he/him 
I also trust a multi-billion dollar company with a massive team of security engineers, ops folk, and dedicated data centres over an unprofitable startup
Show this thread
GitHub are in such a good position to improve npm package security drastically. Imagine package releases that are verified against git commits. Impossible to sneak code in.
-
-
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
GitHub “only” manages the repos and package registries, but the actual builds and package publish is done on other services and are still black boxes (i.e. might alter code/inject malicious stuff before compilation).. or am I missing something?
-
I predict that GitHub will offer CI services in the future. It makes sense since they now have access to Azure.
- 2 more replies
New conversation -
-
-
I have been positively surprised so far since Microsoft acquired GitHub. Hopefully these trends continue.
-
Surprisingly I love what Microsoft do these last months
- 2 more replies
New conversation -
-
-
I'm imagining this world where you can enable a flag for certain packages so they can only be published through GitHub actions (a trustable and public pipeline) so we can be 100% sure the code in the repo is what was published. And that's something that is now in GitHubs reach
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Also the next time GitHub is getting DDoSed not only the repositories but also all packages will be down. Awesome: more free time, right?
With all those centralised services: what could go wrong?Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Wondering how they are going to handle old discontinued packages nested deep inside the dependency tree which may have security vulnerabilities
-
I think the fact that all packages will be scoped will make it easier for projects to move over to maintained forks, and at the same time easier for maintainers to tell people to just fork theirs if they want to maintain it (instead of what happened with event-stream).
End of conversation
New conversation -
-
-
how would that be possible while properly gitignoring build output tho
- 4 more replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.