3 ms·
But torrent has built in integrity checking. You should still check signatures on packages. Your distribution and storage media should be totally independent of
by ses1984 8y ago
But torrent has built in integrity checking. You should still check signatures on packages. Your distribution and storage media should be totally independent of the packages you choose to use and how you validate them.
- JMTQp8lwXL 8y agoI think the idea is that enterprises would still prefer to offload that responsibility to a third-party provider. I agree with what you're saying, from a risk management perspective, you shouldn't be trusting that your dev's will be pulling in safe third party code (e.g., from the NPM public registry) instead of forcing them to go through your dependency gateway (e.g., artifactory). Under the hood, a tool like Artifactory could take advantage of this means of distribution, be responsible for signature checking, etc.
- baroffoos 8y agoI didn't think anyone was suggesting to pull random stuff out of a p2p network but instead that you build your docker image and then use p2p to share it to thousands of servers. There are no trust issues here because you are the creator of the data being downloaded.