Hacker News new | ask | show | jobs
by tiredofcareer 4789 days ago
No, you just mirror CPAN. This is already done in lots of shops I know of for PyPI. IME, I've only ever had PyPI down on me once, and there are mirrors (that are usually up) if that is ever the case[0]. I think localizing dependencies as you say is a waste of time.

[0]: http://jacobian.org/writing/when-pypi-goes-down/
1 comments
kkowalczyk 4789 days ago
Sure, so now instead of praying that the main host won't get hacked you now should pray that none of the N mirrors will get hacked.

And if you understand the basics of probability, that's not a good scenario.

link
tiredofcareer 4789 days ago
I do understand the basics of probability. The likelihood of your serving infrastructure or application being compromised is an order of magnitude higher than the most popular repositories in software development. I'm not saying it doesn't happen, but I also don't walk around worried about having an asteroid land on me simply because I understand probability. If it happens, it happens, and we deal accordingly, but using a much more difficult software engineering process because of (arguably) paranoia is silly.
link
shabble 4788 days ago
And, that the package(s) you're trojaning aren't signed[1] (I'm not immediately sure if new releases are automagically signed/digested when uploaded via PAUSE, or what fraction of currect packages are signed)

[1] http://search.cpan.org/~dagolden/CPAN-1.94_65/lib/CPAN.pm#Cr...

link