Npm install could be dangerous

Re:Npm install could be dangerous by raesene5 on Monday January 26, 2015 @11:18AM (#8947763)

that's interesting. Any pointers to package stores that do a better job on security? I'm researching the area a bit at the moment and I've not seen a lot of good practice out there, so would be interesting to have some good examples to hold up.

[ Parent | on HN ]

Re:Npm install could be dangerous by nailer on Monday January 26, 2015 @12:13PM (#8948138)

Fedora and RHEL have had mandatory signing since before either existed (back when it was RHL).

Debian has had what we'd call 'EV' level security these days for about 15 years - people bringing their passports in and reading out their GPG public keys at LUGs.

[ Parent | on HN ]

Re:Npm install could be dangerous by thinkmoore on Monday January 26, 2015 @11:32AM (#8947859)

We haven't developed far enough for a package store at this point, but this is one of the use cases we're hoping to explore as part of our capability-based shell scripting language: shill-lang.org.

[ Parent | on HN ]

Re:Npm install could be dangerous by raesene5 on Monday January 26, 2015 @11:36AM (#8947880)

cool. If you're looking for thoughts about threat models and ways to do it http://theupdateframework.com/index.html seems to have some good info.

[ Parent | on HN ]