3 ms·
Have been seeing these rants since the incident. Yet no concrete suggestions. Just high level hand wavy stuff like "better package management". What does that m
by bilater 1y ago
Have been seeing these rants since the incident. Yet no concrete suggestions. Just high level hand wavy stuff like "better package management". What does that mean? We already have mandatory 2 factor, private npm registries.
Ultimately the reason the ecosystem is so fragile is because a ton of packages are maintained by solo devs. So it only takes one hack to impact a ton of code bases.
The only thing I can think of to prevent this is automated LLM scanning of every npm package when any dependency or subdependency (and that's its own gnarly tree) is updated.
- rectang 1y ago> Yet no concrete suggestions. There are a bunch of concrete suggestions in the article: "By introducing universal signatures for packages of executable code, smaller channels and webs of trust, reproducible builds, and the many other straightforward, obvious techniques used by responsible package managers." I'm as pessimistic as the author, though, about how those suggestions will be received.
- deleted 1y ago[deleted]