3 ms·

A large part of npm's staggering success is the very low friction to publish packages. I worry that any mitigation that slows down the publishing side of things

by okhobb 5y ago

A large part of npm's staggering success is the very low friction to publish packages. I worry that any mitigation that slows down the publishing side of things would kill innovation in the ecosystem.

8organicbits 5y ago
I imagined an optional delay for npm install/update. That way it would only slow down users who wanted more time.
- alienalp 5y ago
  It makes so much sense, surprised me that it doesn't exist.
- okhobb 5y ago
  Got it. Yea I agree that's useful and easy mitigation, and I'm sure enterprise users would certainly pay for other safety labeling/filtering/signing of packages.
deleted 5y ago
[deleted]