2 ms·
This must be the fifth incident that could have been readily prevented if npm simply required signing for it's packages. Just do the same thing we have for SSH
by stefan_ 8y ago
This must be the fifth incident that could have been readily prevented if npm simply required signing for it's packages.
Just do the same thing we have for SSH: on first connection (installation), ask if you trust the other side. That goes into your authorized_keys (lock file). If you connect again (update) and the key changed, print a big scary warning. No blockchain needed.
- yuchi 8y agoThis was, from the eyes of npm Inc. and everyone else a completely legitimate ownership transfer. There was a "human error" (Domenic trusting the wrong person) that was completely unpreventable by technological means. There was no hijacking involved.
- stefan_ 8y agoThere is also never hijacking involved when the SSH key of my server changes, but that doesn't mean I trust SSH Inc. to verify that for me.
- yuchi 8y agoIn your metaphor this would be not one of your servers, but a customer’s one. Then the customer says: «oh yes, we changed the keys, it’s all ok».