Re:Malicious code in the purescript NPM installer
by neilv on Sunday July 28, 2019 @05:15PM
(#20549877)
I should've been more clear about what I was saying with "control". The recommendation is connected directly to domain names you control. What was not done at the time was enforcing that, or using that as a basis of authentication or distribution, which is part of why I said more could be done, today.
[ Parent
| on HN ]
Re:Malicious code in the purescript NPM installer
by pvg on Sunday July 28, 2019 @05:47PM
(#20549999)
The purpose of the scheme was to make namespace collisions less likely and that's about it, though. And people regularly deviate from it, both then and now. Not using it as a basis for authentication or distribution probably remains a really excellent idea.