3 ms·
Oh wow, this is cool. I refuse to use npm because these issues keep cropping up and no solution gets implemented, but this looks good. I was just looking at an
by labrador 5y ago
Oh wow, this is cool. I refuse to use npm because these issues keep cropping up and no solution gets implemented, but this looks good. I was just looking at an interesting static site generator today until I saw it used nodejs and noped out of there.
In contrast, Powershell on Windows won't even let you use scriipts you've written yourself on your local hard drive unless you call them in a way the lets PS know you approve them. Scripts off the net have to be signed.
Methods of signing scripts
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_signing?view=powershell-7.2 https://docs.microsoft.com/en-us/powershell/module/microsoft...
- remram 5y agocrev is so neat, I have really been expecting npm/pypa/... to pick it up any day, for years. It solves those problems without taking power away from the package repository, and with minimal changes needed to the repository itself. With a spec already complete, I would expect an organization with the resources of npm could implement it in a few days, and I am really confused (and disappointed) that it is still not taking off. Signatures from the author doesn't solve much unfortunately. You would still need a mechanism to build trust (or review the script manually) and once you put that trust in the author, all that a cryptographic signature gets you is automatic trust in the next version... so the Faker attack slips through.