6 ms·
Sadly, 2FA won't help against malicious developer or a developer selling package to a malicious owner. Maybe ther should be a paid service that would manually
by codedokode 4y ago
Sadly, 2FA won't help against malicious developer or a developer selling package to a malicious owner.
Maybe ther should be a paid service that would manually review packages and provide a curated repository? I can't see other solutions. Either you review the code or you pay someone to do it or you isolate every library into a sandbox.
- doliveira 4y agoAt the very least Maven-style DNS-based namespaces would be quite welcome... Then these authentication schemes or even "reputation" becomes DNS based which is much easier to do. Instead of having this random cutoff of popularity. I don't really get why all these package managers don't copy this from the Java world.