3 ms·
Why not just release escrow? If I try to push a new release version another developer or developers have to agree to that release. In larger projects you woul
by themafia 7mo ago
Why not just release escrow? If I try to push a new release version another developer or developers have to agree to that release. In larger projects you would expect the release to be coordinated or scheduled anyways. Effectively we're just moving "version pinning" or "version delay" one layer up the release chain.
- habinero 7mo agoA lot of libraries are maintained by a single person.
- themafia 7mo agoAre those the ones typically involved in supply chain attacks? There are no perfect solutions; but, let's be reasonable.
- ArcHound 7mo agoActually, yes, they are the prime targets: https://en.wikipedia.org/wiki/Npm_left-pad_incident https://en.wikipedia.org/wiki/Npm_left-pad_incident or seemingly https://en.wikipedia.org/wiki/XZ_Utils_backdoor https://en.wikipedia.org/wiki/XZ_Utils_backdoor as well.
- themafia 7mo agoxz has dozens of contributors and two active maintainers. It was the actual example I was thinking of. The code was submitted by a third party and not a result of a developer machine compromise. left pad wasn't a security incident. It was a capitalism incident.