3 ms·

> verified package versions Who is doing this verification?

• cheschire 3mo ago
  And then who watches the watchmen? Chains of authority can always be questioned. I think GP is suggesting that the package management platforms themselves provide the verification if they want to stay in the business of being the de facto source.
• oneshtein 3mo ago
  Those with skin in the game.