3 ms·
GitRoyalty just hosts a git remote repository that you pay to get access to. NPM and almost all other package managers support installing from git URLs, and too
by sdrzn 7y ago
GitRoyalty just hosts a git remote repository that you pay to get access to. NPM and almost all other package managers support installing from git URLs, and too many people rely on this functionality for it to ever be removed.
- wilt 7y agoMore thinking if you have to mess around with license files to get packages to work they will remove the package.
- imposterr 7y agoHow do you stop someone from forking the project on GitHub, adding in a manifest, and then pushing to a package repository like npm? Is there a risk of popular projects that are distributed through GitRoyalty having unofficial versions with malicious code on the package repositories, similar to now typo-squatting works?
- hnruss 7y agoThere are a few reasons to not rely on unofficial forks. The chance of malicious code is one. Also: unwanted changes, missing updates, maintenance confusion... These issues already exist in the world of open source, as you note, and the only way that I know of to stop it would be to have a more restrictive license (and to pursue any violations).
- rmc 7y agosocial pressure?