Brendan Zabarauskas on Twitter: "@jonmsterling My worry is it introduces the same possibility for supply-chain attacks that other package managers have (I hope that OPAM has avoided this). Ie. running code that assumes the ‘ambient authority’ when building packages locally." / Twitter

You’re unable to view this Tweet because this account owner limits who can view their Tweets. Learn more

Yeah, this is what I gets me frustrated about OPAM coming from Cargo. I get now that I can use switches and direnv to emulate a similar behaviour, but expecting somebody to know that from the start annoying. I had to read a random post on the OCaml forum to learn that.

3

2

Brendan Zabarauskas

@brendanzab

Jan 20

It's less that I want an integrated package manager+build system, and more that I want better defaults, more convention over configuration, better docs, etc.

1

You’re unable to view this Tweet because this account owner limits who can view their Tweets. Learn more

Brendan Zabarauskas

@brendanzab

Jan 20

Personally I think the reference level docs are really good, and important! But they aren't what's needed when you are starting out: they don't replace guides, tutorials and cookbooks, which are also important.

1

You’re unable to view this Tweet because this account owner limits who can view their Tweets. Learn more

Brendan Zabarauskas

@brendanzab

Replying to

@jonmsterling

My worry is it introduces the same possibility for supply-chain attacks that other package managers have (I hope that OPAM has avoided this). Ie. running code that assumes the ‘ambient authority’ when building packages locally.

10:26 PM · Jan 20, 2022Twitter Web App

Replying to

and

Hoping that the next generation of langs take language-level support for capability-based security more seriously 🙏

1

Conversation