4 ms·
Right, but suppose I depend on the org.example.foo package today, and next month someone else buys the example.org domain specifically so that they can insert t
by db48x 4y ago
Right, but suppose I depend on the org.example.foo package today, and next month someone else buys the example.org domain specifically so that they can insert their malicious code into the foo package?
Domain names simply do not eliminate supply–chain problems, they only make your packaging system dependent on DNS.
- oblio 4y agoThat's still a lot harder and more visible than just taking over an orphaned package or many of the other attacks we see in these other ecosystems. Especially since DNS gives you real visibility into ownership when auditing/selecting packages. org.apache is a lot more trustworthy than tk.helicopter.