3 ms·
IIUC the recent high-profile npm backdoors were mostly detected by supply-chain-security firms that ingest all package updates from the registry and look for su
by ameliaquining 8mo ago
IIUC the recent high-profile npm backdoors were mostly detected by supply-chain-security firms that ingest all package updates from the registry and look for suspicious code using automated or semi-automated analysis. Dependency cooldowns work great with this kind of thing. I agree that, if malicious packages were mostly detected via user reports, dependency cooldowns would create a prisoners' dilemma.
I don't understand what you're saying about reporting mechanisms; is there something wrong with how this is currently done?
- fy20 8mo agoMaybe a better way would be to allow third-parties to certify releases, and you can specify only to pull the package once they've given it the green light.
- jauntywundrkind 8mo agoCathedral or Bazaar on and on. We vary in opinion. IMO we should be using the best easiest information syndication we have for all, that's as decentralized as we can be. That's why I suggested atproto. I believe the Bazaar approach here would be more interesting, and would avoid pressure points of only specific people having the relationships to pull the oh shit alarm.