Hacker News Reader

I think a (regulated, secure) npm for postgres would be great, that works from inside the postgres toolchain.

https://database.dev/ from Supabase does this :)

I'm not sure what regulated means (eventual consensus?), but I think *from inside the Postgres toolchain* is important.

For context, there are a few efforts in progress. I'm sure there are more. - https://pgxman.com - https://pgt.dev - pgxn v2: https://github.com/orgs/pgxn/projects/1/views/1

With regulated I mean, curated by a group of postgres committers for example. I do think extensions inside postgres are very prone to supply chain attacks, so it should not be managed the way npm is.

How npm is regulated? Anybody can publish their package on npm as they can do on GitHub. There is no up-front review on npm. Only packages that are clearly harmful to the community are removed from npm.

Yes, as I wrote, npm is not regulated.

Reply on news.ycombinator.com