4 ms·
Once I install a package, its hashes and other info become part of the project. I just don't want that to change in time without me knowing. Etherum here is an
by nikolay 11y ago
Once I install a package, its hashes and other info become part of the project. I just don't want that to change in time without me knowing. Etherum here is an overkill, it's not practical.
- williamcotton 11y agoHow do you first discover the hash? How are you looking it up?
- nikolay 11y agoThe recent issue with NPM surfaced the following two major issues: - a package got unpublished - we demand an immutable package manager; - packages got hijacked - we need authenticity as basic as checksums or signatures. Anything that accomplishes the above in an uncomplicated manner will win my business. Any craptocurrency pitching will not.