2 ms·
Java enforces domain name ownership as well; I can’t publish to maven central under io.netty. This removes a whole slew of attack surfaces that JS and Python h
by jakewins 4y ago
Java enforces domain name ownership as well; I can’t publish to maven central under io.netty.
This removes a whole slew of attack surfaces that JS and Python have, and leverages an existing “prove you are who you say you are” infra
- tsimionescu 4y agoNote that Maven Central only imposes this once when creating a new artifact - which is, I believe, much better than Go, which imposes this for every go mod download. The advantage being, if you later lose access to the DNS domain that you used to publish an artifact to Maven Central, the new owner doesn't automatically get to compromise your artifact for all (new) users.