4 ms·
URL imports is a terrible idea. There's a reason we have actually package managers and repositories instead of installing from GitHub. Properly made and run pa
by pitaj 8y ago
URL imports is a terrible idea. There's a reason we have actually package managers and repositories instead of installing from GitHub.
Properly made and run package managers are more secure and offer a better developer experience than importing by URL.
- ricardobeat 8y agoWhich package managers are properly made, and how are they more secure? As far as I'm aware npm's security model is shared with almost all of them.
- erik_seaberg 8y agoRPM and .deb packages have GPG signatures and lists of trusted maintainers. NPM doesn't have that; https://medium.com/redpoint/introducing-pkgsign-package-signing-and-verification-for-npm-5b833e0ec2d4 https://medium.com/redpoint/introducing-pkgsign-package-sign... looks like a very early start on a big project that could fix this if it catches on.
- eptcyka 8y agoCargo is far better in this regard, for one.
- Arnavion 8y agoCargo packages can also execute arbitrary code at compile-time through build scripts, which run with full permissions of the original `cargo` command including filesystem and network access.
- msoad 8y ago> package managers are more secure How?