Re:Malicious code in the purescript NPM installer
by LoSboccacc on Monday July 29, 2019 @04:01AM
(#20552428)
> this change of ownership is an implementation detail that doesn't need to impact package consumers
it does, because having a dependency means having a trusted path from the developer to the packager to the repository into your software and to your customers
frankly you'd want to do what you call "constant pointless churn" at every single version update, because god knows what comes trough your package manager, as this and many other articles pointed out repeatedly, and the fact that you are advocating to skip it not for version changes but for whole ownership changes is the opposite of a security oriented mindset.
it does, because having a dependency means having a trusted path from the developer to the packager to the repository into your software and to your customers
frankly you'd want to do what you call "constant pointless churn" at every single version update, because god knows what comes trough your package manager, as this and many other articles pointed out repeatedly, and the fact that you are advocating to skip it not for version changes but for whole ownership changes is the opposite of a security oriented mindset.