4 ms·
Or don’t have a system? What if you installed stuff via a git (not necessarily github) url/tag? Puts the onus on users to verify. Use checksums to avoid upstrea
by quickthrower2 3y ago
Or don’t have a system? What if you installed stuff via a git (not necessarily github) url/tag? Puts the onus on users to verify. Use checksums to avoid upstream changes you didn’t explicitly accept. No different than cloning a repo from a risk perspective (just as risky but no more so). This removes any implicit seal of approval. Companies like malwarebytes could monitor and maintain blacklists or whitelists. Sign up to multiple lists if paranoid.
- thayne 3y agoThat's how go does it, and it has some drawbacks: Things break if the git url changes, which is more likely than the package name changing. It complicates using a fork, or local version of a package. Having the url once in a package manifest instead of repeated in every file that importa,like go dows, would probably help. It can make discovering the package you need more difficult.
- aunderscored 3y agoGo has vanity URLs for the first, and go module files have replace statements to redirect imports to other names or local directories.
- thayne 3y ago> Go has vanity URLs for the first In theory, maybe. In practice, I haven't seen vanity urls used very much in go projects, and for it to completely solve the problem you need to use the vanity url from the very beginning and you can't ever change the vanity url. It also requires you to have your own domain.