Hacker News Reader

No, you just mirror CPAN. This is already done in lots of shops I know of for PyPI. IME, I've only ever had PyPI down on me once, and there are mirrors (that are usually up) if that is ever the case[0]. I think localizing dependencies as you say is a waste of time.

[0]: http://jacobian.org/writing/when-pypi-goes-down/

View on HN

Sure, so now instead of praying that the main host won't get hacked you now should pray that none of the N mirrors will get hacked.

And if you understand the basics of probability, that's not a good scenario.

I do understand the basics of probability. The likelihood of your serving infrastructure or application being compromised is an order of magnitude higher than the most popular repositories in software development. I'm not saying it doesn't happen, but I also don't walk around worried about having an asteroid land on me simply because I understand probability. If it happens, it happens, and we deal accordingly, but using a much more difficult software engineering process because of (arguably) paranoia is silly.

And, that the package(s) you're trojaning aren't signed[1] (I'm not immediately sure if new releases are automagically signed/digested when uploaded via PAUSE, or what fraction of currect packages are signed)

[1] http://search.cpan.org/~dagolden/CPAN-1.94_65/lib/CPAN.pm#Cr...

Reply on news.ycombinator.com