You can make a system with incentives to:
1 signing packages with long term identity keys
2 protect those keys.
This Tweet was deleted by the Tweet author. Learn more
Conversation
This Tweet was deleted by the Tweet author. Learn more
This Tweet was deleted by the Tweet author. Learn more
And if this person asked for ownership and checked out owner just handed over keys?
1
They may have done that. It may have made it clearer to them that they were transferring over a lot of trust to someone else, and they might have taken it more seriously and used a different approach. It can be helpful to have more friction for something like this.
1
1
I doubt the friction will be significantly greater than the UX to transfer GitHub repo ownership.
1
That's true, but I have the (perhaps wrong) impression that most people would take handing over control of a signing key more seriously than a repository on GitHub or a package on npm. It very explicitly involves trust / security so it's harder to ignore what should be obvious.
2
1
I get the impression that the original developer didn't deeply consider any security implications of handing over control. Maybe they would have just handed over a signing key too. I don't get the impression they acted in bad faith and deliberately put people at risk though.
1
The same thing can happen due to a bad / reused password. They're trusting the password choice of all the dependency authors too. Of course, a developer could also had their computer compromised, etc. Having a hundred dependencies from unknown / unfunded developers is a problem.