Ask HN: Why does every package+module system become a Rube Goldberg machine?

Re:Ask HN: Why does every package+module system become a Rub... by jakewins on Monday January 30, 2023 @10:56AM (#34581393)

Java enforces domain name ownership as well; I can’t publish to maven central under io.netty.

This removes a whole slew of attack surfaces that JS and Python have, and leverages an existing “prove you are who you say you are” infra

[ Parent | on HN ]

Re:Ask HN: Why does every package+module system become a Rub... by tsimionescu on Tuesday January 31, 2023 @12:58PM (#34598857)

Note that Maven Central only imposes this once when creating a new artifact - which is, I believe, much better than Go, which imposes this for every go mod download.

The advantage being, if you later lose access to the DNS domain that you used to publish an artifact to Maven Central, the new owner doesn't automatically get to compromise your artifact for all (new) users.

[ Parent | on HN ]