4 ms·

Daily reminder that no one can easily impersonate you if you sign your commits and make it easy to discover and verify your authentic key with keyoxide or simil

• junon 1y ago
  This wasn't a repository takeover. I do sign my commits.
  • lrvick 1y ago
    Fair. I should have expanded. If everyone signed commits with well published keys, -and- if NPM would stop rejecting every PR and feature request for clients to verify signatures from authors that opt in, this problem would not exist for packages from those authors. Unfortunately the official position of NPM since 2013 is that hashes solve the same security problem as signatures and that the signatures might make non signing package authors second class citizens. So no security for anyone, to avoid scaring off lazy maintainers. https://github.com/npm/npm/pull/4016 https://github.com/npm/npm/pull/4016