Untitled attachment

Notices where this attachment appears

1. Christine Lemmer-Webber (cwebber@octodon.social)'s status on Tuesday, 27-Nov-2018 21:39:53 UTC Christine Lemmer-Webber

   another npm package with wide deployment backdoor'ed: https://news.ycombinator.com/item?id=18534392 https://blog.bitpay.com/npm-package-vulnerability-copay/

   There are two paths to mitigating this stuff, which both should be taken:
   - Focus on auditable and reproducible packages. Sadly, mostly impossible with NPM, which is one of the worst language package environments: https://dustycloud.org/blog/javascript-packaging-dystopia/
   - Introduce ocap security into the ecosystem. Probably won't happen but MarkM explained how: https://www.youtube.com/watch?v=9Snbss_tawI&list=PLKr-mvz8uvUgybLg53lgXSeLOp4BiwvB2&index=25&t=0s

   Friends don't let friends use npm.