Show HN: Pgsh – branch Postgres like Git

Re:Show HN: Pgsh – branch Postgres like Git by SahAssar on Tuesday November 26, 2019 @05:52PM (#21643564)

The part you leave out of that explanation is that for those files and folders there are 179 authors to trust for all future changes (including adding more authors via granting access to their repo or adding more deps).

Sure, you can do locking, but that does not go deep well, and also turns into a hell of trying to determine if every (for your use-case) pointless release of a sub-dep is worth updating to.

[ Parent | on HN ]

Re:Show HN: Pgsh – branch Postgres like Git by marcus_holmes on Tuesday November 26, 2019 @07:29PM (#21644193)

This. am I really expected to review every change that 179 authors make to 242 packages?

And if I don't, am I responsible for the malicious code insertion, or is NPM going to take responsibility for that?

[ Parent | on HN ]

Re:Show HN: Pgsh – branch Postgres like Git by SahAssar on Wednesday November 27, 2019 @07:04AM (#21647181)

You are responsible for malicious code insertion either way.

If you delegate trust in any way, you are responsible for how that trust was (mis)used.

[ Parent | on HN ]