3 ms·

At the moment, the only packages being distributed are hand-coded into the repository feed. If/when it comes to blindly distributing users code, security measur

At the moment, the only packages being distributed are hand-coded into the repository feed. If/when it comes to blindly distributing users code, security measures would be implemented.

erjtajrtwjwr 5y ago
You're blindly relying on transport security currently, and that's unacceptable even when distributing your own code. Integrity verification of distributed packages (ideally cryptographically) is a core and required feature of a package manager. At an absolute bare minimum you need a Lockfile style mechanism to allow users to ensure two installs are the same.
- joshburnsxyz 5y ago
  I 100% agree with you, but as i've stated a couple times here now. Once i've got the base of the system solid and working I will then implement proper security measures on-top of that. If you want to jump on-board and help out that'd be great! If you've already got an idea of how all this works then i'd be more than happy to use your expertise to make this project better. After all I am only one person so any help is welcome.
  - smaudet 5y ago
    "Once i've got the base of the system solid and working I will then implement proper security measures on-top of that." I understand your sentiment, but it's wrong. You need to take into account your userbase, potential or otherwise. There are those which will be overzealous and not concerned about security and will use your stuff anyways, then there are those people who find themselves compelled (against their will) to use it, secure or otherwise. Because this software strongly facilitates the later group, releasing it in this fashion represents a security risk and is unethical, wrong, even. Just because you can manufacture a bomb does not mean you should, not should you be distributing bomb making kits. Also, perhaps your time would be better spent building this functionality into existing package managers, rather than this one? There are certainly enough package managers out there, I'm not convinced this is even a good idea.

At the moment, the only packages being distributed are hand-coded into the repository feed. If/when it comes to blindly distributing users code, security measures would be implemented.

erjtajrtwjwr 5y ago

You're blindly relying on transport security currently, and that's unacceptable even when distributing your own code. Integrity verification of distributed packages (ideally cryptographically) is a core and required feature of a package manager. At an absolute bare minimum you need a Lockfile style mechanism to allow users to ensure two installs are the same.

joshburnsxyz 5y ago
I 100% agree with you, but as i've stated a couple times here now. Once i've got the base of the system solid and working I will then implement proper security measures on-top of that. If you want to jump on-board and help out that'd be great! If you've already got an idea of how all this works then i'd be more than happy to use your expertise to make this project better. After all I am only one person so any help is welcome.
- smaudet 5y ago
  "Once i've got the base of the system solid and working I will then implement proper security measures on-top of that." I understand your sentiment, but it's wrong. You need to take into account your userbase, potential or otherwise. There are those which will be overzealous and not concerned about security and will use your stuff anyways, then there are those people who find themselves compelled (against their will) to use it, secure or otherwise. Because this software strongly facilitates the later group, releasing it in this fashion represents a security risk and is unethical, wrong, even. Just because you can manufacture a bomb does not mean you should, not should you be distributing bomb making kits. Also, perhaps your time would be better spent building this functionality into existing package managers, rather than this one? There are certainly enough package managers out there, I'm not convinced this is even a good idea.