4 ms·
I think package managers such as npm should require package maintainers to sign a legally binding agreement that they're not going to willfully do stuff like th
by 29athrowaway 5y ago
I think package managers such as npm should require package maintainers to sign a legally binding agreement that they're not going to willfully do stuff like this.
There's no other way.
Why? because determining if a package is malicious via static analysis or other automatic means would be the equivalent of creating a solution for the halting problem.
- greyface- 5y agoWhat consideration, if any, should package maintainers receive in return for legally binding themselves in this way?
- 29athrowaway 5y agoThe publication of their package.
- throw_m239339 5y ago> The publication of their package. AKA peanuts.
- arvinsim 5y ago> I think package managers such as npm should require package maintainers to sign a legally binding agreement that they're not going to willfully do stuff like this. I would think this would discourage a lot of people to contribute to NPM. It's not about enforcement but the threat.
- 29athrowaway 5y agoSure but you cannot build something serious without guarantees. Maybe you can set a flag in your package.json which enables only the usage of packages from authors that have agreed.