Friendly reminder, every time this happens...
https://github.com/npm/npm/pull/4016
"However, this is just a piece of an overall solution, and it brings with it a lot of the baggage that comes along whenever GnuPG or PGP get involved. Without a web of trust (sigh), a PKI (ugh), or some other mechanism to tie identities to trust metrics, this is essentially a complicated, very expensive, and fragile version of the shasum check npm already has."
I really like how the NPM simultaneously insults two legends in crypto and does _nothing_ to protect the node ecosystem, deferring to "better solutions" that don't exist and will never exist.
They've done literally nothing.
https://github.com/node-forward/discussions/issues/29
Last discussion was > 1 year ago. They simply do not care. Security isn't even an afterthought.
https://github.com/npm/npm/pull/4016
"However, this is just a piece of an overall solution, and it brings with it a lot of the baggage that comes along whenever GnuPG or PGP get involved. Without a web of trust (sigh), a PKI (ugh), or some other mechanism to tie identities to trust metrics, this is essentially a complicated, very expensive, and fragile version of the shasum check npm already has."
I really like how the NPM simultaneously insults two legends in crypto and does _nothing_ to protect the node ecosystem, deferring to "better solutions" that don't exist and will never exist.
They've done literally nothing.
https://github.com/node-forward/discussions/issues/29
Last discussion was > 1 year ago. They simply do not care. Security isn't even an afterthought.