'No way to prevent this,' says only package manager where this regularly happens
1–10 of 230 posts
Re: 'No way to prevent this,' says only package manager where this regularly happens
#2[flagged]
Re: 'No way to prevent this,' says only package manager where this regularly happens
#3[deleted]
Re: 'No way to prevent this,' says only package manager where this regularly happens
#4For those unfamiliar with the context: https://en.wikipedia.org/wiki/%27No_Way_to_Prevent_This,%27_...
Re: 'No way to prevent this,' says only package manager where this regularly happens
#5For those unfamiliar with the context: https://en.wikipedia.org/wiki/%27No_Way_to_Prevent_This,%27_...
Same vibe: https://www.youtube.com/watch?v=lOTyUfOHgas
Re: 'No way to prevent this,' says only package manager where this regularly happens
#6With the recent high-profile attacks on PyPI packages, it’s no longer true that npm is the “only package manager where this regularly happens”.
In fact, pip is much more dangerous than npm because it lacks a lockfile. uv fixes that, but adoption is proceeding at a snail’s pace.
Re: 'No way to prevent this,' says only package manager where this regularly happens
#7[flagged]
I read it as a comparison of the attitude of helplessness around it, not the acts themselves. So it was a bit meta, but unremarkably inoffensive.
Re: 'No way to prevent this,' says only package manager where this regularly happens
#8What are the actual guarantees that go/Rust make that Python/npm don’t? It seems like it might just be that Python/npm are juicier targets? I’m starting to try and avoid all third party packages
Re: 'No way to prevent this,' says only package manager where this regularly happens
#9[flagged]
I don't think it's comparing them directly or arguing for equivalent seriousness. It is identifying a similarity of mindset where those who have their hands on the levers of power that could materially improve the situation act like there's nothing they can do.
Re: 'No way to prevent this,' says only package manager where this regularly happens
#10I really don't understand why the npm project cannot embrace PGP as an ambulatory 'good enough' solution.