> What if it contains copyright infringement, Government classified information, Child pornography, personal data, and all the data the law prohibit to distribu

> What if it contains copyright infringement, Government classified information, Child pornography, personal data, and all the data the law prohibit to distribute? I think content-addressing is a good solution to this problem: it separates the identification of a thing from the retrieval of a thing. In this example, software can depend on '<cryptohash>-left_pad-1.2.3', without having to know or care where that comes from (NPM, bittorrent, IPFS, sneakernet, etc.). Build tools can try to fetch these dependencies from a bunch of different sources, including caches on the local machine, on a company intranet, on well-known mirror services, etc. and verify that it got the correct file by matching the hash. A nice aspect of this is that it's resilient for things that people want to host (like left_pad, for example), but nobody is under any obligation to host everything. Mirrors are free to ignore/delete anything with illegal/malicious/spammy content.