3 ms·

> Do digitally signed certificates fit into this usage scenario?? No, because either the package author would have to sign them, in which case you have to choo

by zapt02 9y ago

> Do digitally signed certificates fit into this usage scenario?? No, because either the package author would have to sign them, in which case you have to choose to trust each package author, or the repository would sign them, in which case there would be no improvement for this current issue, since the repo would sign the fake packages as well.

kumarvvr 9y ago
Any way in which blockchain technology can be used? Like, the transaction becomes the act of the author uploading the code and the repo and user verify the transaction in some form?
- peterwwillis 9y ago
  Nope. You can't solve phishing with technological means. You have to curate either a whitelist or blacklist. The best way to handle this is whitelists of trusted package maintainers and/or code authors.
  - kumarvvr 9y ago
    Ohh ok. Thanks. Great to know.
  - zapt02 9y ago
    To be fair you can do a lot with simple heurestics. New package + large number of downloads || new package || new package author = show users a warning message before installing the package.
thehardsphere 9y ago
If you can't trust the package author at all then you shouldn't use their package.