4 ms·

I really don't understand why the npm project cannot embrace PGP as an ambulatory 'good enough' solution.

• loloquwowndueo 5mo ago
  The NIH mentality in the ecosystem would result in a JavaScript pgp library which itself would be an npm package and subject to supply chain attacks. lol.
  • panzi 5mo ago
    A good part of it is already implemented in web crypto, which is supported by browsers and node. There is a chance that npm could implement something there without extra dependencies. Maybe I'm too optimistic?
• Gigachad 5mo ago
  Would that help? Most of these recent attacks, the attackers have gained access to the system that builds the packages. So it would have just signed the malicious build the same.
  • raggi 5mo ago
    nope, doesn't help. signatures and removal of script points have zero net effect on the value of the target that the ecosystem has, or how easy/hard it is to write a worm. the package code gets run, this is statistically true, and the exploited developers/environments will sign packages, this is also statistically true.
  • Macha 5mo ago
    In some ways the push towards trusted publishing has made these attacks more likely as the credentials are sitting in a standardized, always on CI system, rather than in a locked down corporate CI system for big packages or a developers machine or developers head for smaller open source packages.
• saghm 5mo ago
  Probably the same reason that pretty much no other package manager (or even major email provider, when email is ostensibly the most famous use-case for it) has adopted it: the UX is atrocious.
  • Macha 5mo ago
    Basically all Linux distro package managers?
    • saghm 5mo ago
      That's fair, distro package managers use it. I don't know of any language that uses it though; I think NuGet uses certificates for signing rather than PGP.
    • exabrial 5mo ago
      All of maven central? Is that also significant enough (as well)? NIH nihilism