an overkill, it's not practical.
- williamcotton 11y agoHow do you first discover the hash? How are you looking it up?
- nikolay 11y agoThe recent issue with NPM surfaced the following two major issues: - a package got unpublished - we demand an immutable package manager; - packages got hijacked - we need authenticity as basic as checksums or signatures. Anything that accomplishes the above in an uncomplicated manner will win my business. Any craptocurrency pitching will not.
- WorldMaker 11y agogx seems to solve this with the concept of "repositories". From the gx README: > gx supports named packages via user configured repositories. A repository is simply an ipfs object whose links name package hashes. You can add a repository as either an ipns or ipfs path. It doesn't solve the repository "discovery" problem, but it does seem conceptually much simpler than trying to use a cryptocurrency-based solution.
- aakilfernandes 11y agoSo npm install --save $pkg $sig? Which means I have to look up the signature every time, and which point I might as well just install using the github repo. The fact that pretty much nobody uses that workflow today tells you something. If its the token that bothers you, run this off the main chain with the transaction cost set to 0. No ether necessary.
- nikolay 11y agoSorry, that's probably just me, but I don't wanna use anything that relies on Chinese mining operations!
- aakilfernandes 11y agoYou don't need miners at all, if you're not worried about censorship resistance. You can use Ethereum with a single validator. That means you don't need a token (ether) and you get instant transactions. Plus it prevents the hacker issue above.
- nikolay 11y agoHow a single validator any better than relying on, let's say, Keybase?
- aakilfernandes 11y agoNot sure how that would work, but I don't know much about Keybase.