Hacker News Reader

I think "deleted" is still always going to have to be a package state, realistically. A package could contain spam, abuse, copyright infringement and/or illegal content.

I don't mind malware being lumped in to that - the place to look up code for historical or analysis reasons ought to be version control, not crates.io

View on HN

What about the place to look up packaged binary releases for historical or analysis reasons, esp. when the packaging system either builds such releases itself, or where it allows the submission of arbitrary build artifacts (where the build process that produced said artifact can be compromised in ways that have nothing to do with the source repo)?

> the place to look up code for historical or analysis reasons ought to be version control, not crates.io

The build infrastructure should make security incidents easier to respond to, not harder. I shouldn't be sent on a wild goose chase at a time when I'm potentially already dealing with a major incident. The tools need to "just work".

Reply on news.ycombinator.com