5 ms·

> I thought a lot about it, and it seems as secure as node_modules, because anybody can publish to npm anyway npm installs aren't the same as installing from a

> I thought a lot about it, and it seems as secure as node_modules, because anybody can publish to npm anyway npm installs aren't the same as installing from a random URL, because: * NPM (the org) guarantees that published versions of packages are immutable, and will never change in future. This is definitely not true for a random URL. * NPM (the tool) stores a hash of the package in your package-lock.json, and installing via `npm ci` (which enforces the lockfile and never updates it in any case) guarantees that the package you get matches that hash. Downloading from a random URL can return anything, at the whims of the owner, or anybody else who can successfully mitm your traffic. Installing a package via npm is the same only the very first time you ever install it. Once you've done that, and you're happy that the version you're using is safe, you have clear guarantees on future behaviour.

Vinnl 6y ago
My assumption would be that new men in the middle will arise, but this time, you can pick which one to use.
- ecares 6y ago
  btw: https://github.com/denoland/deno/issues/1063 https://github.com/denoland/deno/issues/1063 they know there is a bad mitm vector and won't fix it
reaktivo 6y ago
This is why I think a content addressable store like IPFS would shine working with Deno
- pimterry 6y ago
  That solves this specific problem nicely, although AFAIK IPFS doesn't guarantee long-term availability of any content, right? If you depend on a package version that's not sufficiently popular, it could disappear, and then you're in major trouble. It'd be interesting to look at ways to mitigate that by requiring anybody using a package version to rehost it for others (since they have a copy locally anyway, by definition). But then you're talking about some kind of IPFS server built into your package manager, which now needs to be always running, and this starts to get seriously complicated & practically challenging...

Vinnl 6y ago

My assumption would be that new men in the middle will arise, but this time, you can pick which one to use.

ecares 6y ago
btw: https://github.com/denoland/deno/issues/1063 https://github.com/denoland/deno/issues/1063 they know there is a bad mitm vector and won't fix it

reaktivo 6y ago

This is why I think a content addressable store like IPFS would shine working with Deno

pimterry 6y ago
That solves this specific problem nicely, although AFAIK IPFS doesn't guarantee long-term availability of any content, right? If you depend on a package version that's not sufficiently popular, it could disappear, and then you're in major trouble. It'd be interesting to look at ways to mitigate that by requiring anybody using a package version to rehost it for others (since they have a copy locally anyway, by definition). But then you're talking about some kind of IPFS server built into your package manager, which now needs to be always running, and this starts to get seriously complicated & practically challenging...