3 ms·
The author of event-stream on npm got so much flak for handing out the package when he couldn't maintain it anymore, yet I see no mention of any concerns here.
by ricardobeat 7y ago
The author of event-stream on npm got so much flak for handing out the package when he couldn't maintain it anymore, yet I see no mention of any concerns here. Aren't the same risks of malicious takeover present, or is the python module environment somehow safer?
- awithrow 7y agoIf I recall, the flak wasn't around handing off the package. The flack was for the lack of due diligence in picking a new maintainer. The same risks are present for sure but at least the process is taking place in the open.
- Master_Odin 7y agoYeah, it was this really. The author had largely abandoned the project, someone emailed him asking for it (who had no github presence whatsoever), and the author obliged. Here, there's in theory the effort that the people being given the project have been more vetted and have to have some amount of github presence to get a repo.
- cfors 7y agoThis is actually a much more responsible way to go about it than the event-stream issue, since it is being done in a public forum (Github issues). Event-stream was given away over an Email without an announcement [0]. Of course, the risks are still there for malicious takeover, but I think will be minimized due to the owner's notoriety and the amount of press this has already seen just on GitHub. I am pretty sure the maintainers of Pip will be keeping an eye on this over the next few months in case of intervening. [0] https://github.com/dominictarr/event-stream/issues/116#issuecomment-440927400 https://github.com/dominictarr/event-stream/issues/116#issue...