alt Hacker NewsI don't think even VSCode does this. Probably not even any package managers I know of? Code signing, yes, but not for organization verification? It's pretty much like a username - anyone can claim it if it is unclaimed?
edit: VSCode has a verified marker for publishers but I don't know how that works or if Cursor does the same.
Replies
skydhash • today at 2:30 AM
> Code signing, yes, but not for organization verification
They don’t do organization verification, but they do verify where code comes from. You may be sure that packages are built by alpine, which made sure that the dist files comes from the sources that the maintainers added, and the latter ensure that the sources are correct. In truth, it’s a very small circle of trust.
feross • today at 5:59 AM
[flagged]
This is a solved problem, just look at how EFF's certbot works. You cannot just claim that you are porn.com unless you put a payload there that matches what the bot expects.