4 ms·
Hopefully something along these lines will also be added to Gitab. I share your concerns, but I've also long had the feeling that both NPM and Maven are a secu
by yarg 7y ago
Hopefully something along these lines will also be added to Gitab.
I share your concerns, but I've also long had the feeling that both NPM and Maven are a security disaster in the making.
Having the dependencies being published from the same place that stores the actual code, gives me a little hope that things will improve from the security and design perspective.
- gritzko 7y ago...by adding a single point of failure?
- yarg 7y agoNo, my thoughts are that we need better mechanisms to validate our dependencies. So far I believe that Maven and NPM have failed to deliver on that front. The dependencies being resolved from the code store provides a decent mechanism to resolve that issue. But as long as it's being done on closed software, it's going to be hard to move towards a standard.