3 ms·
Enforcing publishing through source control only is a huge step forward. The current NPM process of allowing anyone with write access to publish a package at wi
by aphextron 7y ago
Enforcing publishing through source control
only is a huge step forward. The current NPM process of allowing anyone with write access to publish a package at will is really insecure. I think that's the most exciting thing I've seen about Pika that NPM lacks.
- icebraining 7y agoWon't this allow anyone with write access to the source code repository to publish a package? Seems just one extra layer of indirection.
- edoceo 7y agoYes, but now only one place to get rekt - the source which (presumably) has tighter ACL than the package manager? The old way had risk at two steps and now it's reduced 50%
- icebraining 7y agoOn the contrary; repositories usually involve many people pushing to them, whereas a package release could be handled by just one person (with maybe one or two for backup). Plus, what about package signing? If the released version comes directly from the repo, does that mean the final package isn't signed by a maintainer?
- pvorb 7y agoSince most source code will be maintained via Git, there's almost no security at all, since you can easily rewrite Git history.
- leipert 7y agoWell. Depends, if your package Version links to a commit hash, you should be rather secure. One could delete it but not overwrite it as easily.
- icebraining 7y agoOne could presumably push a new version, linked to a commit that contained (directly or as an ascendant) some malicious code.