Hacker News Reader

So obviously we have to wonder why TUF hasn't been applied to NodeJS's npm. All I can find is a suggestion that maybe someone from TUF posted to a node mailing list in 2014 [1]. Any more recent info?

[1]: https://groups.google.com/forum/m/?fromgroups#!topic/theupda...

View on HN

AFAIK several language package managers have looked at implementing TUF for their repositories, but the only live implementation that I know of is Docker Content Trust.

I kind of think it's an important part of secure management of libraries. As the Fosshub breach last week showed, software repo's are tempting targets for attackers...

Hackage/Cabal also has at least a partial implementation of TUF.

And opam (OCaml) is working on it too.

I assume that you'd first need a native JS TUF package published to NPM. I don't think that adding another language dependency is a decision that would be taken lightly. Additionally, I don't see any Windows instructions (NB: python-ffi) and Node supports Windows as a first-class citizen.

Reply on news.ycombinator.com