SebastianVerified account

If I'm not mistaken, npm5 makes yarn obselete: npm5 has fast install, lock file (even better than yarn's), plus nothing extra to install.

Mitm? That's an irresponsible way to describe the simple and common reverse proxy. You should read this: https://en.m.wikipedia.org/wiki/Reverse_proxy …

There's no legitimate technical reason for Yarn to man-in-the-middle traffic to the npm registry. If it's not spyware, it's at least icky

I believe they used to just have a CNAME that pointed to the npm registry but now it's proxying with an A record. Why?

Even if just for analytics, it's not worth the risk. Now if either npm *or* yarn is hacked, you are compromised.

I'm sure @sebmck has good intentions, but does his reverse proxy have all patches applied? At least npm pays for security audits

I think there's still some confusion around how our proxy actually works. We use Cloudflare which is literally reverse proxy as a service.