4 ms·
I think browsers show how to migrate away from insecure defaults successfully. The client software should start showing big obvious warnings. Later stages shoul
by SCHiM 8y ago
I think browsers show how to migrate away from insecure defaults successfully. The client software should start showing big obvious warnings. Later stages should add little inconveniences such as pop-ups and user acknowledgement prompts, eg. 'I understand that what I'm doing is dangerous, wait 5 seconds to continue'. The final stage should disable access to unsigned packages without major modifications to the default settings.
- raesene9 8y agoBrowser security has heavily benefited from the fact that ther are a small number of companies with control over the market and an incentive to improve security. Unfortunately the development world doesn't really have the same opporunities. If, for example, npm started to get strict about managing, curating, security libs, they could just move to a new package manager. Security features (e.g. package signing, package curation) have not been prioritised by developers, so they aren't widely provided.