Post-mortem of this weekend's NPM incident

Re:Post-mortem of this weekend's NPM incident by dumbmatter on Thursday January 11, 2018 @02:01PM (#16126692)

Our first action, which began immediately after the incident concluded, was to implement a 24-hour cooldown on republication of any deleted package name.

Why not infinity hours? I don't get it.

[ Parent | on HN ]

Re:Post-mortem of this weekend's NPM incident by Vinnl on Thursday January 11, 2018 @03:22PM (#16127450)

If it's a spam package that gets deleted, that would mean you'd quickly run out of available names.

[ Parent | on HN ]

Re:Post-mortem of this weekend's NPM incident by h1d on Friday January 12, 2018 @06:39AM (#16132150)

Why can't they just reuse when it is apparent the case is harmful (as in, people complain and check number of downloads and dependent packages) by blocking the name and disallow reuse for any other cases?

[ Parent | on HN ]

Re:Post-mortem of this weekend's NPM incident by Vinnl on Friday January 12, 2018 @12:21PM (#16134490)

Hmm, I'm not sure if I can follow your question, but I'm guessing that they're already planning to do what you want?

[ Parent | on HN ]