7 ms·
It’s on by default in yarn 4 too now, but pnpm was the first to market that default minimum gate. https://github.com/yarnpkg/berry/pull/7135 https://github.com
by vinnymac 4mo ago
It’s on by default in yarn 4 too now, but pnpm was the first to market that default minimum gate.
https://github.com/yarnpkg/berry/pull/7135 https://github.com/yarnpkg/berry/pull/7135
- user3939382 4mo agoIf this were a universal default, would the strategy defeat itself?
- Normal_gaussian 4mo agoNo. Many places run analyzers on published code; many security users have reason to shorten the period. The default period becomes the period where white hats have a chance to detect it and stop it passing the threshold.
- zwily 4mo agoEven if everyone used it, the security scanners would still have time to do their static analysis of new packages. Basically, all the clients implementing a delay would create a de facto quarantine status for new packages so they can be examined before everyone starts installing them. (Why npm doesn't just implement that themselves, I do not know.)
- user3939382 4mo agoThen shouldn’t the analyzers just be part of NPMs acceptance requirements?
- zwily 4mo agoThat’s my point. For whatever reason, npm isn’t doing it. All npm users adding a minimum package age is kind of like doing it as a collective, without npm’s help.
- _flux 4mo agoI think if they did it, then attackers would be able to iterate their attack against their own project, and once it passes the filters they could deploy for real. I guess it could work better if it was enabled for only actual attack vectors projects.