4 ms·

> That's just plain irresponsible. He must have known how popular the library was. Taking ownership of browser extensions and common software libraries is becom

> That's just plain irresponsible. He must have known how popular the library was. Taking ownership of browser extensions and common software libraries is becoming a very popular attack vector. Owners of these need to be a little more diligent when transferring ownership. I'm sure he would do it for $150k/year. He won't do it for $150k/year? Increase the price until he says "Yeah, sure I will maintain it". Or maybe he will find someone else would would maintain it for that money.

michaelmrose 8y ago
How about just not transfer ownership of the original name. Let foo become foo-new or go from john/foo to bob/foo whichever is appropriate thus ensuring that only those who affirmatively added bob/foo or foo-new are ever effected. Vetting new maintainers sounds like hard work that you might not feel like doing for free no problem just don't do it and don't give them the damn name.
- bigmanwalter 8y ago
  That's fundamentally not how identification on the Internet works. You are whoever you say you are. It's absurd to tie identity to a physical person.
  - michaelmrose 8y ago
    You are incorrect you are who you can prove who you are. I can prove any of a number of identities scattered around the internet most of which are in fact my real name. Pretending that this is trust less is just not real. Example I know from a wide variety of sources that certain projects are trustworthy even if I can only verify a pseudonym that itself is trustworthy and infer that authors other projects are trustworthy. Accounts emails and domains are all useful tools even if not perfect. People don't normally put years into developing trust in order to distribute malware. It's normally a low effort affair. Not giving maintainership to random people who send you an email or selling projects to skeevy companies seems like a good way to avoid 80% of issues kind of like washing your hands can prevent a lot of colds.

michaelmrose 8y ago

How about just not transfer ownership of the original name. Let foo become foo-new or go from john/foo to bob/foo whichever is appropriate thus ensuring that only those who affirmatively added bob/foo or foo-new are ever effected. Vetting new maintainers sounds like hard work that you might not feel like doing for free no problem just don't do it and don't give them the damn name.

bigmanwalter 8y ago
That's fundamentally not how identification on the Internet works. You are whoever you say you are. It's absurd to tie identity to a physical person.
- michaelmrose 8y ago
  You are incorrect you are who you can prove who you are. I can prove any of a number of identities scattered around the internet most of which are in fact my real name. Pretending that this is trust less is just not real. Example I know from a wide variety of sources that certain projects are trustworthy even if I can only verify a pseudonym that itself is trustworthy and infer that authors other projects are trustworthy. Accounts emails and domains are all useful tools even if not perfect. People don't normally put years into developing trust in order to distribute malware. It's normally a low effort affair. Not giving maintainership to random people who send you an email or selling projects to skeevy companies seems like a good way to avoid 80% of issues kind of like washing your hands can prevent a lot of colds.