4 ms·
A few more of these and we'll all ditch package managers in favor of plain git repos. Commit SHAs inherently guarantee content integrity.
by vemv 8y ago
A few more of these and we'll all ditch package managers in favor of plain git repos. Commit SHAs inherently guarantee content integrity.
- daxelrod 8y agoCan you elaborate on how you see this as an integrity problem? A new malicious version was released; at no point did the attackers represent their new release as the same code as the previous release.
- vemv 8y agoWhen you "git all the things", upgrading a dependency can equal a `git diff`. Upgrades become reviewable. I envision a future where organisations routinely review upgrades.