Many people here say that slowing down is a must -- and I agree it's probably the best solution -- but surely there are more approaches we could think of:
* Not allowing packages with similar names to popular ones
* Not allowing packages creation to be anonymous (in the extreme case you would require to validate your passport or similar)
* Automatic detection of malicious code
* Central auditing organization
...
This is just on top of my head, there must be many more ideas.
* Not allowing packages with similar names to popular ones
* Not allowing packages creation to be anonymous (in the extreme case you would require to validate your passport or similar)
* Automatic detection of malicious code
* Central auditing organization ...
This is just on top of my head, there must be many more ideas.