3 ms·
Then you're just shifting the responsibility of preventing squatting from NPM to GitHub or whoever hosts the Git repo in question. (I don't think GitHub perman
by comex 11y ago
Then you're just shifting the responsibility of preventing squatting from NPM to GitHub or whoever hosts the Git repo in question. (I don't think GitHub permanently reserves deleted usernames, though I could be wrong.) And if squatting does occur, there is nothing like npm's previous guarantee that replacement packages have a different version number. How is that better?
- kibwen 11y ago> I don't think GitHub permanently reserves deleted > usernames, though I could be wrong This doesn't actually matter, because Github allows you to rewrite your repo's history at will. Even if Github prevented you from deleting the repo itself, an irate maintainer looking to "liberate" their code could just delete the entire history of the repo and force-push to achieve the same effect.
- tombert 11y agoI actually tend to fork my dependencies to my own account.
- comex 11y agoYeah, I was being overly security minded and thinking only about the threat of someone taking the name and replacing the package with a malicious one, not the breakage caused by the package disappearing in the first place. In the former case, if the maintainer deletes their GitHub account, it matters whether someone else could register the same name. But of course you're right that Git repos are far more vulnerable to the latter too, unless you fork.