Hacker Read top | best | new | newcomments | leaders | about | bookmarklet login

For starters, packages should probably be considered non-transferable. If someone buys a package, they shouldn't keep the existing rankings and ratings.

It would be challenging to be proactive about it, but it was be a clear solution when they get caught.



sort by: page size:

I feel like "pick the more popular package" is a good enough solution in this case.

I would never expect them to do that without vendoring the package. Which mitigates that risk.

Not to mention if the package name itself changes...

Yes, but they don't enforce it for new packages.

At least with most packages this can't happen anymore.

If a package owner distributes a wheel, you're good. Most packages do now.


Exactly, so all you could do is trigger certain bundles to be 'unlocked': you would always have to ship them.

I agree, but I see them as a patch to get something that could be more cleanly achieved with a transactional packaging system.

The problem is that no one reviews what goes in the package registries. Unless someone spots the security issue it goes unnoticed and unfixed. Particularly true with new and not very popular packages.

To be fair to the author though this package won't take more than a couple of hours review quickly for potential back doors and if you just want one data structure it's at most in 3 files.


I know. Yet most folks take packages at face value as if it was a part of some standard library.

apt deciding it should yeet essential packages is not a new thing and has happened many times to many people.

But they should have a repo or something where you can get the sources of individual packages. Else it's a bit shady.

That's an interesting idea!

A "vetted" package index that charges subscription and splits the revenue with package maintainers. In return, maintainers agree to jump through all the extra hoops and index maintainers do extra verification (but still no warranty except that the standard procedure is followed).

The same package can then be uploaded to the normal index (as it is now), but without these extra steps, and no vetting.


even when you keep making new accounts and "losing" the packages!

Thanks for the feedback, I'm not that happy with "see the packages" either so I'll probably follow your advice.

Agree about that. And I'm not wild about the idea of having to do a special incantation before using the package system anyway, myself.

Your own mirror of third party packages is definitely the way to go. I'm continuously stunned this is not standard practice.

That would still be the case if the packages weren't 1-3 years out of date.

http://seclists.org/fulldisclosure/2006/Mar/130

Just some food for thought concerning package ecosystems.


What if they were sold as a package deal?
next

Legal | privacy