3 ms·
I agree that namespacing doesn't solve all the problems, but I do think it significantly reduces the attack surface. It is sort of like a checksum for a packag
by rogerbinns 4y ago
I agree that namespacing doesn't solve all the problems, but I do think it significantly reduces the attack surface. It is sort of like a checksum for a package, combining the publisher name with the package name instead of having just bare package names.
- woodruffw 4y agoAgreed! The problem is that the publisher's name isn't always clear: a lot of open source maintainers (myself included) publish major packages under their own name; a less familiar user could easily be confused into choosing the "official looking" name instead. I think the most "complete" solution here needs to involve code signing.