3 ms·
They say this is 'peer-reviewed' but is that all? If someone sends them a pull request for an update to a widely used but perhaps smaller library, will they rev
by po 14y ago
They say this is 'peer-reviewed' but is that all? If someone sends them a pull request for an update to a widely used but perhaps smaller library, will they review it or does it just get merged into the CDN? It seems like a good way to get access to millions of browser sessions. Is anyone in Cloudfare taking responsibility for checking that the code is coming from the authoritative repo and not joeblow/underscore.js?
https://github.com/cdnjs/cdnjs#pull-requests-steps https://github.com/cdnjs/cdnjs#pull-requests-steps
While Google and Microsoft are slower to update their libs, we can assume that they are downloading releases from official sources.
- thomasfromcdnjs 14y agoContributors generally include the links to the official sources. If not we track down the official repositories ourselves. Once we have verified the source, we then check the diff against the submitted and official. We have always flirted with the idea of a level of automation to handle this. But your comment addresses the problem with a solution such as that so we are still manually diff checking for maximum security.