5 ms·
One would think you would do more than send an email if you're trying to verify. Websites, Twitter, Github, Keybase, etc.. It would be pretty hard for a bad a
by sbarre 9y ago
One would think you would do more than send an email if you're trying to verify.
Websites, Twitter, Github, Keybase, etc..
It would be pretty hard for a bad actor to overtake the real author's entire Google-findable presence (assuming it's a reasonably popular package - why would you typosquat anything obscure).
If all you do is send an email, then you haven't really done "due diligence" in any acceptable form.
- Ajedi32 9y agoWhat if the attacker instead advertises `some-totally-different-person@gmail.com`? How are you even supposed to know who wrote the legitimate version of the package in the first place? And if you _do_ know who wrote the package, you don't need a GPG key to verify that; just their NPM username or even the actual, real package name will do fine for preventing this specific attack.
- am1988 9y agoShould I book a plane ticket to go verify 2 pieces of photo ID in person? This idea that everyone will just verify with the author is insane.