4 ms·
Yeah I'm not really following how users desiring a natural-language tuple-looking thing prevents proper identity verification. Even without namespacing strong i
by tomc1985 9y ago
Yeah I'm not really following how users desiring a natural-language tuple-looking thing prevents proper identity verification. Even without namespacing strong identity controls (signature verification and preventing unauthorized accounts from posting under a taken name, for example) can prevent most attacks short of typosquatting.
- stupidcar 9y agoTyposquatting is exactly what these malicious packages were doing. So you're agreeing that arguments re. identify verification is a useless distraction in this case?
- KirinDave 9y agoYou seem to have a handle on every aspect of this situation except what the actual attack we're discussing was. It was typo squatting.
- tomc1985 9y agoAnd you like to assume things. Name canonicalization gets you part of the way there. But unless you want to go full-on namespacing then you must realize you are fighting a pointless battle. You cannot reasonably expect to save users from themselves in every way.
- KirinDave 9y agoNpm has namespacing.