News for hackers. Stuff that matters.

A comment on GitHub has completed its acquisition of NPM. Parent comment

Re:GitHub has completed its acquisition of NPM by smcnally on Thursday April 16, 2020 @04:06AM (#22887200)
> delays updates from packages that are recently updated under suspicious circumstances

This is an example of the security curation you note earlier. People reviewing flags alongside the code, remediation during the delay, highlighting package authors you like are some of why “Being the canonical registry … tends to be a huge expense.” How many people build and run GitLab Package Registry?

[ Parent | on HN ]
Re:GitHub has completed its acquisition of NPM by sytse on Thursday April 16, 2020 @06:02AM (#22887790)
We don’t know exactly how many people use it since it is open source but I think between 100,000 and 1 million people. The docker container registry is the most popular.

The security curation examples I mentioned are intended to use automated signals so there wouldn’t be an expense for labor. In fact we intend to run them separately on every self managed GitLab installation.

[ Parent | on HN ]