Hacker News Reader

What is missing here is an understanding of IPNS, which sits on top of IPFS and allows us to rename nodes and redirect things if the circumstances warrant.

https://groups.google.com/forum/#!topic/ipfs-users/fr6dlQ8we...

The same way you'd handle a trojan module in a statically-linked project; you remove the trojen and republish. It's a issue with linking rather than dependency satisfaction.

Someone publishing a trojan module can be solved in a number of way. Probably the simplest way is to just republish the module and tell people the previous one is bad. You can also provide an optional blacklist (similar to how adblocking blacklists works) where the bad hash would be if needed.

With signing, you would revoke the keys used for the signing.

Fortunately, because everything is a cryptographic sum, it would be trivially easy to state "IPFS Hash Qm....... is a trojan, please sanitize this hash on all machines".

I would expect things like this coming from CERT or other security researchers in the coming months/years.