3 ms·

> Basically if you have an environment where a bad actor has to pay money, steal someone's identity, and takes awhile before they can even verify their attack h

> Basically if you have an environment where a bad actor has to pay money, steal someone's identity, and takes awhile before they can even verify their attack has been successful - you'll cover a huge chunk of the attack surface area. If you have an environment where a good actor has to pay money, provide their passport name with proof of identity, and has to put up with artificial deployment delays, I think you'll miss out on a huge chunk of good actors. I'm not convinced that it's possible to outsource your trust and audit decisions to some third-party system. We should be scaling at the speed of actual human trust, not giving up our privacy to companies or our security to randos.

unlinked_dll 7y ago
There's plenty of places/ways to distribute software anonymously. And depending on software from an anonymous identity with no trust that the registry verified who they were or if subsequent publications came from the same entity is an attack vector. There is a time and place for anonymity, but I don't think a dependency registry is one of them (most of the time). And I think if you're going to make a new registry, such verification is a way to make yourself different.
- icebraining 7y ago
  > if subsequent publications came from the same entity The way you do that is by having signed packages. Gov IDs don't help with that, unless the registry verified the ID every time you published an update, which is impractical (unless you have a smart ID card, but most governments don't issue those).
omgtehlion 7y ago
I would add: and bad actors would not be stopped by this, it is easy (and cheap) nowadays to buy identity with document scans enough to pass verification in payment systems. I doubt that any package registry could implement more stringent checks. And a fee is just a small bump in the way of bad actors that would like to monetize their misdeeds.

unlinked_dll 7y ago

There's plenty of places/ways to distribute software anonymously. And depending on software from an anonymous identity with no trust that the registry verified who they were or if subsequent publications came from the same entity is an attack vector. There is a time and place for anonymity, but I don't think a dependency registry is one of them (most of the time). And I think if you're going to make a new registry, such verification is a way to make yourself different.

icebraining 7y ago
> if subsequent publications came from the same entity The way you do that is by having signed packages. Gov IDs don't help with that, unless the registry verified the ID every time you published an update, which is impractical (unless you have a smart ID card, but most governments don't issue those).

omgtehlion 7y ago

I would add: and bad actors would not be stopped by this, it is easy (and cheap) nowadays to buy identity with document scans enough to pass verification in payment systems. I doubt that any package registry could implement more stringent checks. And a fee is just a small bump in the way of bad actors that would like to monetize their misdeeds.