Malicious crossenv package on npm

Re:Malicious crossenv package on npm by KirinDave on Wednesday August 02, 2017 @12:20PM (#14911873)

I don't understand why you feel that the keybase question was directed at you. The decision to enter into this part of the discussion definitely hurt otherwise interesting post.

It's true that a signature is based around a component with longer lifespan than a hash. However the management and trust of that component damages this argument severely.

I am unaware of any web of trust in active use that could operate a npm scale existing today. Could you share one with me?

[ Parent | on HN ]

Re:Malicious crossenv package on npm by graphememes on Wednesday August 02, 2017 @04:21PM (#14914224)

Because it was a direct reply to the individual. If used as an example you should give context, otherwise your comments are directed towards who you reply to.

[ Parent | on HN ]

Re:Malicious crossenv package on npm by KirinDave on Thursday August 03, 2017 @12:47AM (#14917016)

I didn't reply to lmm. I asked that question of danjoc.

Is that not obvious from scrolling?

[ Parent | on HN ]