Hacker News Reader

Comment by ricardobeat | Hacker News Reader

The author of event-stream on npm got so much flak for handing out the package when he couldn't maintain it anymore, yet I see no mention of any concerns here. Aren't the same risks of malicious takeover present, or is the python module environment somehow safer?

View on HN

This is actually a much more responsible way to go about it than the event-stream issue, since it is being done in a public forum (Github issues). Event-stream was given away over an Email without an announcement [0].

Of course, the risks are still there for malicious takeover, but I think will be minimized due to the owner's notoriety and the amount of press this has already seen just on GitHub. I am pretty sure the maintainers of Pip will be keeping an eye on this over the next few months in case of intervening.

[0] https://github.com/dominictarr/event-stream/issues/116#issue...

If I recall, the flak wasn't around handing off the package. The flack was for the lack of due diligence in picking a new maintainer. The same risks are present for sure but at least the process is taking place in the open.

Yeah, it was this really. The author had largely abandoned the project, someone emailed him asking for it (who had no github presence whatsoever), and the author obliged.

Here, there's in theory the effort that the people being given the project have been more vetted and have to have some amount of github presence to get a repo.

Reply on news.ycombinator.com